PART 401—PRIVACY AND DISCLOSURE OF OFFICIAL RECORDS AND INFORMATION Authority: Secs. 205, 702(a)(5), 1106, and 1141 of the Social Security Act (42 U.S.C. 405, 902(a)(5), 1306, and 1320b-11); 5 U.S.C. 552 and 552a; 8 U.S.C. 1360; 26 U.S.C. 6103; 30 U.S.C. 923. Source: 62 FR 4143, Jan. 29, 1997, unless otherwise noted. Subpart A—General § 401.5 Purpose of the regulations. (a) General. (b) Privacy. (c) Disclosure. § 401.10 Applicability. (a) SSA. (b) Other entities. § 401.15 Limitations on scope. The regulations in this part do not— (a) Make available to an individual records which are not retrieved by that individual's name or other personal identifier. (b) Make available to the general public records which are retrieved by an individual's name or other personal identifier or make available to the general public records which would otherwise not be available to the general public under the Freedom of Information Act, 5 U.S.C. 552, and part 402 of this title. (c) Govern the maintenance or disclosure of, notification about or access to, records in the possession of SSA which are subject to the regulations of another agency, such as personnel records which are part of a system of records administered by the Office of Personnel Management. (d) Apply to grantees, including State and local governments or subdivisions thereof, administering federally funded programs. (e) Make available records compiled by SSA in reasonable anticipation of court litigation or formal administrative proceedings. The availability of such records to the general public or to any subject individual or party to such litigation or proceedings shall be governed by applicable constitutional principles, rules of discovery, and applicable regulations of the agency. § 401.20 Scope. (a) Access. (b) Disclosure Program records. (i) Health insurance records which SSA maintains for the Health Care Financing Administration's (HCFA) programs under title XVIII of the Social Security Act. We will disclose these records to HCFA. HCFA may redisclose these records under the regulations applying to records in HCFA's custody; (ii) Black lung benefit records which SSA maintains for the administration of the Federal Coal Mine Health and Safety Act; (However, this information is not covered by section 1106 of the Social Security Act.) and (iii) Information retained by medical sources pertaining to a consultative examination performed for the Social Security program shall not be disclosed except as permitted by this part. (2) Nonprogram records. [62 FR 4143, Jan. 29, 1997, as amended at 65 FR 16812, Mar. 30, 2000; 72 FR 20939, Apr. 27, 2007] § 401.25 Terms defined. Access Act Agency Commissioner Disclosure FOIA Individual individual Information Maintain record system of records. Notification Subject individual Program information Record Routine use Social Security Administration (SSA) Social Security program Statistical record Subject individual System of records We our Subpart B—The Privacy Act § 401.30 Privacy Act and other responsibilities. (a) Policy. (b) Maintenance of records. (1) It is relevant and necessary to accomplish an SSA function which is required to be accomplished by statute or Executive Order; (2) We obtain the information in the record, as much as it is practicable, from the subject individual if we may use the record to determine an individual's rights, benefits or privileges under Federal programs; (3) We inform the individual providing the record to us of the authority for our asking him or her to provide the record (including whether providing the record is mandatory or voluntary, the principal purpose for maintaining the record, the routine uses for the record, and what effect his or her refusal to provide the record may have on him or her). Further, the individual agrees to provide the record, if the individual is not required by statute or Executive Order to do so. (c) First Amendment rights. (1) By statute, (2) By the subject individual, or (3) Unless pertinent to and within the scope of an authorized law enforcement activity. (d) Privacy Officer. (e) Senior Agency Official for Privacy. (f) Privacy Impact Assessment. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20939, Apr. 27, 2007] § 401.35 Your right to request records. The Privacy Act gives you the right to direct access to most records about yourself that are in our systems of records. Exceptions to this Privacy Act right include— (a) Special procedures for access to certain medical records (see 5 U.S.C. 552a(f)(3) and § 401.55); (b) Unavailability of certain criminal law enforcement records (see 5 U.S.C. 552a(k), and § 401.85); and (c) Unavailability of records compiled in reasonable anticipation of a court action or formal administrative proceeding. Note to § 401.35: The Freedom of Information Act (see 20 CFR part 402) allows you to request information from SSA whether or not it is in a system of records. § 401.40 How to get your own records. (a) Your right to notification and access. provided (b) Identifying the records. Federal Register. (c) Requesting notification or access. Federal Register § 401.45 Verifying your identity. (a) When required. (1) You make a request for notification of a record and we determine that the mere notice of the existence of the record would be a clearly unwarranted invasion of privacy if disclosed to someone other than the subject individual; or, (2) You make a request for access to a record which is not required to be disclosed to the general public under the Freedom of Information Act, 5 U.S.C. 552, and part 402 of this chapter. (b) Manner of verifying identity Request in person. (2) Request by telephone. (3) Electronic requests. (4) Electronic disclosures. (5) Requests not made in person. (6) Requests on behalf of another. (7) Medical records—additional verification. