The Privacy Act and other Federal laws do not allow us to disclose or release information unless the request for disclosure first meets certain conditions. When we receive requests to disclose an individual's information, we may require the individual’s written consent, as described in GN 03305.003F. This written consent is our legal authority for disclosing the requested information to a third party. In all instances, the consent document must describe the specific information authorized to be disclosed by us.

The Privacy Act and our disclosure regulations require that we have the written consent of an individual before disclosing information about them to a third party, unless one of the 12 Privacy Act exceptions applies. These exceptions permit disclosure without an individual’s consent when the request meets certain requirements. For a complete list of the Privacy Act exceptions, see GN 03301.099D.

We have specific requirements in our disclosure regulations (20 CFR 401.100) and policies (GN 03305.003D in this section) for what represents a valid consent to disclose agency records. We will provide an individual's information to a third party based on the individual’s written, signed consent as long as it meets these requirements. If the consent fails to meet these requirements, we will return it to the requester with an explanation of why we cannot honor it. We can honor a new consent document from the same requester once it meets our requirements.

We use queries for internal, administrative use. We do not routinely disclose these queries to third parties based on an individual’s consent. For further information concerning the disclosure of queries, see GN 03305.004.

All consent documents must meet each of the eight requirements listed below. If the consent does not meet these requirements, return the consent document to the requester with an explanation of why we cannot honor it. All consent documents, including the Form SSA-3288 and Form SSA-3288-OP1, must:

1. 1. 

   Specify the first and last name, Social Security number, and date of birth of the individual who is the subject of the requested record(s);

2. 2. 

   Include a legible signature or mark “X” for paper consent documents. A legible signature is one that is clearly visible. If an individual signs a paper consent document by marking “X,” two witnesses who do not stand to gain anything from the disclosure must wet sign the consent and provide their full mailing addresses. Electronic consents (i.e., Form SSA-3288-OP1) require a valid electronic signature. See GN 03305.001C;

   NOTE: 

   If there is suspicion that the signature is not the record subject's (due to misspellings, illegibility, apparent post-signature changes, or other factors), the field office (FO) may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgement in these instances.

3. 3. 

   The signature must be below the requested information on the consent document and be dated by the individual who is the subject of the requested record(s) or someone who can consent on behalf of that individual (GN 03305.005);

4. 4. 

   Specifically state that the Social Security Administration (SSA) may disclose the requested information. A consent document that also authorizes other entities to disclose information is acceptable as long as it identifies SSA as one of the entities;

5. 5. 

   Specify the first and last name and address of the person or organization to whom we should send the requested information;

6. 6. 

   Describe the requested record(s) in enough detail for us to locate the record(s);

7. 7. 

   Specify the purpose for which the requester will use the information. This helps us ensure that the individual has informed consent and determine if we must charge a fee for providing the information if it is a non-program related request; and

8. 8. 

   Specify a time frame during which we may disclose the information. We will process the request as a one-time-only disclosure if the requester does not specify a time frame during which the consent is valid. If an individual wants us to disclose information on an ongoing basis (e.g., each month for 6 months, or quarterly, or annually) using the same consent document, they must submit a copy of the original consent document with each subsequent request for disclosure of that same information. For additional information, see GN 03305.002, Item 4. The Form SSA-3288-OP1 can only be used for a one-time consent to disclose.

   NOTE: 

   The time frame for the receipt of a consent is not the same as the time frame for the duration of a consent. For information concerning the time frame for the receipt of consents, see GN 03305.003G in this section.

The Internal Revenue Code (IRC) governs the disclosure of all tax return information. For examples of our record information that are also considered tax return information, see GN 03320.001D.1. In addition to the SSA consent requirements listed in GN 03305.003D in this section, Internal Revenue Service (IRS) regulations require individuals to meet two additional requirements before we disclose tax return information:

1. 1. 

   An individual may not combine a request for tax return information with a request for non-tax return information on the consent document, or the consent document is invalid.

