11-7-07 memo

From: Davidson, Liz [mailto:[email protected]]
Sent: Wednesday, November 07, 2007 3:26 PM
To: Matsuoka, Karen Y.
Cc: Lebowitz, Naomi; Hartson, Craig; Misener, Charlene
Subject: Authorization to Release Medical Report to Physician

Karen,
Our Office of Disclosure Policy (ODP) and our Office of General Counsel is providing
guidance to the office responsible for the form SSA-91 and we will send you revised
form when I receive it. ODP, the owners of the SSA-3288, said it cannot be used for this
purpose for the following reasons:
In brief, the 3288 cannot and should not be used for the purpose OMB and OMVE suggest
below. Rather, the SSA-91 should be modified to accomplish that purpose.
The point raised in the exchange below about demonstrating reasons for not modifying the SSA3288 (e.g., hardships on beneficiaries) is not relevant to this discussion. This is because a
parent/legal guardian may designate a physician to receive medical records; but that does not
equate to the parent/legal guardian providing consent or to the doctor being authorized to release
the records to another doctor in an SSA-related process. The Privacy Act itself draws a
distinction between "request" and "consent."
The SSA-3288 was designed to be a Privacy Act "consent-based" form to be used for the
purpose of authorizing the release/disclosure of SSA records about an individual to a third party.
The question then becomes, who may consent? Adults, legal guardians and minors, in
some instances, may only consent to the release/disclosure of non-medical records.
Per regulation (20 CFR 401.100(b)), parents or legal guardians, whether or not acting on behalf
of a minor may not consent to the release/disclosure of a minor's medical records. They may
however, when acting on behalf of the minor, obtain access to the minor's medical records by
designating a physician or other health care professional to receive the medical records.
In light of the Privacy Act distinction and the regulatory provision, we suggest that the SSA-91
be revised to delete references to the word "authorization." If the word "request" is substituted
for "authorization" this would be consistent with the Privacy Act provision which allows
individuals to request that records be provided to other parties. In that way, additional language
could be added to the SSA-91 which would allow the parent/legal guardian to make such a
request.
Liz Davidson

SSA Reports Clearance Officer
DCBFM, OPLM, OPUM
410-965-0454

Pager: 410-909-8175
Fax: 410-965-6400