NPRM On Privacy

The Social Security Administration has published a Notice of Proposed Rule Making (NPRM) in the Federal Register on privacy and disclosure of official records. At first reading there is nothing new in the NPRM that should be controversial. Perhaps the only thing that might cause a problem is the following language:

§ 401.100 Disclosure of records with thewritten consent of the subject of the record.
(a) General. Except as permitted by the Privacy Act and the regulations in this chapter, or when required by the FOIA, we will not disclose your records without your written consent.
(b) Disclosure with written consent. The written consent must clearly specify to whom the information may be disclosed, the information you want us to disclose (e.g., social security number, date and place of birth, monthly Social Security benefit amount, date of entitlement), and, where applicable, during which time frame the information may be disclosed (e.g., during the school year, while the subject individual is out of the country, whenever the subject individual i receiving specific services).
(c) Disclosure of the entire record. We will not disclose your entire record. For example, we will not honor a blanket consent for all information in a system of records or any other record consisting of a variety of data elements. We will disclose only the information you specify in the consent. We will verify your identity and where applicable (e.g., where you consent to disclosure of a record to a specific individual), the identity of the individual to whom the record is to be disclosed.
(d) A parent or guardian of a minor is not authorized to give written consent to a disclosure of a minor’s medical record. See § 401.55 (c)(2) for the procedures for disclosure of or access to medical records of minors.

If applied too literally, this could make the job of an attorney representing a Social Security disability claimant more difficult, since the mere appointment of the representative would not be enough to authorize the attorney access to the client's records at Social Security. A separate, detailed authorization would be required for each disclosure. It is unlikely that this was intended.

This is only a proposal. The public can comment on the proposal until November 13, 2006.