   Individuals must submit a separate consent document to authorize the disclosure of tax return information, such as earnings records. For example, we receive one consent document authorizing the disclosure of detailed earnings information and medical records. We cannot accept this consent document. Individuals must submit a separate consent document for the disclosure of the detailed earnings information. Therefore, the preferred consent documents in this instance would be Form SSA-3288 or Form SSA-3288-OP1 authorizing the release of medical records and Form SSA-7050-F4 authorizing the disclosure of the earnings information. The SSA-7050-F4 meets the IRC’s required consent authority for disclosing tax return information. (It is permissible to disclose the medical information based on the original consent if it meets our requirements.)

2. 2. 

   The consent document must include:

   • •

     The taxpayer's identity;

   • •

     Identity of the person to whom disclosure is to be made;

   • •

     Type of return information;

   • •

     Taxable period; and

   • •

     Signature of taxpayer and the date the authorization was signed.

3. 3. 

   We must receive the consent document authorizing the disclosure of tax return information within 120 days from the date the individual signs the consent document to meet the IRS time limitation for receipt. Use the fee schedule shown on the SSA-7050-F4 to determine the fee for processing requests for detailed earnings information for non-program purposes. The SSA-7050-F4 advises requesters to send the form, together with the appropriate fee, to the address printed on the form. Do not send an SSA-7050-F4 or other request for detailed earnings information for processing without the appropriate fee, unless the request clearly indicates that the requested earnings information is for a program purpose.

Direct individual requests for summary yearly earnings totals to our online application "my Social Security ". For additional information about requests for earnings and disclosing tax return information, see GN 03320.005A and GN 03320.010B.

For the purpose of this policy, "Privacy Consents" means consents to disclose SSA records protected under the Privacy Act of 1974 and consents to disclose Federal tax return information.

1. 1. 

   A "wet" signature (sometimes also referred to as a "pen and ink" signature) is an individual's handwritten signature that has been physically (not electronically) signed. A wet signature is the only signature that we will accept on a paper consent document. See GN 03305.003H for additional guidance.

   We will accept a wet signature, in the form of a wet printed name (versus a cursive signed name) with additional verification. In addition, we will accept a wet “X” marked signature when made in the presence of two witnesses who do not stand to gain anything by the disclosure. Each witness must wet sign the consent document and provide their full mailing address. FOs should use current office procedures for acknowledging receipt of and verifying documents.

   NOTE: 

   If there is suspicion that the signature is not the record subject’s (due to misspellings, illegibility, apparent post-signature changes, or other factors), the FO may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgement in these instances.

   For further information concerning who may provide consent, see GN 03305.005.

2. 2. 

   We will only accept electronic signatures on the Form SSA-3288-OP1, Consent for Disclosure of Records Protected Under the Privacy Act. Other means of electronic signature on privacy consents must be approved by OGC for acceptance. In determining the requirements for electronic signature on tax return information consents, we follow the policies or requirements of the Internal Revenue Service.

The following time-frame limitations apply to the receipt of a consent document:

While we prefer the consent forms described in B.1. above, we will accept equivalent consent documents if they meet all of the consent requirements described in GN 03305.003D, GN 03305.003F, and GN 03305.003G in this section, as applicable. We will accept the following types of consent documents that meet the agency’s requirements:

1. 1. 

   All versions of the SSA-3288 are acceptable if they meet all of the consent requirements for disclosure, as applicable. Return any other consent document that does not meet our requirements to the requester with an explanation of why we cannot honor it. If you return an earlier version of the SSA-3288 to the requester because it is not completed correctly, also provide the most current version of the form.

   NOTE: 

   The address and telephone number of the consenting individual are not mandatory on Form SSA-3288 or other consent forms for the consent to be acceptable. This information assists SSA in contacting the consenting individual if there are questions about the form, but if it is missing from the SSA-3288 or other acceptable consent forms, accept the form anyway.

2. 2. 

   Fill-in forms are acceptable only if they meet all of the consent requirements, as applicable;

3. 3. 

