Addendum to the Supporting Statement for 0960-0566

Addendum to the Supporting Statement for

Form SSA-3288, Consent for Release of Information; and

SSA-3288-OP1, Consent for Disclosure of Records Protected Under the Privacy Act

20 CFR Part 401 (Privacy and Disclosure of Official Records and Information) and

20 CFR Part 402 (Availability of Information and Records to the Public)

OMB No. 0960-0566

Background

The Social Security Administration (SSA) has established methods by which the public can provide consent for SSA to release Privacy Act protected records to a third party. We collect the necessary information for these requests through written correspondence, including the Form SSA-3288; on other writings, including non-SSA forms often used by large employers, that incorporate SSA’s consent requirements; or the Form SSA‑3288‑OP1 via a webform application linked on SSA’s Privacy Program website. SSA created the SSA-3288-OP1 as a new web application tool to comply with the Creating Advanced Streamlined Electronic Services for Constituents (CASES) Act of 2019, Public Law 116-50, 133 Stat. 1073 (2019).

We are updating the Form SSA-3288-OP1 to enhance the time bounding options for requested records as requested by OMB and to make language and user interface changes to improve usability and conform with SSA’s standard user experience framework (UEF) 3.0. We are also updating the Form SSA-3288 to correct a typographical error in the Penalty of Perjury section.

Terms of Clearance

OMB provided the following Terms of Clearance when it approved the revised information collection on April 14, 2023:

The agency made clarifications to its supporting statement to describe the various instruments under the ICR as well as future enhancements.

The web-based instrument is approved consistent with the agency’s assertion of this instrument’s compliance with Pub. L. No. 116-50 ("Creating Advanced Streamlined Electronic Services for Constituents Act of 2019’’) and relevant guidance. The agency is encouraged to routinely review its standards to ensure ongoing consistency with P.L. 116-50 and other relevant statutes.

• Term of Clearance #1: The agency made clarifications to its supporting statement to describe the various instruments under the ICR as well as future enhancements.

• SSA Response:

SSA notes that these clarifications were part of the passbacks between OMB and SSA. These passbacks included the following items:

• OMB Passback #1: [SSA] needs to provide a catchall option for something like “all claims-related records” – something that can encapsulate application/appeals/denials in one bucket for a respondent who may not know exactly which of those records they need. That said, the actual option needs to be more plain language than “claims-related records.”

SSA Response: We explored this request and conducted discovery with agency stakeholders. We determined that implementing a catchall option is not feasible. Our regulations at 20 CFR 401.100(c) provide that “We will not disclose your entire record. For example, we will not honor a blanket consent for all information in a system of records or any other record consisting of a variety of data elements. We will disclose only the information you specify in the consent.” This requirement aligns with the principles of informed consent and data minimization. In particular, honoring a blanket consent to disclose, for example, “all claims-related records,” may lead to the unintended disclosure to a third party of: (1) more information than the subject realizes is in the file (e.g., sensitive medical information such as a medical diagnosis), and (2) more information than is needed to satisfy the purpose of the requested disclosure. This would also increase the burden on agency staff to retrieve and copy additional records that may not be necessary. This means taking additional time to fulfill a request and redirecting technician time from otherwise serving the public.

• OMB Passback #2: [SSA] needs to consider alternative time-bounding than MM/YYYY records. For example, “all records in the last five years” or “all records related to this case.”

SSA Response: To comply with this request, we are revising the SSA‑3288‑OP1 to expand the time-bounding. This will provide users the option to select all records of certain types or to provide a specific date range for those records.

• OMB Passback #3: [SSA] should strongly consider combining SSDI and SSI options into a single option (e.g. “Disability benefits applications (both SSDI and SSI) from date to date”). We recognize that on the back-end, DI and SSI records are often housed in different systems, but to a customer this distinction may be substantially less clear and can cause confusion.

SSA Response: We explored this request and conducted discovery with agency stakeholders. We determined that combining Social Security Disability Insurance (SSDI) and Supplemental Security Income (SSI) into a single option is not feasible. The SSI program includes payments based on disability or based on age. Combining SSDI with SSI into one “disability” option would exclude the SSI aged population from using the SSA-3288-OP1 because SSI aged does not fall into the category of “disability.” Additionally, combining SSDI and SSI into a single “disability” option is counter to the principles of informed consent and data minimization. Combining SSDI and SSI into one “disability” option removes the option for the subject to specify which type of records they are consenting to disclose. Without the option to specify whether they consent to disclose SSDI or SSI records, subjects would be consenting to disclose records from both claim types if both exist.

However, there may be circumstances in which the recipient only needs records regarding SSDI or SSI, but not both. Therefore, honoring a consent to disclose “disability” records that includes both SSDI and SSI may lead to the disclosure of: (1) more information than the subject realizes is in the file, and (2) more information than is needed to satisfy the purpose of the requested disclosure. Additionally, this would also increase burden on agency staff to retrieve and copy additional records that may not be necessary. This results in taking additional time to fulfill a request and redirecting technician time from otherwise serving the public.

• Term of Clearance #2: The web-based instrument is approved consistent with the agency’s assertion of this instrument’s compliance with Pub. L. No. 116-50 ("Creating Advanced Streamlined Electronic Services for Constituents Act of 2019’’) and relevant guidance.

