Effort Grows to Protect Seniors by Removing Social
Security Number from Medicare Card
Social Security frustrated with refusal to change by
Centers for Medicare & Medicaid Services
June
27, 2008 - Social Security says dont carry your card on you, someone
could get the number and use it to steal your identity. Medicare tells
senior citizen to always carry their Medicare card, even though it has
their Social Security number prominently displayed. Social Security has
been trying to get Medicare to come up with a new card and
identification system and, finally, they are getting some help in this
effort to protect older Americans from identification theft.
USA Today reports that Sen. Chuck Schumer, New York
Democrat, and other members of the Senate Finance Committee are pushing
a bipartisan bill that would require the Medicare administration to
issue new cards that do not contain the numbers.
The Senators are likely to get considerable support
from the Social Security Administration after a report in May by the
agencys inspector general said, While we recognize SSA cannot prohibit
CMS from using SSNs as its primary beneficiary identifier, we believe it
can help reduce the potential threats to SSN integrity by taking a
proactive role in supporting legislation that would mandate the removal
of SSNs from Medicare cards.
By printing Social Security numbers on Medicare
cards, the federal government is leaving seniors and disabled Americans
vulnerable to identity theft, Sen. Chuck Schumer told the newspaper.
Thieves can use Social Security numbers to obtain
credit cards or tap into their victims' bank accounts, notes USA Today.
Medicare officials object to the $500 million cost
of issuing new cards to the more than 40 million people who have them.
They also say there is not enough evidence to prove that thieves are
stealing people's Social Security numbers from the cards, the newspaper
says.
"While we share concerns about identify theft, to
date we have not seen significant evidence that the security of Medicare
cards has been compromised," said Jeff Nelligan, director of media
affairs for the Centers for Medicare and Medicaid Services.
"As a result, we still believe that our limited
administrative dollars are better spent on inspecting hospitals and
nursing homes and ensuring physicians and hospitals have their bills
paid on time," Nelligan said.
But Schumer pointed to a recent warning by the
Social Security Administration about the dangers of using the numbers on
Medicare cards. A report by the Government Accountability Office also
concluded that the cards expose Medicare patients to identity theft.
Social Security Administration officials have requested that
CMS take immediate action to issue beneficiaries new membership
cards that do not include their Social Security numbers to address
concerns regarding identity theft, the
New York Times reports, according to a report June 23 by
KaiserNetwork.org.
Medical identity theft is the fastest-growing form
of identity theft, according to Byron Hollis, director of the antifraud
department at the
Blue Cross and Blue Shield Association.
Most private insurers have removed Social Security
numbers from their membership cards because many states forbid the
inclusion of such information, the Times reports. SSA cannot prohibit
CMS from including Social Security numbers on Medicare cards, but
Congress could, according to the Times.
Clay Johnson, deputy director of the
White House Office of Management and Budget, in a May 2007 memo to
the heads of federal departments and agencies, wrote that CMS should
develop plans to "eliminate the unnecessary collection and use of Social
Security numbers within 18 months."
However, CMS Chief Operating Officer Charlene
Frizzera said issuing new cards would be a "huge undertaking" and would
require three years to plan the change and eight more years to
completely reissue cards. She said that beneficiaries would be alarmed
if the government began issuing new cards or changing individual
identification numbers.
"We don't want to scare them," she said. Medicare
officials estimate that issuing new identification numbers would require
$500 million in computer changes. According to the Times, providers use
the Social Security numbers to file claims with Medicare, which pays one
billion claims annually.
In the report, SSA Inspector General Patrick
O'Carroll said, "Displaying such information on Medicare cards
unnecessarily places millions of individuals at risk for identity
theft." He added, "We do not believe a federal agency should place more
value on convenience than the security of its beneficiaries' personal
information."
According to the Times, other federal agencies have
begun to take steps to remove Social Security numbers from
identification cards, including the
Department of Veterans Affairs, which has begun issuing new cards to
members that "generally" do not include their Social Security numbers
(Pear, New York Times, 6/22).
Report by Inspector General of Social Security
Administration
In May, the Office of the Inspector General, Social
Security Administration, issued a report on the status of corrective
actions the Social Security Administration had taken to address our
recommendation regarding removal of Social Security numbers from
Medicare cards, resulting from our January 2006 report, Hospitals' Use
and Protection of Social Security Numbers.
As background, the report says, Medicare,
authorized by Title XVIII of the Social Security Act, is a health
insurance program for aged individuals and individuals with certain
disabilities or end-stage renal disease. To assist in the administration
of this program, the Centers for Medicare and Medicaid Services (CMS)
issues identification cards to Medicare beneficiaries. These
identification cards display the individual's SSN (Medicare Claim
Number) or the primary wage earner's SSN.