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20939, Apr. 27, 2007] § 401.50 Granting notification of or access to a record. (a) General. (b) Our delay in responding. § 401.55 Access to medical records. (a) General. (b) Medical records procedures Notification of or access to medical records. (ii) When you request medical information about yourself, you must also name a representative in writing. The representative may be a physician, other health professional, or other responsible individual who will be willing to review the record and inform you of its contents. Following the discussion, you are entitled to your records. The representative does not have the discretion to withhold any part of your record. If you do not designate a representative, we may decline to release the requested information. In some cases, it may be possible to release medical information directly to you rather than to your representative. (2) Utilization of the designated representative. (c) Medical records of minors Request by the minor. (2) Requests on a minor's behalf; notification of or access to medical records to an individual on a minor's behalf. (ii) A parent or guardian must make all requests for notification of or access to a minor's medical record in accordance with this paragraph and the procedures in §§ 401.45 through 401.50 of this part. A parent or guardian must at the time he or she makes a request designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. If the parent or guardian will not designate a representative, we will decline to release the requested information. (iii) Where a medical record on the minor exists, we will in all cases send it to the physician or health professional designated by the parent or guardian. The representative will review the record, discuss its contents with the parent or legal guardian, then release the entire record to the parent or legal guardian. The representative does not have the discretion to withhold any part of the minor's record. We will respond in the following similar manner to the parent or guardian making the request: “We have completed processing your request for notification of or access to _____'s (Name of minor) medical records. Please be informed that if any medical record was found pertaining to that individual, it has been sent to your designated physician or health professional.” (iv) In each case where we send a minor's medical record to a physician or health professional, we will make reasonable efforts to inform the minor that we have given the record to the representative. (3) Requests on behalf of an incapacitated adult. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20939, Apr. 27, 2007] § 401.60 Access to or notification of program records about more than one individual. When information about more than one individual is in one record filed under your social security number, you may receive the information about you and the fact of entitlement and the amount of benefits payable to other persons based on your record. You may receive information about yourself or others, which is filed under someone else's social security number, if that information affects your entitlement to social security benefits or the amount of those benefits. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20940, Apr. 27, 2007] § 401.65 How to correct your record. (a) How to request a correction. Federal Register (1) The system of records from which the record is retrieved; (2) The particular record which you want to correct or amend; (3) Whether you want to add, delete or substitute information in the record; and (4) Your reasons for believing that your record should be corrected or amended. (b) What we will not change. (c) Acknowledgment of correction request. (d) Notice of error. (e) Record found to be correct. (f) Record of another government agency. § 401.70 Appeals of refusals to correct records or refusals to allow access to records. (a) General. (b) Appeal of refusal to correct or amend records. (1) We will review your request within 30 working days from the date of the receipt. However, for a good reason and with the approval of the Executive Director for the Office of Privacy and Disclosure, we may extend this time limit up to an additional 30 days. In that case, we will notify you about the delay, the reason for it and the date when the review is expected to be completed. (2) If, after review, we determine that the record should be corrected, we will do so. However, if we refuse to amend the record as you requested, we