---
kind: "range"
citation: "20 C.F.R. §§ 401.35–401.60"
title: "20"
from: "401.35"
to: "401.60"
count: 6
url: "https://uscodex.org/cfr/20/401.35..401.60"
---

# §401.35. Your right to request records.


The Privacy Act gives you the right to direct access to most records about yourself that are in our systems of records. Exceptions to this Privacy Act right include—

- (a) Special procedures for access to certain medical records (see [5 U.S.C. 552a(f)(3)](/usc/5/552a.md?p=f-3) and [§ 401.55](/cfr/20/401.55.md));
- (b) Unavailability of certain criminal law enforcement records (see [5 U.S.C. 552a(k)](/usc/5/552a.md?p=k), and [§ 401.85](/cfr/20/401.85.md)); and
- (c) Unavailability of records compiled in reasonable anticipation of a court action or formal administrative proceeding.

# §401.40. How to get your own records.

- (a) **Your right to notification and access.** Subject to the provisions governing medical records in [§ 401.55](/cfr/20/401.55.md), you may ask for notification of or access to any record about yourself that is in an SSA system of records. If you are a minor, you may get information about yourself under the same rules as for an adult. Under the Privacy Act, if you are the parent or guardian of a minor, or the legal guardian of someone who has been declared legally incompetent, and you are acting on his or her behalf, you may ask for information about that individual. You may be accompanied by another individual of your choice when you request access to a record in person, provided that you affirmatively authorize the presence of such other individual during any discussion of a record to which you are requesting access.
- (b) **Identifying the records.** At the time of your request, you must specify which systems of records you wish to have searched and the records to which you wish to have access. You may also request copies of all or any such records. Also, we may ask you to provide sufficient particulars to enable us to distinguish between records on individuals with the same name. The necessary particulars are set forth in the notices of systems of records which are published in the Federal Register.
- (c) **Requesting notification or access.** To request notification of or access to a record, you may visit your local social security office or write to the manager of the SSA system of records. The name and address of the manager of the system is part of the notice of systems of records. Every local social security office keeps a copy of the Federal Register containing that notice. That office can also help you get access to your record. You do not need to use any special form to ask for a record about you in our files, but your request must give enough identifying information about the record you want to enable us to find your particular record. This identifying information should include the system of records in which the record is located and the name and social security number (or other identifier) under which the record is filed. We do not honor requests for all records, all information, or similar blanket requests. Before granting notification of or access to a record, we may, if you are making your request in person, require you to put your request in writing if you have not already done so.

# §401.45. Verifying your identity.

- (a) **When required.** Unless you are making a request for notification of or access to a record in person, and you are personally known to the SSA representative, you must verify your identity in accordance with [paragraph (b)](#b) of this section if:
  - (1) You make a request for notification of a record and we determine that the mere notice of the existence of the record would be a clearly unwarranted invasion of privacy if disclosed to someone other than the subject individual; or,
  - (2) You make a request for access to a record which is not required to be disclosed to the general public under the Freedom of Information Act, [5 U.S.C. 552](/usc/5/552.md), and [part 402](/cfr/20/part402.md) of this chapter.
- (b) **Manner of verifying identity—**
  - (1) **Request in person.** If you make a request to us in person, you must provide at least one piece of tangible identification such as a driver's license, passport, alien or voter registration card, or union card to verify your identity. If you do not have identification papers to verify your identity, you must certify in writing that you are the individual who you claim to be and that you understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense.
  - (2) **Request by telephone.** If you make a request by telephone, you must verify your identity by providing identifying particulars which parallel the record to which notification or access is being sought. If we determine that the particulars provided by telephone are insufficient, you will be required to submit your request in writing or in person. We will not accept telephone requests where an individual is requesting notification of or access to sensitive records such as medical records.
  - (3) **Electronic requests.** If you make a request by computer or other electronic means, e.g., over the Internet, we require you to verify your identity by using identity confirmation procedures that are commensurate with the sensitivity of the information that you are requesting. If we cannot confirm your identity using our identity confirmation procedures, we will not process the electronic request. When you cannot verify your identity through our procedures, we will require you to submit your request in writing.
  - (4) **Electronic disclosures.** When we collect or provide personally identifiable information over open networks such as the Internet, we use encryption in all of our automated online transaction systems to protect the confidentiality of the information. When we provide an online access option, such as a standard e-mail comment form on our Web site, and encryption is not being used, we alert you that personally identifiable information (such as your social security number) should not be included in your message.
  - (5) **Requests not made in person.** Except as provided in [paragraphs (b)(2)](#b-2) of this section, if you do not make a request in person, you must submit a written request to SSA to verify your identify or you must certify in your request that you are the individual you claim to be. You must also sign a statement that you understand that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense.
  - (6) **Requests on behalf of another.** If you make a request on behalf of a minor or legal incompetent as authorized under [§ 401.40](/cfr/20/401.40.md), you must verify your relationship to the minor or legal incompetent, in addition to verifying your own identity, by providing a copy of the minor's birth certificate, a court order, or other competent evidence of guardianship to SSA; except that you are not required to verify your relationship to the minor or legal incompetent when you are not required to verify your own identity or when evidence of your relationship to the minor or legal incompetent has been previously given to SSA.
  - (7) **Medical records—additional verification.** You need to further verify your identity if you are requesting notification of or access to sensitive records such as medical records. Any information for further verification must parallel the information in the record to which notification or access is being sought. Such further verification may include such particulars as the date or place of birth, names of parents, name of employer or the specific times the individual received medical treatment.

