The Privacy Act and our disclosure regulations require that we have the prior written consent of an individual before disclosing information about him or her to a third party, unless one of the 12 Privacy Act exceptions applies. These exceptions permit disclosure without an individual’s consent when the request meets certain requirements. For a complete list of the Privacy Act exceptions, see GN 03301.099D.

SSA has specific requirements in our disclosure regulations (20 CFR 401.100) and policies (GN 03305.003D in this section) for what represents a valid consent. We will provide information to a third party based on an individual’s signed consent as long as the consent document meets these requirements. If the consent fails to meet these requirements, we will return it to the third party with an explanation of why we cannot honor it. We can honor a new consent document from the same requester once it meets our requirements.

We use queries for internal, administrative use. We do not routinely disclose these queries to third parties based on an individual’s consent. For further information concerning the disclosure of queries, see GN 03305.004.

All consent documents must meet each of the seven requirements listed below. If the consent does not meet these requirements, return the consent document to the requester with an explanation of why we cannot honor it. All consent documents, including the Form SSA-3288 must:

1. 1. 

   Specify the first and last name, Social Security Number, and date of birth of the individual who is the subject of the requested record(s);

2. 2. 

   Include a legible signature or mark “X” below the requested information and be dated by the individual who is the subject of the requested record(s) or someone who can consent on behalf of that individual (GN 03305.005). If signed by mark “X,” two witnesses who do not stand to gain anything from the disclosure must sign the consent and provide their full mailing addresses;

3. 3. 

   Specifically state that SSA may disclose the requested information. A consent document that also authorizes other entities to disclose information is acceptable as long as it identifies SSA as one of the entities;

4. 4. 

   Specify the first and last name and address of the person or organization to whom we should send the requested information;

5. 5. 

   Describe the requested record(s) in enough detail for us to locate the record(s);

6. 6. 

   Specify the purpose for which the requester will use the information. This helps us ensure the individual has informed consent and determine if we must charge a fee for providing the information if it is a non-program related request; and

7. 7. 

   Specify a time frame during which we may disclose the information. We will process the request as a one-time-only disclosure if the requester does not specify a time frame during which the consent is valid. If a requester wants us to disclose information on an ongoing basis (each month for 6 months, or quarterly, or annually) using the same consent document, they must submit a copy of the original consent document with each subsequent request for disclosure of that same information. For additional information, see GN 03305.002, Item 4.

   NOTE: The time frame for the receipt of a consent is not the same as the time frame for the duration of a consent. For information concerning the time frame for the receipt of consents, see GN 03305.003G in this section.

The Internal Revenue Code (IRC) governs the disclosure of all tax return information. For examples of SSA record information that are also considered tax return information, see GN 03320.001D.1. In addition to the SSA consent requirements listed in GN 03305.003D in this section, IRS regulations require individuals to meet two additional requirements before we disclose tax return information:

1. 1. 

   An individual may not combine a request for tax return information with a request for non-tax return information on the consent document, or the consent document is invalid.

   Individuals must submit a separate consent document to authorize the disclosure of tax return information, such as earnings records. For example, we receive one consent document authorizing the disclosure of detailed earnings information and medical records. We cannot accept this consent document. Individuals must submit a separate consent document for the disclosure of the detailed earnings information. Therefore, the preferred consent documents in this instance would be form SSA 3288 authorizing the release of medical records and form SSA 7050-F4 authorizing the disclosure of the earnings information. The SSA-7050-F4 meets the IRC’s required consent authority for disclosing tax return information. (It is permissible to disclose the medical information based on the original consent if it meets our requirements.)

2. 2. 

   The consent document must include:

   • •

     The taxpayer's identity;

   • •

     Identity of the person to whom disclosure is to be made;

   • •

     Type of return information;

   • •

     Taxable period; and

   • •

     Signature of taxpayer and the date the authorization was signed.

3. 3. 

   We must receive the consent document authorizing the disclosure of tax return information within 120 days from the date the individual signs the consent document to meet the IRS time limitation for receipt. Use the fee schedule shown on the SSA-7050-F4 to determine the fee for processing requests for detailed earnings information for non-program purposes. The SSA-7050-F4 advises requesters to send the form, together with the appropriate fee, to the address printed on the form. Do not send an SSA-7050-F4 or other request for detailed earnings information for processing without the appropriate fee, unless the request clearly indicates that the requested earnings information is for a program purpose.

Direct individual requests for summary yearly earnings totals to our online application, “My Social Security” at www.socialsecurity.gov/myaccount. For additional information about requests for earnings and disclosing tax return information, see GN 03320.005A and GN 03320.010B.

