1. Who Should Handle the Request
The servicing FO with access to the requested information should process the request.
If the information is not available electronically, the servicing FO should request
the file following the instructions in GN 03305.015 .
Third party requesters must direct their requests to the FO that services the mailing
zip code of the individual who is the subject of the request. If an FO receives a
third party request about a subject outside of its servicing area, return the request
to the requester using the sample language in GN 03305.020.
EXCEPTION: Subpoenas are binding on the office that receives them. See GN 03330.010 and GN DAL03330.015.
2. Review the Consent Form
Review the consent form for compliance with the criteria in GN 03305.003. A consent document must meet all of the requirements in GN 03305.003D. It must be received within the timeframes shown in GN 03305.003G. See GN 03305.003B for consent form signature requirements. See GN 03305.005 and GN 03305.006 for who may and may not consent.
If the consent form does not meet all of the requirements for disclosure, return the
consent document to the requester with a written explanation of why we cannot honor
it per GN 03305.003I. If the consent form meets the requirements, scan the SSA-3288 into the electronic
folder to meet the retention requirement (GN 03305.010) and continue processing the request following the instructions below.
NOTE: There are limited situations under which we can disclose records to third parties
without consent. See the following POMS references for SSA’s policies on disclosure
without consent.
GN 03312.000 Disclosure of Law Enforcement Purposes
GN 03313.000 Disclosure to Federal Agencies and Officials
GN 03314.000 Disclosure to State and Local Agencies and Tribal Authorities
GN 03315.000 Disclosure Concerning Deceased or Missing Persons
GN 03316.000 Disclosure to Administer SSA Programs and Other Miscellaneous Disclosures
Ask the CDPS Privacy Act Coordinator if you have questions about these types of requests.
The name of the current Privacy Act Coordinator is listed on the Dallas CDPS Programs Support Topics list.
3. National Records Center Folder Certification Request Process
In most cases, FOs should use the National Records Center (NRC) Folder Certification
Request process for certified records requests. Follow the instructions on the NRC Folder Certification Request Site when using this process.
As noted in the site's user guide, subpoenas and requests from law enforcement entities,
Department of Homeland Security, Assistant United States Attorneys at the Department
of Justice, and the SSA Office of the Inspector General are excluded from the NRC
certification process. The RO will certify records when an NRC exclusion applies.
If an NRC exclusion applies, follow the instructions below.
NOTE: The FO processes requests for uncertified records. Do not send requests for uncertified
records to the NRC.
4. Compute Fees and Bill Requester
Compute the applicable fees following GN 03311.005. You can use FeebayNet to create an invoice to send to the requester. Process the fee in the Social Security
Electronic Remittance System (SERS) unless an exception applies. (See GN 02403.014.) Refer SERS issues to the SERS Helpdesk or via email at ^SERS. Update the payment receipt field in FeebayNet after the fee is received and processed. SSA requires payment before providing records.
(See GN 02403.012.) Therefore, make sure the requester pays the applicable fees before routing the
request to RO for certification. RO staff does not have SERS access so the FO should
submit a copy of the receipt with each certification request.
5. Assemble the Requested Information
Gather the requested information located in both paper and electronic records. Photocopy
or print the requested information. Only produce the information specifically listed
on the consent form.
Personal information about other individuals for whom we do not have a written consent
document may be contained in the consenting individual’s record. The consenting individual
may not consent to the release of information in their record about other individuals.
Therefore, you must redact any information about other individuals before releasing
the records of the consenting individual. See GN 03305.002.2. You can redact using a marker or registered Adobe Acrobat users can use the Adobe
redact feature.
NOTE: If redacting using a marker, first black out the information to be redacted, then
make a photocopy of the document. Only the photocopy should be released, as the blacked-out
information can sometimes be read through the marker on the original copy.
NOTE: If manual redaction is not required, you may wish to save the records as a PDF by
selecting "print to PDF" rather than printing on paper since you will need to email
the records to the RO.
REMEMBER: The requester may submit these records as evidence in criminal or civil court proceedings.
We are responsible for providing clear, complete, and accurate records.
6. Route the Request to the Regional Office
Route the request to the CDPS Privacy Act Coordinator by email. The name of the current
Privacy Act Coordinator is listed on the Dallas CDPS Programs Support Topics list. Enter RO Certification Request
as the subject line.
Attach copies of the following documents.
• Consent form and any other paperwork submitted by the requester
• Record(s) to be certified
• SERS receipt
Provide the name of an FO contact if using a shared email box to submit the request.
If a file is too large to send in a single email, you may need to split it into smaller
files to email separately or eFAX it to CDPS. Ask the Privacy Act Coordinator if you
have questions about routing the records.