will inform you that— (i) Your request has been refused and the reason for the refusal; (ii) The refusal is our final decision; and (iii) You have a right to seek court review of our final decision. (3) We will also inform you that you have a right to file a statement of disagreement with the decision. Your statement should include the reason you disagree. We will make your statement available to anyone to whom the record is subsequently disclosed, together with a statement of our reasons for refusing to amend the record. Also, we will provide a copy of your statement to individuals whom we are aware received the record previously. (c) Appeals after denial of access. (d) Filing your appeal. [72 FR 20940, Apr. 27, 2007, as amended at 88 FR 1329, Jan. 10, 2023] § 401.75 Rights of parents or legal guardians. For purposes of this part, a parent or guardian of any minor or the legal guardian of any individual who has been declared incompetent due to physical or mental incapacity or age by a court of competent jurisdiction is authorized to act on behalf of a minor or incompetent individual. Except as provided in § 401.45, governing procedures for verifying an individual's identity, and § 401.55(c) governing special procedures for notification of or access to a minor's medical records, if you are authorized to act on behalf of a minor or legal incompetent, you will be viewed as if you were the individual or subject individual. § 401.80 Accounting for disclosures. (a) We will maintain an accounting of all disclosures of a record for five years or for the life of the record, whichever is longer; except that, (1) Disclosures under paragraphs (a) and (b) of § 401.110; and, (2) Disclosures of your record made with your written consent. (b) The accounting will include: (1) The date, nature, and purpose of each disclosure; and (2) The name and address of the person or entity to whom the disclosure is made. (c) You may request access to an accounting of disclosures of your record. You must request access to an accounting in accordance with the procedures in § 401.40. You will be granted access to an accounting of the disclosures of your record in accordance with the procedures of this part which govern access to the related record. We may, at our discretion, grant access to an accounting of a disclosure of a record made under paragraph (g) of § 401.110. § 401.85 Exempt systems. (a) General policy. (b) Specific systems of records exempted. (i) 5 U.S.C. 552a(c)(3) and paragraph (c) of § 401.80 of this part which require that you be granted access to an accounting of disclosures of your record. (ii) 5 U.S.C. 552a (d) (1) through (4) and (f) and §§ 401.35 through 401.75 relating to notification of or access to records and correction or amendment of records. (iii) 5 U.S.C. 552a(e)(4) (G) and (H) which require that we include information about SSA procedures for notification, access, and correction or amendment of records in the notice for the systems of records. (iv) 5 U.S.C. 552a(e)(3) and § 401.30 which require that if we ask you to provide a record to us, we must inform you of the authority for our asking you to provide the record (including whether providing the record is mandatory or voluntary, the principal purposes for maintaining the record, the routine uses for the record, and what effect your refusal to provide the record may have on you), and if you are not required by statute or Executive Order to provide the record, that you agree to provide the record. This exemption applies only to an investigatory record compiled by SSA for criminal law enforcement purposes in a system of records exempt under subsection (j)(2) of the Privacy Act to the extent that these requirements would prejudice the conduct of the investigation. (2) The following systems of records are exempt from those provisions of the Privacy Act and this part listed in paragraph (b)(1) of this section: (i) Pursuant to subsection (j)(2) of the Privacy Act, the Investigatory Material Compiled for Law Enforcement Purposes System, SSA. (ii) Pursuant to subsection (k)(2) of the Privacy Act: (A) The General Criminal Investigation Files, SSA; (B) The Criminal Investigations File, SSA; and, (C) The Program Integrity Case Files, SSA. (D) Civil and Administrative Investigative Files of the Inspector General, SSA/OIG. (E) Complaint Files and Log. SSA/OGC. (F) Anti-Harassment & Hostile Work Environment Case Tracking and Records System, SSA. (G) Social Security Administration Violence Evaluation and Reporting System, SSA. (H) Anti-Fraud System, SSA. (iii) Pursuant to subsection (k)(5) of the Privacy Act: (A) Security and Suitability Files. (B) [Reserved] (iv) Pursuant to subsection (k)(6) of the Privacy Act, the Personnel Research and Merit Promotion Test Records, SSA/DCHR/OPE. (c) Notification of or access to records in exempt systems of records. (2) We will grant you notification of or access to a record in an exempt system but only to the extent such notification or access would not reveal the identity of a source who furnished the record to us under an express promise, and prior to September 27, 1975, an implied promise, that his or her identity would be held