We will accept a printed signature if the individual indicates that this is their usual signature. In addition, we will accept a mark “X” signature in the presence of two witnesses who do not stand to gain anything by the disclosure. Each witness must sign the consent document and provide their full mailing address. FOs offices should use current office procedures for acknowledging receipt of and verifying documents.

For further information concerning who may provide consent, see GN 03305.005.

The following time-frame limitations apply to the receipt of a consent document:

We prefer that consenting individuals use the current version of the SSA-3288. However, we will accept equivalent consent documents if they meet all of the consent requirements described in GN 03305.003D and GN 03305.003E in this section, as applicable. For example, we will accept the following types of consent documents that meet the agency’s requirements:

1. 1. 

   All versions of the SSA-3288 are acceptable if they meet all of the consent requirements for disclosure, as applicable. Return any other consent document that does not meet our requirements to the third party with an explanation of why we cannot honor it. If you return an earlier version of the SSA-3288 to the requester because it is not completed correctly, also provide the most current version of the form.

   NOTE: The address and telephone number of the consenting individual are not mandatory on Form SSA-3288 or other consent forms for the consent to be acceptable. This information assists SSA in contacting the consenting individual if there are questions about the form, but if it is missing from the SSA-3288 or other acceptable consent forms, accept the form anyway.

2. 2. 

   Fill-in forms are acceptable only if they meet all of the consent requirements, as applicable;

3. 3. 

   Photocopies, faxed copies, and electronic mail (we encourage that the public limit the amount of personally identifiable information in email correspondence) of consent documents, including the SSA-3288, are acceptable if they bear the consenting individual’s written signature and do not appear altered or otherwise suspicious (offices must use their own judgment in these instances);

4. 4. 

   A consent document patterned after the SSA-3288 or an imitation copy of the SSA-3288 is acceptable if it contains all of the consent requirements, as applicable;

5. 5. 

   A power of attorney document for the disclosure of non-tax return information is acceptable only when the power of attorney document bears the signature of the consenting individual and contains all of the consent requirements, as applicable;

6. 6. 

   A consent document received within one year from the date of the consenting individual’s signature for non-tax return and non-medical records information is acceptable as described in subsection GN 03305.003D in this section;

7. 7. 

   A consent document that specifies the time frame for which we may disclose information is acceptable. If using the SSA-3288, the consenting individual may indicate specific time frames in the space allotted for the purpose; and

8. 8. 

   A consent document that adequately describes all or any part of the information for release above the consenting individual’s signature is acceptable.

Consent documents are unacceptable when the following conditions exist:

1. 1. 

   The SSA 3288 is unacceptable if the form number (SSA-3288) or the OMB control number (OMB No. 0960-0566) is missing, or it appears altered or suspicious (offices must use their own judgment in these instances), or it does not meet the consent requirements, as applicable;

2. 2. 

   The SSA-3288 is unacceptable if the list of SSA records information on the form appears altered, replaced, or deleted (offices must use their own judgment in these instances);

3. 3. 

   A consent document is unacceptable if the requested information does not appear above the written signature or mark (X) of the consenting individual. However, we may provide any part of the requested records appearing above the consenting individual’s signature if the consent documents satisfies the rest of the requirements in GN 03305.003D and GN 03305.003E in this section;

4. 4. 

   A consent document is unacceptable if the consenting individual’s (or witnesses’) signature and date of signature, or both are missing, unrecognizable, unclear, illegible, appears traced or otherwise suspicious (offices must use their own judgment in these instances);

5. 5. 

   A consent document is unacceptable if the individual indicates “any and all records,” “my entire file,” “all my records” or similarly worded phrases. All requesters must specifically indicate the form number or title of the specific record or information for disclosure or describe the requested information in enough detail to enable us to locate the requested information. If the consent document specifies certain records or information for disclosure and also indicates “my entire record” or similar wording, disclose only the specific information that was requested;

6. 6. 

   A consent document is unacceptable if the overall general appearance of the document appears suspicious (offices must use their own judgment in these instances); and

7. 7. 

   A consent document is unacceptable if the time frame for disclosing the particular type of information has expired. For the time limitations that apply to the receipt of consent documents, see GN 03305.003G in this section.

If any of these conditions exist, return the consent document to the third party with a written explanation of why we cannot honor it. We will accept a new consent document from the same requester for the same information once we receive a consent that meets our consent requirements in GN 03305.003D or GN 03305.003E in this section, as applicable. For subpoenas and court orders, with or without consent, see GN 03330.015.

An individual may submit an SSA-3288 (or equivalent) to request the release of their medical records to a third party. However, the Privacy Act and our related disclosure regulations permit us to develop special procedures for the disclosure of medical records, including psychological records, pertaining to an individual.