Supporting Statement - 0566 (Final)

Supporting Statement for

Form SSA-3288, Consent for Release of Information and

Form SSA-3288-OP1, Consent for Disclosure of Records Protected Under the Privacy Act

20 CFR Part 401 (Privacy and Disclosure of Official Records and Information) and

20 CFR Part 402 (Availability of Information and Records to the Public)

20 CFR 401.40(b)&(c), 401.45, 401.55(b), 401.65(a), 401.100; 20 CFR 401.130; and 20 CFR 402

OMB No. 0960-0566

A. Justification

1. Introduction/Authoring Laws and Regulations

Section 205(a) of the Social Security Act (42 U.S.C. 405 of the United States Code), section (b) of the Privacy Act of 1974 (5 U.S.C. 552a of the United States Code), the Freedom of Information Act (FOIA) (5 U.S.C. 552), and the Creating Advanced Streamlined Electronic Services for Constituents (CASES) Act of 2019, Public Law 116-50, 133 Stat. 1073 (2019), provide the authority for the Commissioner of the Social Security Administration (SSA) to obtain the following:

• information necessary to access records;

• information necessary to amend or correct records;

• the designation of a representative to receive an individual's medical records;

• consent statements from persons authorizing SSA to disclose information in SSA records about the record subject to a third party; and

• consent statements from persons authorizing SSA to disclose information in SSA records about the consenting person to a third party.

These rules are also set forth under Sections 20 CFR 401.40(b)&(c), 401.45, 401.55(b), 401.65(a), 401.100 and 20 CFR 401.130 of the Code of Federal Regulations.

2. Description of Collection

Within the Privacy and Disclosure of Official Records and Information regulations, SSA has established methods through which the public can provide consent for release of records under the Privacy Act of 1974. The public can also request records accessible through the Freedom of Information Act (FOIA).

We collect the necessary information for these requests through written correspondence, including the Form SSA-3288; other writings, including non-SSA forms often used by large employers, that incorporate SSA’s consent requirements; or the Form SSA‑3288‑OP1 via a webform application linked on SSA’s Privacy Program website. The Form SSA-3288-OP1 allows an individual to consent to and authorize SSA to disclose specific types of records that an individual can alternatively request through other writings and written correspondence; however, an individual can consent to and authorize SSA to disclose a broader range of types of records when using other writings and written correspondence (other than Form SSA‑3288‑OP1).

Consent for Release of Records – 20 CFR 401.100(a) and (b)

SSA obtains the required consent(s) (with certain exceptions specified by law) from anyone requesting information in SSA systems of records about another individual. We will not release information requested about an individual until we obtain the required consent from that individual. Under the Privacy Act of 1974 (5 U.S.C. 552a(b)), individuals may give SSA written consent to disclose their personal information to a third party of their choosing. In addition, individuals may have multiple needs for the disclosure of their personal information, such as for qualification for a mortgage or pre-employment screenings.

1. Form SSA-3288 (Consent for Release of Information): Form SSA-3288 is SSA’s preferred paper form for requests for disclosure of information based on the consent of the subject of record. Respondents can download the SSA-3288 from www.ssa.gov/forms, obtain a copy at a local SSA field office, or request SSA mail a copy to them directly. Use of this form ensures compliance with SSA consent regulations at 20 CFR 401.100. SSA also collects consent on other writings, including non-SSA forms often used by large employers, that incorporate SSA’s consent requirements.

2. Form SSA-3288-OP1 (Consent for Disclosure of Records Protected Under the Privacy Act): Form SSA-3288-OP1 complies with the CASES Act, OMB M‑21‑04, and SSA consent regulations at 20 CFR 401.100.

The CASES Act directed OMB to develop templates for, among other things, electronic consents for SSA to disclose records protected by the Privacy Act of 1974 to third parties. OMB implemented that statutory directive in M-21-04. SSA developed the SSA‑3288‑OP1 pursuant to the CASES Act and M‑21-04. The public can access the webform application that populates Form SSA-3288-OP1 online by selecting the “Submit an Electronic Consent to Disclose Records” link found at www.ssa.gov/privacy. The public can also find the “Submit an Electronic Consent to Disclose Records” page with the link to the SSA-3288-OP1 by typing in relevant search terms at www.ssa.gov.

