CMS Pub. 100-01, ch. 6, § 40

(Contractors)

(Rev. 1, 09-11-02)

Sections 3764 - 3769 set the guidelines for disclosure of information about a named

beneficiary, to whom it may be disclosed, and the purposes for which it may be disclosed.

In general, no information may be released except to the beneficiary (or the beneficiary's

legal guardian) without the beneficiary's (or legal guardian's) explicit written

authorization.

In cases requiring the beneficiary's consent, the authorization may be in any form, but it

must:

• Be signed and dated;

• Specify the individual, organizational unit, class of individuals or organizational

units to which the information may be disclosed;

• Specify the record(s), information, or type(s) of information which may be

disclosed; and

• Indicate whether the consent is a one-time or on-going release of records.

A contractor will not honor a blanket consent to disclose all beneficiary records to

unspecified individuals or organizational units.

The disclosure of information about beneficiaries is governed by the provisions of § 1106

if the Social Security Act as implemented by Regulation No. 1, the Privacy Act, the FOI

Act, and the DHHS Public Information Regulation.