in confidence, if: (i) The record is in a system of records which is exempt under subsection (k)(2) of the Privacy Act and you have been, as a result of the maintenance of the record, denied a right, privilege, or benefit to which you would otherwise be eligible; or, (ii) The record is in a system of records which is exempt under subsection (k)(5) of the Privacy Act. (3) If we do not grant you notification of or access to a record in a system of records exempt under subsections (k) (2) and (5) of the Privacy Act in accordance with this paragraph, we will inform you that the identity of a confidential source would be revealed if we granted you notification of or access to the record. (d) Discretionary actions by SSA. [62 FR 4143, Jan. 29, 1997, as amended at 82 FR 16510, Apr. 5, 2017; 83 FR 63416, Dec. 10, 2018; 84 FR 45901, Sept. 3, 2019; 87 FR 25141, Apr. 28, 2022] § 401.90 Contractors. (a) All contracts which require a contractor to maintain, or on behalf of SSA to maintain, a system of records to accomplish an SSA function must contain a provision requiring the contractor to comply with the Privacy Act and this part. (b) A contractor and any employee of such contractor will be considered employees of SSA only for the purposes of the criminal penalties of the Privacy Act, 5 U.S.C. 552a(i), and the employee standards of conduct (see appendix A of this part) where the contract contains a provision requiring the contractor to comply with the Privacy Act and this part. (c) This section does not apply to systems of records maintained by a contractor as a result of his management discretion, e.g., the contractor's personnel records. § 401.95 Fees. (a) Policy. (b) Fee schedule. (1) Copying of records susceptible to photocopying—$.10 per page. (2) Copying records not susceptible to photocopying (e.g., punch cards or magnetic tapes)—at actual cost to be determined on a case-by-case basis. (3) We will not charge if the total amount of copying does not exceed $25. (c) Other fees. Subpart C—Disclosure of Official Records and Information § 401.100 Disclosure of records with the written consent of the subject of the record. (a) General. (b) Disclosure with written consent. (c) Disclosure of the entire record. (d) A parent or guardian of a minor is not authorized to give written consent to a disclosure of a minor's medical record. See § 401.55(c)(2) for the procedures for disclosure of or access to medical records of minors. [72 FR 20940, Apr. 27, 2007] § 401.105 Disclosure of personal information without the consent of the subject of the record. (a) SSA maintains two categories of records which contain personal information: (1) Nonprogram records, primarily administrative and personnel records which contain information about SSA's activities as a government agency and employer, and (2) Program records which contain information about SSA's clients that it keeps to administer benefit programs under Federal law. (b) We apply different levels of confidentiality to disclosures of information in the categories in paragraphs (a) (1) and (2) of this section. For administrative and personnel records, the Privacy Act applies. To the extent that SSA has physical custody of personnel records maintained as part of the Office of Personnel Management's (OPM) Privacy Act government-wide systems of records, these records are subject to OPM's rules on access and disclosure at 5 CFR parts 293 and 297. For program records, we apply somewhat more strict confidentiality standards than those found in the Privacy Act. The reason for this difference in treatment is that our program records include information about a much greater number of persons than our administrative records, the information we must collect for program purposes is often very sensitive, and claimants are required by statute and regulation to provide us with the information in order to establish entitlement for benefits. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20940, Apr. 27, 2007] § 401.110 Disclosure of personal information in nonprogram records without the consent of the subject of the record. The disclosures listed in this section may be made from our nonprogram records, e.g., administrative and personnel records, without your consent. Such disclosures are those: (a) To officers and employees of SSA who have a need for the record in the performance of their duties. The SSA official who is responsible for the record may upon request of any officer or employee, or on his own initiative, determine what constitutes legitimate need. (b) Required to be disclosed under the Freedom of Information Act, 5 U.S.C. 552, and 20 CFR part 402. (c) For a routine use as defined in § 401.25 of this part. Routine uses will be listed in any notice of a system of records. SSA publishes notices of systems of records, including all pertinent routine uses, in the Federal Register. (d) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13 U.S.C. (e) To a recipient who has provided us with advance written assurance that the record will be used solely as a statistical research or reporting record; Provided, (f) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of General Services