215 F.3d 743
7th Cir.
2000
RIPPLE, Circuit Judge.

Gеrald Bavido wants the Social Security Administration (“SSA”) to let him see his medical records. He wants, moreover, direct access to the records and does not want to name a physician or other individual to receive them on his behalf, as SSA regulations require. Mr. Bavido declined to designate a representative and subsequently filed this action raising claims cognizable under the Privacy Act. The distriсt court concluded that it lacked subject matter jurisdiction because Mr. Bavido had failed to exhaust his administrative remedies.

We believe that the district court had jurisdiction because, under the circumstances here, Mr. Bavido was not required to exhaust administrative regulations. We also conclude, in agreement with the Court of Appeals for the District of Columbia Circuit, that the current regulations are incompatible with the clear mandate of the statute. Accordingly, we reverse the judgment of the district court and remand the case for proceedings consistent with this opinion.

I

BACKGROUND

In early 1997, Mr. Bavido began submitting written requests to SSA, asking that copies of his medical records be released directly to him. He claimed that the agency had compiled these records in connection with his application for disability benefits. The agency denied his requests because Mr. Bavido refused to comply with its regulatory requirement that he designate a representative to receive the records. According to assertions made by Mr. Bavido in the district court (the record does not contain any of the correspondence from SSA denying the requests), the agency imposed this requirement bеcause it had determined'that direct disclosure of the records to Mr. Bavido would adversely affect him. Mr. Bavido’s subsequent inquiries to the agency produced no further response.

In early 1998, Mr. Bavido, proceeding, pro se, submitted a form application to the district court to proceed in forma pauperis (“IFP”) against SSA. In addition to providing details about his salary history and assets, Mr. Bavido specified that the nature of the action he intended to bring was that “Social Security won’t give me an updated copy of my file” despite his efforts to obtain it “for over a year.” After the court granted him IFP status, Mr. Bavido filed a self-prepared version of a form complaint alleging that SSA had de nied him disability benefits. The single-page form complaint provided little detail, but stated that Mr. Bavido sought judicial review under 42 U.S.C. § 405(g) of an adverse decision of the Commissioner of Social Security and that this decision involved his “claim for Social Security file.” The preprinted complaint designated the Commissioner of Social Security as the defendant. According to a docket entry in the record, return of service was promptly executed on “defendant CSS.”

A hearing was held at which an assistant United Statеs attorney appeared on behalf of the agency. According to the docket entry for the hearing, Mr. Bavido reiterated that he “simply wants his file.” Shortly thereafter, SSA moved to dismiss Mr. Ba-vido’s complaint for lack of subject matter jurisdiction. See Fed.R.Civ.P. 12(b)(1). SSA argued that dismissal was warranted because Mr. Bavido, by failing to designate a medical representative, had not followed agency procedures for requesting records and thus had not exhausted his administrative remedies. Mr. Bavido responded to the motion by challenging the requirement that he designate a representative. He stated that it would “degrade him[ ] to let someone else read his private information.” Emphasizing that he “always handled my own business,” he asserted that “I don’t miss house payments, light bills, gas bills, so I don’t need anyone else telling me whether I can read my file.” Moreover, he insisted, the records in his file had nothing to do with anyone but himself: “No court, no one else for me to have to rely on. Just me.”

The magistrate judge, presiding with the consent of the parties, dismissed the action for lack of subject matter jurisdiction. The judge explained that Mr. Bavido failed to exhaust his administrative remedies by refusing to follow agency regulations and to designate a representative. According to the court, Mr. Bavido had chosen the “wrong way” to obtain his records and consequently had ended up at a “dead end.” Mr. Bavido filed a timely notice of appeal, and we appointed counsel to represent him.

II

DISCUSSION

Although Mr. Bavido’s complaint and the district court’s order assert jurisdiction under 42 U.S.C. § 405(g), jurisdiction is based properly on the Privacy Act, 5 U.S.C. § 552a(g)(l). 1 The Act authorizes individuals to bring suit in the district court to challenge an agency’s refusal to disclose records pertaining to them. It fosters “the principle that an individual should to the greatest extent possible be in control of information about him which is given to the government.” Darst v. Social Sec. Admin., 172 F.3d 1065, 1067 (8th Cir.1999) (citation and internal quotation marks omitted); cf. Haynes v. Alfred A. Knopf, Inc., 8 F.3d 1222, 1229 (7th Cir.1993) (“The desire for privacy ... is a mysterious but deep fact about human personality. It deserves and in our society ‍‌‌​​‌​​‌​​​​​‌‌‌‌‌​​‌‌‌​‌‌‌​‌‌‌​‌​‌‌​‌​‌​‌‌​‌‌​‌‍receives legal protectionAppellate jurisdiction is based upon 28 U.S.C. § 1291.

A.