   We will accept copies (e.g., photocopies, PDFs or JPEGs) of wet signed consent documents, including the SSA-3288, sent via facsimile, postal mail, or approved electronic means if the copies we receive bear the consenting individual’s wet signature. If there is suspicion that the signature is not the record subject’s (due to misspellings, illegibility, apparent post-signature changes, or other factors), the FO may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgment in these instances. See GN 03305.003F.2. in this section for circumstances in which electronically signed consents are accepted;

   NOTE: 

   We strongly discourage the public from sending consent documents, or any other documents that contain personally identifiable information, to SSA via unsecure email. Secure email is email sent by a secure partner, encrypted email, or email where the document is password protected.

4. 4. 

   A consent document patterned after the SSA-3288 or an imitation copy of the SSA-3288 is acceptable if it contains all of the consent requirements, as applicable, and is validly signed (see GN 03305.003F for signature requirements);

5. 5. 

   A power of attorney document for the disclosure of non-tax return information is generally not acceptable, as these documents do not usually contain all of the consent requirements; only when the power of attorney document contains all of the consent requirements and is validly signed, may it be accepted;

6. 6. 

   A consent document received within one year from the date of the consenting individual’s signature for non-tax return and non-medical records information is acceptable as described in subsection GN 03305.003G in this section;

7. 7. 

   A consent document that specifies the time frame for which we may disclose information is acceptable. If using the SSA-3288, the consenting individual may indicate specific time frames in the space allotted for the purpose; and

8. 8. 

   A consent document that adequately describes the information authorized to be released above the consenting individual’s signature is acceptable.

Consent documents that are unacceptable and cannot be relied on to disclose records include the following:

1. 1. 

   A consent document is unacceptable if it appears altered or suspicious (offices must use their own judgment in these instances), or it does not meet the consent or valid signature requirements. For instance, if the list of SSA records requested on the form appears to be altered, replaced, or deleted;

2. 2. 

   A consent document is unacceptable if the requested information does not appear above the written signature or mark (X) of the consenting individual. However, we may provide any part of the requested records appearing above the consenting individual’s signature if the consent documents satisfies the rest of the requirements in GN 03305.003D, GN 03305.003E, GN 03305.003F, and/or GN 03305.003G in this section;

3. 3. 

   A consent document is unacceptable if the consenting individual’s (or witnesses’) signature and date of signature, or both are missing, unrecognizable, unclear, illegible, appears traced or otherwise suspicious (offices must use their own judgment in these instances);

4. 4. 

   A consent document is unacceptable if the individual indicates “any and all records,” “my entire file,” “all my records” or similarly worded phrases. All requesters must specifically indicate the form number or title of the specific record or information for disclosure or describe the requested information in enough detail to enable us to locate the requested information. If the consent document specifies certain records or information for disclosure and also indicates “my entire record” or similar wording, disclose only the specific information that was requested;

5. 5. 

   A consent document is unacceptable if the overall general appearance of the document appears suspicious (offices must use their own judgment in these instances);

6. 6. 

   Except for the SSA-3288-OP1 or other electronic consents approved by Office of the General Counsel (OGC), any consent document containing an electronic signature is unacceptable; and

7. 7. 

   A consent document is unacceptable if the time frame for disclosing the particular type of information has expired. For the time limitations that apply to the receipt of consent documents, see GN 03305.003G in this section.

If any of these conditions exist, return the consent document to the requester with a written explanation of why we cannot honor it. Do not disclose any records until we receive a written consent that meets our consent requirements in GN 03305.003D or GN 03305.003E, as applicable. For subpoenas and court orders, with or without consent, see GN 03330.015.

An individual may submit an SSA-3288 (or equivalent) to request the release of their medical records to a third party. However, we have developed special procedures for the disclosure of medical records, including psychological records, pertaining to an individual.

Generally, the individual who is the subject of the record and a competent adult may give us written consent to disclose information about themselves to a third party.

