A third party entity, authorized by a State or local government agency, to act on its behalf under certain conditions. (For information about these disclosures, see GN 03314.001F in this section.) An agent is also known as a contractor.

The release or showing of personal information about an individual to a third party. Individuals who have access rights to a number holder’s records are not considered third parties for purposes of disclosure. For example, a parent of a minor child or the court-appointed guardian of an incompetent adult may make an access request.

Any non-commercial program, such as Medicare and Medicaid, administered by a government agency that is designed to provide an individual with health care (both prevention and treatment), or to subsidize the cost of such care.

Any non-commercial program administered by a government agency that is designed to provide an individual with basic necessities of life, such as food, clothing, shelter, and utilities, or supplement the individual’s income to permit the purchase of such necessities. Loan programs of any type, even if subsidized by a government, such as the Department of Housing and Urban Development or another government agency, are not income-maintenance programs for disclosure purposes. Examples of State income-maintenance programs include:

• •

  subsidized housing;

• •

  Supplemental Nutritional Assistance Program;

• •

  Temporary Assistance for Needy Families;

• •

  general assistance;

• •

  Title XX services;

• •

  fuel subsidies;

• •

  workers’ compensation;

• •

  unemployment compensation;

• •

  government pension programs; and

• •

  State supplementation.

The principle of disclosing only the minimum information that is relevant and necessary to accomplish the purpose for which information is requested.

For the definition and examples of non-tax return information, see GN 03320.001D.2.

Any item, collection, or grouping of information about an individual an agency maintains, including, but not limited to: education, financial transactions, medical history, and criminal or employment history. A record contains the individual’s first and last name, Social Security Number (SSN), or other identifying particulars assigned to the individual, such as a finger or voice print, or a photograph. 5 U.S.C. § 552a(a)(4).

The disclosure of a record, without the consent of the individual to whom the record pertains, for a purpose that is compatible with the purpose for which we collected the record. 5 U.S.C. § 552a(a)(7).

Our statements of routine uses can be reviewed in the “routine use” section of each of our systems of records. New routine uses must be published in the Federal Register.

A group of records, under our control, from which we retrieve information by the first and last name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. 5 U.S.C. § 552a(a)(5).

You can find a listing of all of our systems of records and their routine uses here: https://www.ssa.gov/privacy/sorn.html.

For the definition and examples of tax return information, see GN 03320.001D.1.

If a procedure for handling a request is discussed in any section of GN 03314.000, follow that procedure.

If a request for information from a State or local agency does not meet our criteria for disclosure as discussed in subchapter GN 03314.000 or any other chapter in GN 03300.000, handle the request as a potential Freedom of Information Act (FOIA) denial and follow the procedures in GN 03350.005B.3.

FOs or other components should consult with regional the Privacy Act Coordinators (PAC) for questions concerning the appropriateness of a disclosure. As necessary, PACs should consult with the Office of Privacy and Disclosure (OPD).

Upon receipt of a disclosure request from a State or local agency, take these actions to analyze the request:

• •

  ensure the requester identifies the specific information the State or local agency is requesting;

• •

  identify the system(s) of records that controls the collection and disclosure of the requested information; and

• •

  determine if the applicable system(s) of records contains a routine use that permits the disclosure of the information, without consent, to the requesting agency.

A large majority of disclosures to State and local agencies are permissible under our health maintenance and income maintenance routine use (disclosure of our data to State and local agencies that administer health maintenance and income maintenance programs that are similar to the programs that we administer). For more information on these programs, see GN 03314.005.

When we receive disclosure requests from State and local agencies via telephone, follow the requirements in GN 03360.005A.8. When the caller does not know the SSN of the number holder whose record they are requesting, do not provide the SSNs or any other personal information over the telephone, via fax, or by email. See guidance in GN 03360.005A.1.b.

Our policy on the use of email conforms to the National Institute of Standards and Technology’s Special Publication 800-45, “Guidelines on Electronic Mail Security.” We are not permitted to transmit personally identifiable information (PII) outside of our firewall unless the email is encrypted. We have established secured network connections with some agencies that enable us to use encrypted email that includes PII to conduct agency business.

The Office of Information Security maintains a full, updated list of SSA secure partner agencies. Sending PII via email must be done in accordance with SSA policies and procedures. For more information regarding the use of encrypted email for business purposes, refer to the Information Security Policy.

State or local agencies may submit requests to FOs for a variety of reasons:

• •

  there is no formal data exchange arrangement in place with the requesting agency;

• •

  it is a singular request;

• •

  the request is for an emergency situation or a law enforcement purpose; or

• •

  the information the agency is requesting is available only manually.

FOs are staffed to assist the local population base. Each FO services a certain number of zip codes and assists individuals and third party requesters in the office’s designated service area. While a beneficiary may visit any FO and receive service, a third-party requester (public or private) should seek service from the FO servicing the inquired-about individual’s mailing zip code. For more information on determining appropriate servicing offices, see GN 00904.010. For sample language to use when a third party requests information from an FO outside of its servicing area, see GN 03305.020.

When handling a disclosure request, FOs should determine how the request impacts their resources and normal operations and, as necessary, seek guidance from the regional office, through the regional PAC.

We have established electronic data exchanges to facilitate routine use disclosures of information to State and local agencies. For example, we have a number of data exchange agreements in effect with State agencies that administer health maintenance and income maintenance programs. These data exchanges are the most efficient and cost-effective means of providing information to State and local agencies that need our information on an ongoing basis. We should direct State and local agencies requesting information from FOs to these data exchanges. As necessary, FOs may consult with the regional Data Exchange Coordinator or PAC to determine if we have a data exchange in effect with a particular State or local agency. Central offices components should contact the Office of Data Exchange and Policy Publications. For information on the data exchange systems through which we exchange data with State and local agencies, see GN 03314.155.