# §401.50. Granting notification of or access to a record.

- (a) **General.** Subject to the provisions governing medical records in [§ 401.55](/cfr/20/401.55.md) and the provisions governing exempt systems in [§ 401.85](/cfr/20/401.85.md), upon receipt of your request for notification of or access to a record and verification of your identity, we will review your request and grant notification or access to a record, if you are the subject of the record.
- (b) **Our delay in responding.** If we determine that we will have to delay responding to your request because of the number of requests we are processing, a breakdown of equipment, shortage of personnel, storage of records in other locations, etc., we will so inform you and tell you when notification or access will be granted.

# §401.55. Access to medical records.

- (a) **General.** You have a right to access your medical records, including any psychological information that we maintain.
- (b) **Medical records procedures—**
  - (1) **Notification of or access to medical records.**
    - (i) You may request notification of or access to a medical record pertaining to you. Unless you are a parent or guardian requesting notification of or access to a minor's medical record, you must make a request for a medical record in accordance with this section and the procedures in [§§ 401.45 through 401.50](/cfr/20/401.45..401.50.md) of this part.
    - (ii) When you request medical information about yourself, you must also name a representative in writing. The representative may be a physician, other health professional, or other responsible individual who will be willing to review the record and inform you of its contents. Following the discussion, you are entitled to your records. The representative does not have the discretion to withhold any part of your record. If you do not designate a representative, we may decline to release the requested information. In some cases, it may be possible to release medical information directly to you rather than to your representative.
  - (2) **Utilization of the designated representative.** You will be granted direct access to your medical record if we can determine that direct access is not likely to have an adverse effect on you. If we believe that we are not qualified to determine, or if we do determine, that direct access to you is likely to have an adverse effect, the record will be sent to the designated representative. We will inform you in writing that the record has been sent.
- (c) **Medical records of minors—**
  - (1) **Request by the minor.** You may request access to your own medical records in accordance with [paragraph (b)](#b) of this section.
  - (2) **Requests on a minor's behalf; notification of or access to medical records to an individual on a minor's behalf.**
    - (i) To protect the privacy of a minor, we will not give to a parent or guardian direct notification of or access to a minor's record, even though the parent or guardian who requests such notification or access is authorized to act on a minor's behalf as provided in [§ 401.75](/cfr/20/401.75.md) of this part.
    - (ii) A parent or guardian must make all requests for notification of or access to a minor's medical record in accordance with this paragraph and the procedures in [§§ 401.45 through 401.50](/cfr/20/401.45..401.50.md) of this part. A parent or guardian must at the time he or she makes a request designate a family physician or other health professional (other than a family member) to whom the record, if any, will be sent. If the parent or guardian will not designate a representative, we will decline to release the requested information.
    - (iii) Where a medical record on the minor exists, we will in all cases send it to the physician or health professional designated by the parent or guardian. The representative will review the record, discuss its contents with the parent or legal guardian, then release the entire record to the parent or legal guardian. The representative does not have the discretion to withhold any part of the minor's record. We will respond in the following similar manner to the parent or guardian making the request: “We have completed processing your request for notification of or access to _____'s (Name of minor) medical records. Please be informed that if any medical record was found pertaining to that individual, it has been sent to your designated physician or health professional.”
    - (iv) In each case where we send a minor's medical record to a physician or health professional, we will make reasonable efforts to inform the minor that we have given the record to the representative.
  - (3) **Requests on behalf of an incapacitated adult.** If you are the legal guardian of an adult who has been declared legally incompetent, you may receive his or her records directly.

# §401.60. Access to or notification of program records about more than one individual.


When information about more than one individual is in one record filed under your social security number, you may receive the information about you and the fact of entitlement and the amount of benefits payable to other persons based on your record. You may receive information about yourself or others, which is filed under someone else's social security number, if that information affects your entitlement to social security benefits or the amount of those benefits.