The SSA may retrieve patients’ medical information only for patients who have provided the SSA with a signed authorization form.