At the outset, we note that Kenneth Apfel, in his capacity as SSA Commissioner, is not a proper party defendant in this Privacy Act action. The Privacy Act authorizes suit only against an agency, and not an individual. See 5 U.S.C. § 552a(g)(l). Several courts, including our own, have held that individual officers of federal agencies are not proper рarties to a Privacy Act action. 2

Improper denomination of defendants may be waived by the government. See Scruggs v. United States, 929 F.2d 305, 305-06 (7th Cir.1991) (defendant in Privacy Act action improperly designated as “United States”); see also Smith v. United States Dist. Court Officers, 203 F.3d 440, 442 (7th Cir.2000) (defendants in access-to-judicial-records suit designated as “unnamed officers of the district court”). At oral argument, SSA admitted that it had received proper notice in this case and that it did not dispute its designatiоn as defendant. It, moreover, had fully defended the action from its inception. Accordingly, SSA has waived any objection as to the naming of the proper party defendant. 3

B.

SSA has predicated most of its arguments in this case on the proposition that Mr. Bavido has failed to exhaust his administrative remedies because he did not make a proper Privacy Act request. The district court acсepted the agency’s position and insisted on exhaustion. It concluded that Mr. Bavido failed to exhaust his administrative remedies because his request under the Privacy Act did not comport with SSA’s procedural requirements for access to medical records. Specifically, the court held that Mr. Bavido had not met the requirements of 20 C.F.R. § 401.55(b)(ii), which requires the requesting individual to designate a representаtive, who can be a “physician, other health professional, or other responsible individual,” to receive those records. A representative “must” be named before the agency will consider a request. See id. In addition, the court continued, Mr. Bavido’s refusal to designate a representative prevented him from exhausting his appellate remedies within the agency. Under the regulations, а requesting individual who declines to name a representative may not administratively appeal SSA’s refusal to provide access:

If we refuse to release a medical record because you did not designate a representative (§ 401.55) to receive the material, that refusal is not a formal denial of access and, therefore, may not be appealed to the Commissioner.

20 C.F.R. § 401.70(c) (emphasis added).

Mr. Bavido thus finds himself trapped. He cannot exhaust internal agency remedies unless he formally designates a representative to receive his records. To name such a representative would amount to conceding his case. As the Supreme Court has noted, exhaustion is unnecessary “where the challenge is to the adequacy of the agency procedure itself, such that ‘the question of the adequacy of-the administrative remedy ... [is] for all practical purposes identical with the merits of [the plaintiffs] lawsuit.’ ” McCarthy v. Madigan, 503 U.S. 140, 148, 112 S.Ct. 1081, 117 L.Ed.2d 291 (1992) (citation and quotation marks omitted). See also Taylor v. United States Treasury Dep't, 127 F.3d 470, 477 (5th Cir.1997); Benavides v. United States Bureau of Prisons, 995 F.2d 269, 271 & n. 1 (D.C.Cir.1993). Here, SSA’s administrative remedies do not allow Mr. Bavido to challenge the agency’s procedure governing access to records. Exhaustion therefore is not required.

C.

Mr. Bavido argues that the Social Security regulations governing access tо medical records violate the “letter, spirit, and intent” of the Privacy Act. This statute, he contends, requires governmental agencies to establish a procedure ‍‌‌​​‌​​‌​​​​​‌‌‌‌‌​​‌‌‌​‌‌‌​‌‌‌​‌​‌‌​‌​‌​‌‌​‌‌​‌‍for disclosing records to an individual. SSA regulations, however, condition access (and the right to administrative appeal) on designation of a representative who has complete discretion regarding disclosure of thе records. See 20 C.F.R. §§ 401.55(b)(1), 401.70(c).

The agency asserts that Mr. Bavido did not address this issue before the district court and that, therefore, it is waived. Contrary to the agency’s contention, however, Mr. Bavido’s pro se pleadings in the district court, construed liberally, preserve the claim. His single-page form complaint referred to a “final” decision concerning his Social Security file that “adversely affects” him and statеd that he had “exhausted his administrative remedies.” Moreover, his response to the agency’s motion to dismiss emphasized his desire to have direct access to his file, complained that the representative requirement was degrading and improper, insisted that he had exhausted his remedies by making proper requests, and argued that SSA’s failure to release his records in a timely manner -violated the Act. Finally, we note that the district court’s order characterized, albeit without discussion, the regulations as “valid.”

Having rejected the agency’s assertion of waiver, we turn to the merits and next consider whether SSA’s regulations conflict with the Privacy Act. The Privacy Act was intended to help individuals gain access to government records about themselves and to correct erroneous informatiоn in those records. See Blazy v. Tenet, 194 F.3d 90, 95-96 (D.C.Cir.1999). The Act 'permits individuals to make a written request for such records for review and copying. The Act also authorizes agencies to promulgate rules administering the process by which individuals may request records; subsection 552a(f)(3), the subsection before us in this case, requires agencies to establish a “special procedure ... for the disclosure to an individual of medical records, including psychologicаl records, pertaining to him.” 5 U.S.C. § 552a(f)(3) (emphasis added).