or his designee to determine whether the record has such value. (g) To another government agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of such government agency or instrumentality has submitted a written request to us, specifying the record desired and the law enforcement activity for which the record is sought. (h) To an individual pursuant to a showing of compelling circumstances affecting the health or safety of any individual if a notice of the disclosure is transmitted to the last known address of the subject individual. (i) To either House of Congress, or to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee. (j) To the Comptroller General, or any of his authorized representatives, in the course of the performance of duties of the Government Accountability Office. (k) Pursuant to the order of a court of competent jurisdiction. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20940, Apr. 27, 2007] § 401.115 Disclosure of personal information in program records without the consent of the subject of the record. This section describes how various laws control the disclosure of personal information that we keep. We disclose information in the program records only when a legitimate need exists. For example, we disclose information to officers and employees of SSA who have a need for the record in the performance of their duties. We also must consider the laws identified below in the respective order when we disclose program information: (a) Some laws require us to disclose information (§ 401.120); some laws require us to withhold information (§ 401.125). These laws control whenever they apply. (b) If no law of this type applies in a given case, then we must look to FOIA principles. See § 401.130. (c) When FOIA principles do not require disclosure, we may disclose information if both the Privacy Act and section 1106 of the Social Security Act permit the disclosure. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20940, Apr. 27, 2007] § 401.120 Disclosures required by law. We disclose information when a law specifically requires it. The Social Security Act requires us to disclose information for certain program purposes. These include disclosures to the SSA Office of Inspector General, the Federal Parent Locator Service, and to States pursuant to an arrangement regarding use of the Blood Donor Locator Service. Also, there are other laws which require that we furnish other agencies information which they need for their programs. These agencies include the Department of Veterans Affairs for its benefit programs, U.S. Citizenship and Immigration Services to carry out its duties regarding aliens, the Railroad Retirement Board for its benefit programs, and to Federal, State and local agencies administering Temporary Assistance for Needy Families, Medicaid, unemployment compensation, food stamps, and other programs. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20941, Apr. 27, 2007] § 401.125 Disclosures prohibited by law. We do not disclose information when a law specifically prohibits it. The Internal Revenue Code generally prohibits us from disclosing tax return information which we receive to maintain individual earnings records. This includes, for example, amounts of wages and contributions from employers. Other laws restrict our disclosure of certain information about drug and alcohol abuse which we collect to determine eligibility for social security benefits. § 401.130 Freedom of Information Act. The FOIA requires us to disclose any information in our records upon request from the public, unless one of several exemptions in the FOIA applies. When the FOIA requires disclosure (see part 402 of this chapter), the Privacy Act permits it. The public the public § 401.135 Other laws. When the FOIA does not apply, we may not disclose any personal information unless both the Privacy Act and section 1106 of the Social Security Act permit the disclosure. Section 1106 of the Social Security Act requires that disclosures which may be made must be set out in statute or regulations; therefore, any disclosure permitted by this part is permitted by section 1106. § 401.140 General principles. When no law specifically requiring or prohibiting disclosure applies to a question of whether to disclose information, we follow FOIA principles to resolve that question. We do this to insure uniform treatment in all situations. The FOIA principle which most often applies to SSA disclosure questions is whether the disclosure would result in a “clearly unwarranted invasion of personal privacy.” To decide whether a disclosure would be a clearly unwarranted invasion of personal privacy we consider— (a) The sensitivity of the information (e.g., whether individuals would suffer harm or embarrassment as a result of the disclosure); (b) The public interest in the disclosure; (c) The rights and expectations of individuals to have their personal information kept confidential; (d) The public's interest in maintaining general standards of confidentiality of personal information; and (e) The existence of safeguards against unauthorized redisclosure or use. § 401.145 Safeguards against unauthorized redisclosure or