As a note, 20 CFR 401.100(d) explains that a parent or guardian of a minor is not authorized to give written consent to a disclosure of a minor’s medical record. This limitation is consistent with privacy restrictions in our regulations about how minor records must be accessed. Per 20 CFR 401.45(b)(6) and 20 CFR 401.55(c), to protect the privacy of a minor, we will not give a parent or guardian direct notification of, or access to, a minor’s medical record. Parents or legal guardians requesting notification of, or access to, a minor’s medical records must provide proof of relationship to the minor, in addition to verifying their own identities, by providing a copy of the minor’s birth certificate, a court order, or other competent evidence of guardianship to SSA.

We identified the following psychological costs based on the requirements for this information collection:

• Requirement for the Program: The information collection does not require highly personal information about the respondents. However, we collect necessary information such as the respondent’s name, date of birth, Social Security number, and address to identity proof and authenticate the respondent who is submitting the consent to disclose request.

• Psychological Cost: Some respondents may consider the request is redundant as we ask for the same or similar information on other forms. Other respondents may experience anxiety toward the authentication requirement to complete the SSA-3288-OP1.

We understand these psychological costs may cause some respondents to delay their completion of the information collection or cause them to abandon the information collection entirely. However, we require full completion of this collection to allow for consent for disclosure of records. As this is a voluntary information collection, we do not believe these psychological costs will affect the overall burden for this information collection as shown in #12 below.

The respondents are individuals consenting to, authorizing, and requesting SSA disclosure of their records protected by the Privacy Act of 1974 to third parties.

2. Use of Information Technology to Collect the Information

Form SSA-3288, Consent for Release of Information, is available online to the public in a fillable PDF format, which individuals can download, fill in, print, and send to SSA for processing. However, since the SSA-3288, and any request to designate a representative for disclosure of medical records (items a and b above), fall under the Privacy Act of 1974, at 5 USC 552a(b), (d)(1), and (f)(3), these actions currently require a wet signature per agency policy decision. For this reason, SSA did not create an electronic version of Form SSA-3288 under the Agency’s Government Paperwork Elimination Act.

Form SSA-3288-OP1, Consent for Disclosure of Records Protected Under the Privacy Act, is available for the public as a webform application on the Internet when a respondent selects the “Submit an Electronic Consent to Disclose Records” link found at www.ssa.gov/privacy. The respondent undergoes authentication and identity‑proofing through “SSA's Public Credentialing and Authentication Process” (eAccess) (OMB No. 0960-0789) or a federated identity service (FIS) (e.g., ID.me or Login.gov). The respondent selects the specific SSA records they consent to disclose, including all records of that type or records within a specific date range. The respondent authorizes SSA to disclose the records to the third party(ies) the respondent designates. Any request respondents make using the SSA-3288-OP1 are one‑time-only requests. The respondent electronically signs the online form and selects “submit” to send the request to SSA. The completed, signed, and locked online Form SSA‑3288-OP1 is then routed via WorkTrack to the local field office associated with the respondent’s ZIP code for fulfillment. SSA continues to work toward incremental subsequent releases that fully implement the CASES Act and M-21-04. Subsequent releases will also be accessible online only and will allow respondents to submit the requests electronically.

2. Why We Cannot Use Duplicate Information

The webform application, SSA-3288-OP1, allows an individual to consent to and authorize SSA to disclose specific types of records that an individual can also request through writings and written correspondence to SSA, including the use of paper Form SSA-3288. An individual can consent to and authorize SSA to disclose a broader range of types of records through writings and written correspondence, including the SSA-3288. Even so, we explain to the public that SSA prefers the use of the SSA-3288 or SSA-3288-OP1 as these forms are fully compliant with SSA consent regulations at 20 CFR 401.100.

5. Minimizing Burden on Small Respondents

While this collection does not significantly affect small businesses or other small entities, there is a small burden on respondents to complete the electronic SSA-3288-OP1. Even so, if we did not impose this burden, we would be unable to provide access to or disclose SSA records. We minimized the burden by carefully reviewing the form and ensuring that we only ask individuals to complete relevant and necessary questions.

6. Consequence of Not Collecting Information or Collecting it Less Frequently

The Form SSA-3288 is our preferred method to obtain written consent on paper, even though we cannot require individuals to use it. We require respondents to electronically sign the SSA-3288-OP1. Both the SSA-3288 and SSA-3288-OP1 meet our regulatory requirements for consent at 20 CFR 401.100 and agency policy requirements for disclosing non-tax return information. We collect this information each time an individual gives consent to, and authorizes SSA to, disclose information protected by the Privacy Act of 1974 to a third party. Because we need this information for legal purposes, we cannot collect it less frequently. Given the need for timely and accurate consent sufficient to allow and authorize disclosure, there is a legal obstacle to further reducing any burden herein.

7. Special Circumstances

There are no special circumstances that would cause SSA to conduct this information collection in a manner inconsistent with 5 CFR 1320.5.