Mr. Bavido’s claim requires that we determine the validity of the SSÁ’s “special procedure” regulation implementing § 552a(f)(3). This regulation governs the manner in which SSA discloses records:

(b) Medical records procedures—
(1) Notification of or access to medical records.
(i) You may request notification of or access to a medical record pertaining to you.... [Y]ou must make a request for a medical record in accordancе with [these regulations].
(ii) When you request medical information about yourself, you must also name a representative in writing. The representative may be a physician, other health professional, or other responsible individual who would be willing to review the record and inform you of its contents at your representative’s discretion. If you do not designate a representative, we may decline to release the requested information. In some cases, it may be possible to release information directly to you rather than to your representative.

20 C.F.R. § 401.55(b)(1). According to the regulations, the agency determines whether an individual will be given direct access to the records or whether access will be provided only indirectly, through that individual’s designated representative:

(2) Utilization of the designated representative.
You will be grantеd direct access to your medical record if we can determine that direct access is not likely to have an adverse effect on you. If we believe that we are not qualified to determine, or if we do determine, that direct access to you is likely to have an adverse effect, the record will be sent to the designated representative. We will inform you in writing that the recоrd has been sent [to the designated representative].

20 C.F.R. § 401.55(b)(2).

Mr. Bavido argues that' § 401.55 is an impermissible interpretation of the Privacy Act’s special procedure provision, § 552a(f)(3). That provision’s plain language, he asserts, mandates the disclosure of records to the requesting individual; it does not contemplate that an agency can comply with this mandate by creating a “special prоcedure” that results only in disclosure to a designated representative.

The Court of Appeals for the District of Columbia Circuit ‍‌‌​​‌​​‌​​​​​‌‌‌‌‌​​‌‌‌​‌‌‌​‌‌‌​‌​‌‌​‌​‌​‌‌​‌‌​‌‍considered an analogous regulatory scheme in Benavides v. United States Bureau of Prisons, 995 F.2d 269 (D.C.Cir.1993). In that case, the Justice Department had promulgated a regulation that purported to be a “special procedure” under § 552a(f)(3). Under the regulation, the Justice Department required, as a condition of disclosing medical records, that the requesting individual designate a physician who had discretion to determine which records should or should not be disclosed. See id. at 271-72. Thus, like SSA’s “special procedure,” the Justice Department’s regulation envisioned certain circumstances in which a l'equesting individual would never obtain his records. The court concluded that such a regulation was not a permissible interpretаtion of § 552a(f)(3). Nothing in § 552a(f)(3), the court observed, suggested that disclosure to a third party satisfied the government’s obligation under the Act: “A regulation that expressly contemplates that the requesting individual may never see certain medical records is simply not a special procedure for disclosure to that person.” Id. at 272.

The Privacy Act clearly directs agencies to devise special procedures for disclosure of medical records in cases in which direct transmission could adversely affect a requesting individual. But, under the plain wording of the statute, these procedures eventually must lead to disclosure of the records to the requesting individual. Like the invalidated regulation in Benavides, § 401.55(b) exacts too much by requiring the designation of a representative who ultimately has complete disсretion to disclose or to withhold the requested information. SSA’s regulations effectively negate Mr. Bavido’s request for direct access and, consequently, do not constitute a “special procedure ... for ... disclosure to [that] individual.” 5 U.S.C. § 552a(f)(3). We conclude, as did the District of Columbia Circuit in Benavides, that such regulations do not comply with the Privacy Act.

Although we hold that SSA’s regulations are unlawful, we must also recognize that, by virtue of the plain language of the statutе authorizing special procedures, a requesting individual is not entitled to “undiluted” direct access to his records. See Benavides, 995 F.2d at 273. As long as an agency assures the ultimate disclosure of the records to the requesting individual, it may impose a special procedure to limit the possible harm that could result from unfettered access to medical and psychological records. SSA is entitled to revise its “special procedures” to conform to the Privacy Act as we have interpreted it here. In the present case, however, we also must recognize that Mr. Bavido has been seeking his medical records for three years. Like our colleagues on the District of Columbia Circuit in Benavides, we do not believe that the plaintiff should have to wait until the agency finishes the time-consuming process of prоmulgating a new rule before receiving his records. See id. Rather, on remand, the district court should allow access to the records under the court’s supervision. See id. In fashioning such a remedy, the district court ought to give great weight to the views of the SSA on how this task can be most effectively accomplished within the framework of the agency’s contemplated approach to new regulations conforming to our decision. See id.