use. (a) The FOIA does not authorize us to impose any restrictions on how information is used after we disclose it under that law. In applying FOIA principles, we consider whether the information will be adequately safeguarded against improper use or redisclosure. We must consider all the ways in which the recipient might use the information and how likely the recipient is to redisclose the information to other parties. Thus, before we disclose personal information we may consider such factors as— (1) Whether only those individuals who have a need to know the information will obtain it; (2) Whether appropriate measures to safeguard the information to avoid unwarranted use or misuse will be taken; and (3) Whether we would be permitted to conduct on-site inspections to see whether the safeguards are being met. (b) We feel that there is a strong public interest in sharing information with other agencies with programs having the same or similar purposes, so we generally share information with those agencies. However, since there is usually little or no public interest in disclosing information for disputes between two private parties or for other private or commercial purposes, we generally do not share information for these purposes. § 401.150 Compatible purposes. (a) General. (b) Notice of routine use disclosures. Federal Register. (c) Determining compatibility Disclosure to carry out SSA programs. (2) Disclosure to carry out programs similar to SSA programs. (i) The program is clearly identifiable as a Federal, State, or local government program. (ii) The information requested concerns eligibility, benefit amounts, or other matters of benefit status in a Social Security program and is relevant to determining the same matters in the other program. For example, we disclose information to the Railroad Retirement Board for pension and unemployment compensation programs, to the Department of Veterans Affairs for its benefit programs, to worker's compensation programs, to State general assistance programs and to other income maintenance programs at all levels of government. We also disclose for health maintenance programs like Medicaid and Medicare. (iii) The information will be used for appropriate epidemiological or similar research purposes. [72 FR 20941, Apr. 27, 2007] § 401.155 Law enforcement purposes. (a) General. (b) Serious crimes. (c) Criminal activity involving the social security program or another program with the same purposes. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20941, Apr. 27, 2007] § 401.160 Health or safety. The Privacy Act allows us to disclose information in compelling circumstances where an individual's health or safety is affected. For example, if we learn that someone has been exposed to an excessive amount of radiation, we may notify that person and appropriate health officials. If we learn that someone has made a threat against someone else, we may notify that other person and law enforcement officials. When we make these disclosures, the Privacy Act requires us to send a notice of the disclosure to the last known address of the person whose record was disclosed. § 401.165 Statistical and research activities. (a) General. (b) Safeguards for disclosure with identifiers. (1) We determine that the requestor needs the information in an identifiable form for a statistical or research activity, will use the information only for that purpose, and will protect individuals from unreasonable and unwanted contacts; (2) The activity is designed to increase knowledge about present or alternative Social Security programs or other Federal or State income-maintenance or health-maintenance programs; or is used for research that is of importance to the Social Security program or the Social Security beneficiaries; or an epidemiological research project that relates to the Social Security program or beneficiaries; and (3) The recipient will keep the information as a system of statistical records, will follow appropriate safeguards, and agrees to our on-site inspection of those safeguards so we can be sure the information is used or redisclosed only for statistical or research purposes. No redisclosure of the information may be made without SSA's approval. (c) Statistical record. (d) Compiling of records. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 20941, Apr. 27, 2007] § 401.170 Congress. (a) We disclose information to either House of Congress. We also disclose information to any committee or subcommittee of either House, or to any joint committee of Congress or subcommittee of that committee, if the information is on a matter within the committee's or subcommittee's jurisdiction. (b) We disclose to any member of Congress the information needed to respond to constituents' requests for information about themselves (including requests from parents of minors, or legal guardians). However, these disclosures are subject to the restrictions in §§ 401.35 through 401.60. § 401.175 Government Accountability Office. We disclose information to the Government Accountability Office when that agency needs the information to carry out its duties. [72 FR 20941, Apr. 27, 2007] § 401.180 Disclosure