The Privacy Act and our disclosure regulations require that we have the written consent of an individual before disclosing information about them to a third party, unless one of the 12 Privacy Act exceptions applies. These exceptions permit disclosure without an individual’s consent when the request meets certain requirements. For a complete list of the Privacy Act exceptions, see GN 03301.099D.

We have specific requirements in our disclosure regulations (20 CFR 401.100) and policies (GN 03305.003D in this section) for what represents a valid consent to disclose agency records. We will provide an individual's information to a third party based on the individual’s written, signed consent as long as it meets these requirements. If the consent fails to meet these requirements, we will return it to the requester with an explanation of why we cannot honor it. We can honor a new consent document from the same requester once it meets our requirements.

We use queries for internal, administrative use. We do not routinely disclose these queries to third parties based on an individual’s consent. For further information concerning the disclosure of queries, see GN 03305.004.

All consent documents must meet each of the eight requirements listed below. If the consent does not meet these requirements, return the consent document to the requester with an explanation of why we cannot honor it. All consent documents, including the Form SSA-3288 and Form SSA-3288-OP1, must:

1. 1. 

   Specify the first and last name, Social Security number, and date of birth of the individual who is the subject of the requested record(s);

2. 2. 

   Include a legible signature or mark “X” for paper consent documents. A legible signature is one that is clearly visible. If an individual signs a paper consent document by marking “X,” two witnesses who do not stand to gain anything from the disclosure must wet sign the consent and provide their full mailing addresses. Electronic consents (i.e., Form SSA-3288-OP1) require a valid electronic signature. See GN 03305.001C;

   NOTE: 

   If there is suspicion that the signature is not the record subject's (due to misspellings, illegibility, apparent post-signature changes, or other factors), the field office (FO) may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgement in these instances.

3. 3. 

   The signature must be below the requested information on the consent document and be dated by the individual who is the subject of the requested record(s) or someone who can consent on behalf of that individual (GN 03305.005);

4. 4. 

   Specifically state that the Social Security Administration (SSA) may disclose the requested information. A consent document that also authorizes other entities to disclose information is acceptable as long as it identifies SSA as one of the entities;

5. 5. 

   Specify the first and last name and address of the person or organization to whom we should send the requested information;

6. 6. 

   Describe the requested record(s) in enough detail for us to locate the record(s);

7. 7. 

   Specify the purpose for which the requester will use the information. This helps us ensure that the individual has informed consent and determine if we must charge a fee for providing the information if it is a non-program related request; and

8. 8. 

   Specify a time frame during which we may disclose the information. We will process the request as a one-time-only disclosure if the requester does not specify a time frame during which the consent is valid. If an individual wants us to disclose information on an ongoing basis (e.g., each month for 6 months, or quarterly, or annually) using the same consent document, they must submit a copy of the original consent document with each subsequent request for disclosure of that same information. For additional information, see GN 03305.002, Item 4. The Form SSA-3288-OP1 can only be used for a one-time consent to disclose.

   NOTE: 

   The time frame for the receipt of a consent is not the same as the time frame for the duration of a consent. For information concerning the time frame for the receipt of consents, see GN 03305.003G in this section.

The Internal Revenue Code (IRC) governs the disclosure of all tax return information. For examples of our record information that are also considered tax return information, see GN 03320.001D.1. In addition to the SSA consent requirements listed in GN 03305.003D in this section, Internal Revenue Service (IRS) regulations require individuals to meet two additional requirements before we disclose tax return information:

1. 1. 

   An individual may not combine a request for tax return information with a request for non-tax return information on the consent document, or the consent document is invalid.

   Individuals must submit a separate consent document to authorize the disclosure of tax return information, such as earnings records. For example, we receive one consent document authorizing the disclosure of detailed earnings information and medical records. We cannot accept this consent document. Individuals must submit a separate consent document for the disclosure of the detailed earnings information. Therefore, the preferred consent documents in this instance would be Form SSA-3288 or Form SSA-3288-OP1 authorizing the release of medical records and Form SSA-7050-F4 authorizing the disclosure of the earnings information. The SSA-7050-F4 meets the IRC’s required consent authority for disclosing tax return information. (It is permissible to disclose the medical information based on the original consent if it meets our requirements.)

2. 2. 

   The consent document must include:

   • •

     The taxpayer's identity;

   • •

     Identity of the person to whom disclosure is to be made;

   • •

     Type of return information;

   • •

     Taxable period; and

   • •

     Signature of taxpayer and the date the authorization was signed.

3. 3. 

   We must receive the consent document authorizing the disclosure of tax return information within 120 days from the date the individual signs the consent document to meet the IRS time limitation for receipt. Use the fee schedule shown on the SSA-7050-F4 to determine the fee for processing requests for detailed earnings information for non-program purposes. The SSA-7050-F4 advises requesters to send the form, together with the appropriate fee, to the address printed on the form. Do not send an SSA-7050-F4 or other request for detailed earnings information for processing without the appropriate fee, unless the request clearly indicates that the requested earnings information is for a program purpose.

Direct individual requests for summary yearly earnings totals to our online application "my Social Security". For additional information about requests for earnings and disclosing tax return information, see GN 03320.005A and GN 03320.010B.

For the purpose of this policy, "Privacy Consents" means consents to disclose SSA records protected under the Privacy Act of 1974 and consents to disclose Federal tax return information.

1. 1. 

   A "wet" signature (sometimes also referred to as a "pen and ink" signature) is an individual's handwritten signature that has been physically (not electronically) signed. A wet signature is the only signature that we will accept on a paper consent document. See GN 03305.003H for additional guidance.