Conclusion

Because we conclude that Mr. Bavido was not required to exhaust his administrative remedies and that 20 C.F.R. § 401.55 is inconsistent with the Privacy Act, we reverse the district court’s judgment dismissing the case and remand for further proceedings consistent with this opinion.

REVERSED and Remanded.

Notes

1

. The statute states in pertinent part:

(g)(1) Civil remedies. — Whenever any agency
(A) makes a determination under subsection (d)(3) of this section not to amend an individual's record in accordance with his request, or fails to makе such review in conformity with that subsection;
(B) refuses to comply with an individual request ‍‌‌​​‌​​‌​​​​​‌‌‌‌‌​​‌‌‌​‌‌‌​‌‌‌​‌​‌‌​‌​‌​‌‌​‌‌​‌‍under subsection (d)(1) of this section;
(C) fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual; or
(D)fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the prоvisions of this subsection.

5 U.S.C. § 552a.

2

. See, e.g., Brown-Bey v. United States, 720 F.2d 467, 469 (7th Cir.1983); accord Petrus v. Bowen, 833 F.2d 581, 583 (5th Cir.1987); Wren v. Harris, 675 F.2d 1144, 1148 n. 8 (10th Cir.1982); Bruce v. United States, 621 F.2d 914, 916 n. 2 (8th Cir.1980); but see Hewitt v. Grabicki, 794 F.2d 1373, 1377 n. 2 (9th Cir.1986) (citing countervailing authority holding that "heads of agencies in their official capacity are proper party defendants in Privacy Act cases [because] such individuals have the final authority in the agency and ultimate responsibility for custody of records”).

3

. In any event, Mr. Bavido’s complaint may be amended to add SSA as a defendant. See Swan v. Clinton, 100 F.3d 973, 980 & n. 3 (D.C.Cir.1996) (amending the complaint to allоw the plaintiff to sue the government officials in their official capacity; not to allow amendment "would elevate form over substance”). See also Fed.R.Civ.P. 21 (stating that new parties "may be ... added by order of the court on ... its own initiative at any stage of the action and on such terms as are just”); Mullaney v. Anderson, 342 U.S. 415, 417, 72 S.Ct. 428, 96 L.Ed. 458 (1952) (noting that “Rule 21 will rarely come into play at this stage of a litigation” but granting the petitioner’s motion to add parties on the ground that ”[t]o dismiss the present petition and require the new plaintiffs to start over in the District Court would entail needless waste”); cf. 28 U.S.C. § 1653 (stating that "[djefective allegations of jurisdiction may be amended, upon terms, in the trial or appellate courts”).

At oral argument SSA conceded that, because the head of the agency was sued in his official capacity, the agency has been on nоtice of the action and fully defended it throughout the litigation; we therefore need not be concerned that the agency might suffer prejudice by being added as a defendant at this point in the proceedings. See Fed.R.Civ.P. 15(c) (stating that an amendment changing a party relates back to the date of the original pleading if the party being added is a federal agency and process was timely sеrved on the United States Attorney (or designee), the Attorney General, or an "agency or officer who would have been a proper defendant if named”); Delgado-Brunet v. Clark, 93 F.3d 339, 344 (7th Cir.1996) (observing that the government notice provision of Rule 15(c) renders "[mistakes in naming parties ... far less likely to have drastic consequences in official rather than individual capacity actions”); Paulk v. Department of Air Force, 830 F.2d 79, 82 (7th Cir.1987) (noting that a plaintiff who served timely process on the U.S. Attorney should have been ‍‌‌​​‌​​‌​​​​​‌‌‌‌‌​​‌‌‌​‌‌‌​‌‌‌​‌​‌‌​‌​‌​‌‌​‌‌​‌‍allowed to amend the complaint under Rule 15(c) to rename the mistakenly-identified federal defendant); accord Reyes v. Supervisor of Drug Enforcement Admin., 834 F.2d 1093, 1097 (1st Cir.1987) (stating that ”[i]t seems clear [in this Privacy Act action] ... that the [U.S. Attorney's Office] was on notice that it was the proper party defendant, in which case the amendment would relate back to the time of the original complaint”); Barvick v. Cisneros, 941 F.Supp. 1015, 1017-18 n. 2 (D.Kan.1996) (holding that, although thе employee improperly named the Secretary of Housing and Urban Development rather than the agency, in a Freedom of Information Act suit, "HUD, the proper party defendant, [ ] had notice of the action and ha[d] participated in its defense[, and thus the employee’s] complaint [would be] deemed amended to name HUD as the proper defendant”). We are mindful, too, of the pro se nature of Mr. Bavido’s com plaint, which must be held to less stringent standards than formal pleadings drafted by attorneys. See Haines v. Kerner, 404 U.S. 519, 520, 92 S.Ct. 594, 30 L.Ed.2d 652 (1972).