under court order or other legal process. (a) General. (b) Court. (c) Court order. (1) It is issued under the authority of a Federal court; (2) A judge or a magistrate judge of that court signs it; (3) It commands SSA to disclose information; and (4) The court is a court of competent jurisdiction. (d) Court of competent jurisdiction. (e) Conditions for disclosure under a court order of competent jurisdiction. (1) another section of this part specifically allows such disclosure, or (2) SSA, the Commissioner of Social Security, or any officer or employee of SSA in his or her official capacity is properly a party in the proceeding, or (3) disclosure of the information is necessary to ensure that an individual who is accused of criminal activity receives due process of law in a criminal proceeding under the jurisdiction of the judicial branch of the Federal government. (f) In other circumstances. in camera (g) Other regulations on request for testimony, subpoenas and production of records in legal proceedings. [72 FR 20941, Apr. 27, 2007] § 401.185 Other specific recipients. In addition to disclosures we make under the routine use provision, we also release information to— (a) The Bureau of the Census for purposes of planning or carrying out a census, survey, or related activity; and (b) The National Archives of the United States if the record has sufficient historical or other value to warrant its continued preservation by the United States Government. We also disclose a record to the Administrator of General Services for a determination of whether the record has such a value. § 401.190 Deceased persons. We do not consider the disclosure of information about a deceased person to be a clearly unwarranted invasion of that person's privacy. However, in disclosing information about a deceased person, we follow the principles in § 401.115 to insure that the privacy rights of a living person are not violated. § 401.195 Situations not specified in this part. If no other provision in this part specifically allows SSA to disclose information, the Commissioner or designee may disclose this information if not prohibited by Federal law. For example, the Commissioner or designee may disclose information necessary to respond to life threatening situations. § 401.200 Blood donor locator service. (a) General. (b) Definitions. State Authorized person (1) Any agency of a State (or of a political subdivision of a State) which has duties or authority under State law relating to the public health or otherwise has the duty or authority under State law to regulate blood donations; and (2) Any entity engaged in the acceptance of blood donations which is licensed or registered by the Food and Drug Administration in connection with the acceptance of such blood donations, and which provides for— (i) The confidentiality of any address information received pursuant to the rules in this part and section 1141 of the Social Security Act and related blood donor records; (ii) Blood donor notification procedures for individuals with respect to whom such information is requested and a finding has been made that they are or may be infected with the human immunodeficiency virus; and (iii) Counseling services for such individuals who have been found to have such virus. New counseling programs are not required, and an entity may use existing counseling programs or referrals to provide these services. Related blood donor records (c) Use of social security number for identification. (d) Request for address of blood donor. (1) Be in writing; (2) Be from a participating State agency either on its own behalf as an authorized person or on behalf of another authorized person; (3) Indicate that the authorized person meets the confidentiality safeguards of paragraph (g) of this section; and (4) Include the donor's name and social security number, the addresses at which the authorized person attempted without success to contact the donor, the date of the blood donation if available, a statement that the donor has tested positive for the human immunodeficiency virus according to the latest Food and Drug Administration standards or that the history of the subsequent use of the donated blood or blood products indicates that the donor has or may have the human immunodeficiency virus, and the name and address of the requesting blood donation facility. (e) SSA response to request for address. (f) SSA refusal to furnish address. (g) Safeguards to ensure confidentiality of blood donor records. (1) Establish and maintain a system for standardizing records which includes the reasons for requesting the addresses of blood donors, dates of the requests, and any disclosures of address information; (2) Store blood donors' addresses received from the Blood Donor Locator Service and all related blood donor records in a secure area or place that is physically safe from access by persons other than those whose duties and responsibilities require access; (3) Restrict access to these records to authorized employees and officials who need them to perform their official duties related to notifying blood donors who are or may be infected with the human immunodeficiency virus that