SSA Response: SSA asserts that the web-based instrument complies with Pub. L. No. 116-50 and relevant guidance including M-21-04.

• Term of Clearance #3: The agency is encouraged to routinely review its standards to ensure ongoing consistency with P.L. 116-50 and other relevant statutes.

SSA Response: SSA routinely reviews its standards to ensure ongoing consistency with Pub. L. No. 116-50.

Revisions to the Information Collection:

• Change #1: When a user selects the following record types on the SSA‑3288‑OP1 webform application – medical records, Medicare entitlement documents, application(s) for benefits, award notice(s), denial notice(s), and appeal request(s) – the application displays a radio button. This button gives the user the option to either select all records of that type or provide a specific date range for records of that type (with month/date/year fields all mandatory if selecting the date range option). We are also updating the SSA-3288-OP1 PDF deliverable “Description of Requested Records” section to accommodate the enhanced time-bounding options in the webform application.

Justification #1: When OMB approved the information collection for the SSA‑3288-OP1, it provided three Terms of Clearance, including instructing SSA to “[c]onsider alternative time-bounding than MM/YYYY records. For example, ‘all records in the last five years” or “all records related to this case.’” We developed Change #1 to comply with the time-bounding term of clearance. 

We are maintaining the option for users to select a specific date range for the requested records so that users can limit the information disclosed in situations where the records are only needed for certain time periods. This helps users avoid sharing too much of their information and aligns with the principle of data minimization.

We are not expanding the time-bounding of the paper Form SSA-3288, Consent for Release of Information. We understand that OMB’s time-bounding Term of Clearance only applied to the SSA-3288-OP1, not to the SSA-3288. Additionally, expanding the time-bounding of the SSA-3288 in the same manner would lengthen and complicate the form. This would result in an additional burden for members of the public completing the form. The change, however, imposes an additional minimal burden on users completing the SSA-3288-OP1 webform. This is because users first select which type of records they are requesting from a drop-down menu. They are then presented with the expanded time-bounding options for only the selected record types. The time-bounding change did lengthen and complicate the SSA-3288-OP1 PDF deliverable. However, the form is automatically generated and completed based on the users’ selections in the SSA-3288-OP1 webform. Users can review, save, or print a copy of the completed SSA-3288-OP1 PDF deliverable. Users, however, do not manually fill it out as they do with the paper SSA-3288.

• Change #2: We are updating the formatting of the SSA-3288-OP1 (e.g., font weights, button components, rearranging text, etc.) and making user interface changes (e.g., adding a persistent banner to each page of the application that contains useful links, removing the instructions page from the path and instead providing the instructions using a “Help” link in the persistent banner, and adding the Privacy Act statement to the Terms of Service page).

Justification #2: We are making formatting changes to conform with SSA’s UEF 3.0. This is so the look and feel of the SSA-3288-OP1 are more user friendly and for consistency with other agency applications. We added the persistent banner to give users easy access to helpful links on any page of the application. We reduced the number of pages and page-throughs in the application path for simplicity and a better user experience.

• Change #3: We are making minor language updates throughout the SSA‑3288‑OP1 application (e.g., renaming button and field labels, updating page titles, removing unnecessary instructional text, etc.).

Justification #3: We are making minor language updates for clarity and simplicity to improve the user experience.

• Change #4: We made updates to the “Submit an Electronic Consent to Disclose Records” launch page that we host on ssa.gov/privacy to address OMB recommendations. We updated the webpage to be clearer and user friendly by using plain language. We updated the bulleted list for readability and clarity. The original bulleted list addressed scenarios for when not to use the form.  We rewrote the bulleted list to explain when an individual can use the form. 

Justification #4: OMB previously recommended that “[t]he [SSA-3288-OP1] launch page that SSA hosts on ssa.gov/privacy needs to be VERY user-oriented in its branding – explain in plain language that it’s exactly the same as completing the paper version (except, potentially, free-form responses).”

• Change #5: We are removing the blank page from the end of the SSA-3288-OP1 PDF deliverable preview and adopting agency enterprise formatting for the electronic signature “audit page”.

Justification #5: The last page of the unsigned, preview version of the approved SSA-3288-OP1 PDF deliverable was blank except for the form header information (i.e., form title, OMB number, and page number). The blank page was a technical placeholder for the electronic signature “audit page” that populated when the SSA-3288-OP1 was signed and submitted on the Service Now platform. We have moved the SSA-3288-OP1 to the Angular ecosystem, which appends the electronic signature “audit page” differently; therefore, the SSA-3288-OP1 PDF deliverable preview does not require the blank page. Additionally, we have made the SSA-3288-OP1 consistent with other electronically signed agency forms by removing the blank page from the form preview and eliminating the form header information from the electronic signature “audit page”.

• Change #6: We corrected a typographical error in the Penalty of Perjury statement in the Form SSA-3288.

Justification #6: The Form SSA-3288 that was submitted both to OMB as a non‑substantive change request and, subsequently, to SSA’s Division of Forms, Library and Duplicating Services in 2023 contained a typographical error in the Penalty of Perjury citation. We are correcting the citation to read 28 U.S.C. § 1746 instead of 28 C.F.R. § 1746.

We will make these revisions upon OMB’s approval. These revisions will not change the current public reporting burden for this information collection.

4