20 CFR §401.105

1. (a)SSA maintains two categories of records which contain personal information:
   1. (1)Nonprogram records, primarily administrative and personnel records which contain information about SSA's activities as a government agency and employer, and
   2. (2)Program records which contain information about SSA's clients that it keeps to administer benefit programs under Federal law.
2. (b)We apply different levels of confidentiality to disclosures of information in the categories in paragraphs (a) (1) and (2) of this section. For administrative and personnel records, the Privacy Act applies. To the extent that SSA has physical custody of personnel records maintained as part of the Office of Personnel Management's (OPM) Privacy Act government-wide systems of records, these records are subject to OPM's rules on access and disclosure at 5 CFR parts 293 and 297. For program records, we apply somewhat more strict confidentiality standards than those found in the Privacy Act. The reason for this difference in treatment is that our program records include information about a much greater number of persons than our administrative records, the information we must collect for program purposes is often very sensitive, and claimants are required by statute and regulation to provide us with the information in order to establish entitlement for benefits.