they may need medical care and treatment; (4) Advise all personnel who will have access to the records of the confidential nature of the information, the safeguards required to protect the information, and the civil and criminal sanctions for unauthorized use or disclosure of the information; (5) Destroy the address information received from the Blood Donor Locator Service, as well as any records established in connection with the request which indicate directly or indirectly the identity of the individual, after notifying or attempting to notify the donor at the address obtained from the Blood Donor Locator Service; and (6) Upon request, report to us the procedures established and utilized to ensure the confidentiality of address information and related blood donor records. We reserve the right to make onsite inspections to ensure that these procedures are adequate and are being followed and to request such information as we may need to ensure that the safeguards required in this section are being met. (h) Unauthorized disclosure. Appendix A to Part 401—Employee Standards of Conduct (a) General. (b) Penalties. (2) SSA may be subjected to civil liability for the following actions undertaken by its employees: (a) Making a determination under the Privacy Act and §§ 401.65 and 401.70 not to amend an individual's record in accordance with his or her request, or failing to make such review in conformity with those provisions; (b) Refusing to comply with an individual's request for notification of or access to a record pertaining to him or her; (c) Failing to maintain any record pertaining to any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such a record, and consequently makes a determination which is adverse to the individual; or (d) Failing to comply with any other provision of the Act or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual. (3) An employee may be personally subject to criminal liability as set forth below and in 5 U.S.C. 552a (i): (a) Willful disclosure. (b) Notice requirements. (c) Rules governing employees not working with systems of records. (1) Name and title of individual. (2) Grade classification or equivalent and annual rate of salary. (3) Position description. In addition, employees shall disclose records which are listed in SSA's Freedom of Information Regulation as being available to the public. Requests for other records will be referred to the responsible SSA Freedom of Information Officer. This does not preclude employees from discussing matters which are known to them personally, and without resort to a record, to official investigators of Federal agencies for official purposes such as suitability checks, Equal Employment Opportunity investigations, adverse action proceedings, grievance proceedings, etc. (d) Rules governing employees whose duties require use or reference to systems of records. (1) Systems Employees shall: (a) Be informed with respect to their responsibilities under the Privacy Act; (b) Be alert to possible misuses of the system and report to their supervisors any potential or actual use of the system which they believe is not in compliance with the Privacy Act and regulation; (c) Disclose records within SSA only to an employee who has a legitimate need to know the record in the course of his or her official duties; (d) Maintain records as accurately as practicable. (e) Consult with a supervisor prior to taking any action where they are in doubt whether such action is in conformance with the Act and regulation. (2) Systems employees shall not: (a) Disclose in any form records from a system of records except (1) with the consent or at the request of the subject individual; or (2) where its disclosure is permitted under § 401.110. (b) Permit unauthorized individuals to be present in controlled areas. Any unauthorized individuals observed in controlled areas shall be reported to a supervisor or to the guard force. (c) Knowingly or willfully take action which might subject SSA to civil liability. (d) Make any arrangements for the design, development, or operation of any system of records without making reasonable effort to provide that the system can be maintained in accordance with the Act and regulation. (e) Contracting officers. (1) Contracts for design, or development of systems and equipment. (2) Contracts for the operation of systems of records. (3) Other service contracts. (f) Rules governing SSA officials responsible for managing systems of records. (1) Respond to all requests for notification of or access, disclosure, or amendment of records in a timely fashion in accordance with the Privacy Act and regulation; (2) Make any amendment of records accurately and in a timely fashion; (3) Inform all persons whom the accounting records show have received copies of the record prior to the amendments of the correction; and (4) Associate any statement of disagreement with the disputed record, and (a) Transmit a copy of the statement to all persons whom the accounting records show have received a copy of the disputed record, and (b) Transmit that statement with any future disclosure. [62 FR 4143, Jan. 29, 1997, as amended at 72 FR 69617, Dec. 10, 2007]