8. Solicitation of Public Comment and Other Consultations with the Public

We published the 60-day advance Federal Register Notice on May 21, 2025, at 90 FR 21817 and received no public comments. We published the 30-day FRN published on June 21, 2025, at 90 FR 34327. If we receive any comments in response to this Notice, we will forward them to OMB. We did not consult with the public in the development of this form.

9. Payment or Gifts to Respondents

SSA does not provide payments or gifts to the respondents.

9. Assurances of Confidentiality

SSA protects and holds confidential the information it collects in accordance with 42 U.S.C. 1306, 20 CFR 401 and 402, 5 U.S.C. 552 (Freedom of Information Act), 5 U.S.C. 552a (Privacy Act of 1974), and OMB Circular No. A-130.

9. Justification for Sensitive Questions

The information collection does not contain any questions of a sensitive nature.

9. Estimates of Public Reporting Burden

Modality of Completion	Number of Respondents	Frequency of Response	Average Burden per Response (minutes)	Estimated Total Annual Burden (hours)	Average Theoretical Hourly Cost Amount (dollars)*	Average Wait Time in Field Office (minutes)**	Total Annual Opportunity Cost (dollars)***
a. Amendment of Records	100	1	10	17	$32.66*	23**	$1,796***
b. Consent for Release of Information (SSA-3288)+	440,374	1	5	36,698	$32.66*	23**	$6,711,891***
c. Consent for Release of Records (Electronic SSA-3288-OP1)+	1,152	1	10	192	$32.66*		$6,271***
Totals	441,626			36,907			$6,719,958***

⁺The number of respondents for this modality is based on SSA’s analytics data for the number of SSA-3288 and SSA-3288-OP1 forms submitted to SSA in fiscal year (FY) 2024.

*We based this figure on average U.S. worker’s hourly wages, as reported by Bureau of Labor Statistics data (Occupational Employment and Wage Statistics).

**We based this figure on the average FY 2024 wait times for field offices, based on SSA’s current management information (MI) data.

***This figure does not represent actual costs that SSA is imposing on recipients of Social Security payments to complete this application; rather, these are theoretical opportunity costs for the additional time respondents will spend to complete the application. There is no actual charge to respondents to complete the application.

In addition, OMB’s Office of Information and Regulatory Affairs (OIRA) is requiring SSA to use a rough estimate of a 30-minute, one-way, drive time in our calculations of the time burden for this collection. OIRA based their estimation on a spatial analysis of SSA’s current field office locations and the location of the average population centers based on census tract information, which likely represents a 13.97 mile driving distance for one-way travel. We depict this on the chart below:

Total Number of Respondents Who Visit a Field Office	Frequency of Response	Average One-Way Travel Time to a Field Office (minutes)	Estimated Total Travel Time to a Field Office (hours)	Total Annual Opportunity Cost for Travel Time (dollars)****
440,474	1	30	220,237	$7,192,940****

****We based this dollar amount on the Average Theoretical Hourly Cost Amount in dollars shown on the burden chart above.

Per OIRA, we include this travel time burden estimate under the 5 CFR 1320.8(a)(4), which requires us to provide “time, effort, or financial resources expended by persons [for]…transmitting, or otherwise disclosing the information,” as well as 5 CFR 1320.8(b)(3)(iii) which requires us to estimate “the average burden collection…to the extent practicable.” SSA notes that we do not obtain or maintain any data on travel times to a field office, nor do we have any data which shows that the average respondent drives to a field office, rather than using any other mode of transport. SSA also acknowledges that respondents’ mode of travel and, therefore, travel times vary widely dependent on region, mode of travel, and actual proximity to a field office.

NOTE: We included the total opportunity cost estimate from this chart in our calculations when showing the total time and opportunity cost estimates in the paragraph below.

We calculated the following Learning Cost time burden based on the estimated time and effort we expect respondents will take to learn about this program, its applicability to their circumstances, and to cover any additional research we believe respondents may need to take to understand how to comply with the program requirements (beyond reading the instructions on the collection instrument):

Total Number of Respondents	Frequency of Response	Estimate Learning Cost (minutes)	Estimated Total Annual Burden (hours)	Total Annual Learning Cost (dollars)*****
441,626	1	30	220,813	$7,211,753*****

*****We based this dollar amount on the Average Theoretical Hourly Cost Amount in dollars shown on the burden chart above.

NOTE: We included the total opportunity cost estimate from this chart in our calculations when showing the total time and opportunity cost estimates in the paragraph below.