   We will accept a wet signature, in the form of a wet printed name (versus a cursive signed name) with additional verification. In addition, we will accept a wet “X” marked signature when made in the presence of two witnesses who do not stand to gain anything by the disclosure. Each witness must wet sign the consent document and provide their full mailing address. FOs should use current office procedures for acknowledging receipt of and verifying documents.

   NOTE: 

   If there is suspicion that the signature is not the record subject’s (due to misspellings, illegibility, apparent post-signature changes, or other factors), the FO may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgement in these instances.

   For further information concerning who may provide consent, see GN 03305.005.

2. 2. 

   We will only accept electronic signatures on the Form SSA-3288-OP1, Consent for Disclosure of Records Protected Under the Privacy Act. Other means of electronic signature on privacy consents must be approved by OGC for acceptance. In determining the requirements for electronic signature on tax return information consents, we follow the policies or requirements of the Internal Revenue Service.

The following time-frame limitations apply to the receipt of a consent document:

While we prefer the consent forms described in B.1. above, we will accept equivalent consent documents if they meet all of the consent requirements described in GN 03305.003D, GN 03305.003F, and GN 03305.003G in this section, as applicable. We will accept the following types of consent documents that meet the agency’s requirements:

1. 1. 

   All versions of the SSA-3288 are acceptable if they meet all of the consent requirements for disclosure, as applicable. Return any other consent document that does not meet our requirements to the requester with an explanation of why we cannot honor it. If you return an earlier version of the SSA-3288 to the requester because it is not completed correctly, also provide the most current version of the form.

   NOTE: 

   The address and telephone number of the consenting individual are not mandatory on Form SSA-3288 or other consent forms for the consent to be acceptable. This information assists SSA in contacting the consenting individual if there are questions about the form, but if it is missing from the SSA-3288 or other acceptable consent forms, accept the form anyway.

2. 2. 

   Fill-in forms are acceptable only if they meet all of the consent requirements, as applicable;

3. 3. 

   We will accept copies (e.g., photocopies, PDFs or JPEGs) of wet signed consent documents, including the SSA-3288, sent via facsimile, postal mail, or approved electronic means if the copies we receive bear the consenting individual’s wet signature. If there is suspicion that the signature is not the record subject’s (due to misspellings, illegibility, apparent post-signature changes, or other factors), the FO may contact the record subject to verify the consent or may request a new consent. Offices must use their own judgment in these instances. See GN 03305.003F.2. in this section for circumstances in which electronically signed consents are accepted;

   NOTE: 

   We strongly discourage the public from sending consent documents, or any other documents that contain personally identifiable information, to SSA via unsecure email. Secure email is email sent by a secure partner, encrypted email, or email where the document is password protected.

4. 4. 

   A consent document patterned after the SSA-3288 or an imitation copy of the SSA-3288 is acceptable if it contains all of the consent requirements, as applicable, and is validly signed (see GN 03305.003F for signature requirements);

5. 5. 

   A power of attorney document for the disclosure of non-tax return information is generally not acceptable, as these documents do not usually contain all of the consent requirements; only when the power of attorney document contains all of the consent requirements and is validly signed, may it be accepted;

6. 6. 

   A consent document received within one year from the date of the consenting individual’s signature for non-tax return and non-medical records information is acceptable as described in subsection GN 03305.003G in this section;

7. 7. 

   A consent document that specifies the time frame for which we may disclose information is acceptable. If using the SSA-3288, the consenting individual may indicate specific time frames in the space allotted for the purpose; and

8. 8. 

   A consent document that adequately describes the information authorized to be released above the consenting individual’s signature is acceptable.

Consent documents that are unacceptable and cannot be relied on to disclose records include the following:

1. 1. 

   A consent document is unacceptable if it appears altered or suspicious (offices must use their own judgment in these instances), or it does not meet the consent or valid signature requirements. For instance, if the list of SSA records requested on the form appears to be altered, replaced, or deleted;

2. 2. 

   A consent document is unacceptable if the requested information does not appear above the written signature or mark (X) of the consenting individual. However, we may provide any part of the requested records appearing above the consenting individual’s signature if the consent documents satisfies the rest of the requirements in GN 03305.003D, GN 03305.003E, GN 03305.003F, and/or GN 03305.003G in this section;

3. 3. 

   A consent document is unacceptable if the consenting individual’s (or witnesses’) signature and date of signature, or both are missing, unrecognizable, unclear, illegible, appears traced or otherwise suspicious (offices must use their own judgment in these instances);

4. 4. 

   A consent document is unacceptable if the individual indicates “any and all records,” “my entire file,” “all my records” or similarly worded phrases. All requesters must specifically indicate the form number or title of the specific record or information for disclosure or describe the requested information in enough detail to enable us to locate the requested information. If the consent document specifies certain records or information for disclosure and also indicates “my entire record” or similar wording, disclose only the specific information that was requested;

5. 5. 

   A consent document is unacceptable if the overall general appearance of the document appears suspicious (offices must use their own judgment in these instances);

6. 6. 

   Except for the SSA-3288-OP1 or other electronic consents approved by Office of the General Counsel (OGC), any consent document containing an electronic signature is unacceptable; and

7. 7. 

   A consent document is unacceptable if the time frame for disclosing the particular type of information has expired. For the time limitations that apply to the receipt of consent documents, see GN 03305.003G in this section.

If any of these conditions exist, return the consent document to the requester with a written explanation of why we cannot honor it. Do not disclose any records until we receive a written consent that meets our consent requirements in GN 03305.003D or GN 03305.003E, as applicable. For subpoenas and court orders, with or without consent, see GN 03330.015.

An individual may submit an SSA-3288 (or equivalent) to request the release of their medical records to a third party. However, we have developed special procedures for the disclosure of medical records, including psychological records, pertaining to an individual.