Written consent can be provided on paper, so long as it contains the individual’s valid signature and meets the consent requirements listed in GN 03305.003. See GN 03305.001C for more information. We will only accept electronic signatures for the purpose of Privacy Act consents on the Form SSA-3288-OP1 submitted through our website, www.ssa.gov/privacy .

We only accept written paper consents signed by legal guardians on behalf of an adult who is declared to be legally incompetent, with acceptable proof of legal guardianship. Paper consents require a “pen and ink” or “wet” signature, and must meet the consent requirements listed in GN 03305.003. Currently, we do not accept electronic consents to disclose records submitted on behalf of incompetent adults.

The word “parent” used throughout this section refers only to the birth or adoptive parent of a minor child.

A parent or legal guardian, acting on behalf of a minor child, may consent to disclose only the minor child’s non-medical records if the conditions listed in GN 03305.005C.1.a. and GN 03305.005C.1.b. in this section are met. A parent or legal guardian cannot consent to disclose a minor child’s medical records, even if acting on behalf of the minor child. We only accept written paper consent on behalf of a minor child. Consent documents must meet the consent requirements listed in GN 03305.003. We currently do not accept electronic consent to disclose records on behalf of a minor child.

A minor child may provide written paper consent to disclose their own medical and non-medical records, at any time and for any reason, if the reviewing SSA employee is reasonably certain that the child is capable of making a rational decision to consent to the disclosure. It may be necessary for the servicing FO to interview the child or the child’s parent(s) or legal guardian to arrive at this conclusion. The reviewing SSA employee should make the decision to accept a child’s consent based on their own judgment that the child is capable of providing informed consent. This means the child fully understands what they are requesting us to disclose.

Use age 12 as a baseline for determining when a child is old enough to make such a decision. Consider these types of disclosures on a case-by-case basis to protect the rights of the child. A child under 12 years old may be mature enough to provide consent while a child over 12 may not be able to provide consent. If it appears the child cannot provide informed consent, process the request under the guidelines of the FOIA. For FOIA processing instructions, see GN 03350.005J.

A third party may have more than one type of relationship with an individual that would permit disclosure when acting on behalf of the individual. For example, an appointed representative may also be an individual’s legal guardian, or a stepparent may also be a legal guardian of a minor. However, only in the situations in GN 03305.005B and GN 03305.005C in this section may a third party sign a consent.

An individual may consent to disclose their records to a legal aid group or private law firm using the SSA-3288, SSA-3288-OP1, or other consent form that meets our requirements. The public can access the SSA-3288-OP-1 web-form application at SSA's Privacy Program website. These entities may elect to become the individual’s appointed representative during the claims process. Prior to that appointment, disclosures from the individual’s record require written consent.

The SSA-1696-U4 permits individuals to appoint a representative, who may receive records in the performance of their appointed representative duties. The SSA-1696-U4 also allows individuals to consent to the release of their records to their appointed representatives’ designated associates, who perform administrative duties (e.g. clerks, partners, and/or parties under contractual arrangements (e.g., copying services) by selecting the appropriate box on the SSA-1696-U4. If we receive a notice of appointment (SSA-1696-U4 or equivalent writing) authorizing us to release records to a designated associate, a separate SSA-3288 (or other consent form meeting our requirements) is not required as long as the appointed representative is representing the individual in a matter currently pending with us.

The appointed representative must request records or other information from the appropriate Social Security office (field office or Hearing Office) that services the mailing address ZIP code of their client (See GN 03305.020).

We will honor an individual’s request to disclose records to the appointed representative and their designated associates, as long as the appointed representative’s appointment has not ended. The appointed representative’s appointment ends when:

1. 1. 

   The individual cancels the appointment;

2. 2. 

   The representative withdraws his or her own appointment; or

3. 3. 

   The appointment expires (See GN 03910.060).

If one of these conditions exists, the individual must provide written consent for any subsequent disclosure of his or her records to the representative.

Charge the full cost or the appropriate standard fee for providing records or other information to third party requesters where the request is for a non-program purpose. For detailed information about charging fees for non-program purposes, see GN 03311.005E.