We base our burden estimates on current management information data, which includes data from actual interviews, as well as from years of conducting this information collection. Per our management information data, we believe that 5 and 10 minutes accurately shows the average burden per response for learning about the program; receiving notices as needed; reading and understanding instructions; gathering the data and documents needed; answering the questions and completing the information collection instrument; scheduling any necessary appointment or required phone call; consulting with any third parties (as needed); and waiting to speak with SSA employees (as needed). Based on our current management information data, the current burden information we provided is accurate. The total burden for this ICR is 36,907 burden hours (reflecting SSA management information data), which results in an associated theoretical (not actual) opportunity cost financial burden of $21,124,651. SSA does not charge respondents to complete our applications.

9. Annual Cost to the Respondents (Other)

There is no fee for individuals to complete the Form SSA-3288-OP1. The SSA field office with jurisdiction over the request will determine if any fees apply for releasing the requested records. If fees apply, an invoice will be sent to the requester and records will be released after payment is received.

9. Annual Cost to Federal Government

The annual cost to the federal government is approximately $8,516,682. This estimate accounts for the costs from the following areas:

Description of Cost Factor	Methodology for Estimating Cost	Cost in Dollars*
Designing and Printing the Form	Design Cost + Printing Cost	$155**
Distributing, Shipping, and Material Costs for the Form	Distribution + Shipping + Material Cost	$0*
SSA Employee (e.g., field office, 800 number, Disability Determination Services staff) Information Collection and Processing Time	GS-9 employee x # of responses x processing time	$7,423,987
Full-Time Equivalent Costs	Out of pocket costs + Other expenses for providing this service	$0*
Systems Development, Updating, and Maintenance	GS-9 employee x man hours for development, updating, maintenance	$1,092,540 **
Quantifiable Information Technology (IT) Costs	Any additional IT costs	$0*
Total		$8,516,682

*We have inserted a $0 amount for cost factors that do not apply to this collection.

**SSA no longer prints Form SSA-3288 due to its availability on MyStock and on SSA’s website as a fillable PDF. MyStock is an on-demand form system used to access forms. Since the form is available on MyStock and as a fillable PDF on SSA’s website, SSA no longer needs to print or distribute the form.

SSA is unable to break down the costs to the Federal government further than we already have. It is difficult for us to break down the cost for processing a single form, as field office and State DDS staff often help respondents fill out several forms at once, and the time it takes to do so can vary greatly per respondent.  As well, because so many employees have a hand in each aspect of our forms, we use an estimated average hourly wage, based on the wage of our average field office employee (GS-9) for these calculations.  However, we have calculated these costs as accurately as possible based on the information we collect for creating, updating, and maintaining these information collections.

9. Program Changes or Adjustments to the Information Collection Request

When we last cleared this IC, the burden was 2,954,216. However, we are currently reporting a burden of 36,907 hours. This change stems from replacing the estimated number of SSA‑3288-OP1 submissions used in the prior calculations with the actual number of submissions received in FY 2024 based on current MI data. We also updated the number of SSA-3288 submissions received in FY 2024. We re-evaluated our MI data and noticed the previously reported Number of Respondents for the SSA-3288 was inaccurate. There is no change to the burden time per response. Although the number of responses changed, SSA did not take any actions to cause this change. We included FY 2024 updated data in the Estimates of Public Reporting Burden chart cited in #12 above.

*Note: The total burden reflected in ROCIS is 646,805, while the burden cited in #12 of the Supporting Statement is 36,907. This discrepancy is because the ROCIS burden reflects the following components: field office waiting time + a rough estimate of a 30-minute, one-way, drive burden + learning costs. In contrast, the chart in #12 of the Supporting Statement reflects actual burden.

9. Plans for Publication Information Collection Results

SSA will not publish the results of the information collection.

9. Displaying the OMB Approval Expiration Date

OMB granted SSA an exemption from the requirement to print the OMB expiration date on its program forms. SSA produces millions of public-use forms with life cycles exceeding those of an OMB approval. Since SSA does not periodically revise and reprint its public-use forms (e.g., on an annual basis), OMB granted this exemption so SSA would not have to destroy stocks of otherwise useable forms with expired OMB approval dates, avoiding Government waste.

SSA is not requesting an exemption from the requirement to print the OMB expiration date on the webform, SSA-3288-OP1.

9. Exceptions to Certification Statement

SSA is not requesting an exception to the certification requirements at 5 CFR 1320.9 and related provisions at 5 CFR 1320.8(b)(3).

B. Collections of Information Employing Statistical Methods

SSA does not use statistical methods for this information collection.

8