Although no single Federal law regulates overall
use and disclosure of SSNs, the Social Security Act and the Privacy Act
of 1974 contain provisions that govern disclosure and use of SSNs.
Additionally, the Office of Management and Budget (OMB) issued a
memorandum to Federal agencies on safeguarding against, and responding
to, breaches of personally identifiable information, including SSNs.
"Federal agencies are required to reduce the volume
of collected and retained personally identifiable information to the
minimum necessary, including establishment and implementation of plans
to eliminate unnecessary collection and use of SSNs.
Our 2006 audit identified vulnerabilities
associated with displaying SSNs on medical related documents and
identification cards. We recommended that SSA encourage CMS to remove
SSNs from its identification cards and partner with them to develop an
alternative identifier that met both agencies' needs. SSA agreed with
the intent of our recommendation and stated it would work with CMS to
ensure the SSN is protected from unnecessary and/or unauthorized
disclosure.
Following are other highlights from the report:
● Despite the increasing threat of identity
theft, CMS continued to display SSNs on identification cards it issued
to Medicare beneficiaries. Displaying such information on Medicare cards
unnecessarily places millions of individuals at-risk for identity theft.
This is particularly troubling because CMS instructs individuals, many
of whom are elderly, to carry their Medicare card with them when away
from home. We do not believe a Federal agency should place more value
on convenience than the security of its beneficiaries' personal
information.
● In response to growing public and
congressional concern over unnecessary exposure of SSNs, CMS reviewed
its practice of displaying SSNs on Medicare cards and provided Congress
a report containing initial cost estimates and a potential approach for
transitioning to a non-SSN Medicare identifier. CMS officials told us
they had not received a response from Congress, and the Agency had no
position regarding the removal of SSNs from Medicare cards.
●
Based on our previous audit and
investigative findings, we know the unnecessary display of SSNs
increases the potential for dishonest individuals to obtain and misuse
them, creating SSN integrity issues.
● In its 2006 report, CMS outlined the timeframe
and cost of transitioning to a non-SSN based Medicare identifier.
Specifically, CMS estimated that moving to a non-SSN based beneficiary
identifier would be an 8- to 13 year project that included a fixed
3-year preparation period. The estimated timeframe for changing all
beneficiary identifiers would be no sooner than 5 years and no longer
than 10 years. Total costs for implementing the change in 5 years after
the preparation period was estimated to be over $300 million. CMS
developed the report based on the assumption that it would be
responsible for generating and assigning a new identifier that would
only be used for Medicare business. If funded, CMS would assign each
beneficiary a new, unique Medicare beneficiary identifier over time. As
of September 2007, CMS had not received a response from Congress.
Report looks at potential risks
● CMS' display of SSNs on Medicare cards entails
certain risks. Although there are no data on the extent to which
Medicare cards contribute to identity theft, each time an individual
divulges his or her SSN, the potential for someone to illegally gain
access to personal information increases. For example, many individuals
carry their Medicare cards in their wallets or purses and could become
victims of identity theft should dishonest individuals steal such items
or lift their Medicare number from a beneficiary card or medical
document. In fact, instructions on the back of Medicare cards direct
individuals to carry the card with them when they are away from home.
● This practice, according to the consumer
advocacy organization, Consumers Union, "is putting senior citizens at
risk for identity theft." Consumers Union further stated "there is no
excuse for leaving Medicare beneficiaries vulnerable to identity theft
with a thinly disguised Social Security number on their membership
card." Consumers Union relayed its concerns to CMS, pointing out that
many commercial insurance companies had taken steps to remove SSNs from
identity cards and recommended that CMS take similar steps to safeguard
the identities of Medicare recipients. CMS informed Consumers Union that
it had considered removing SSNs from Medicare cards but had no definite
plans for doing so. In contrast, SSA recommends that individuals keep
their Social Security card in a safe place and not carry it with them
unless it is needed to show an employer or service provider.
● In addition, the Government Accountability
Office (GAO) has reported on the vulnerabilities associated with the
display of SSNs on identity and eligibility cards issued under
Government auspices. Specifically, GAO stated that cardholders are often
required to use their card at the point of service, which means a
practical need to carry and display it often, thus increasing the
likelihood for accidental loss, theft, or visual exposure. GAO concluded
that continued display of SSNs on identification cards presented a risk
of identity theft.
Conclusion and Recommendations
● Despite the potential risks associated with
displaying SSNs on Medicare cards, CMS continues this practice. While we
recognize SSA cannot prohibit CMS from using SSNs as its primary
beneficiary identifier, we believe it can help reduce the potential
threats to SSN integrity by taking a proactive role in supporting
legislation that would mandate the removal of SSNs from Medicare cards.
We recognize that such legislation could be inconvenient for both
agencies and may result in additional costs. However, given the
potential threats to SSN integrity, such a challenge should not
discourage SSA from taking additional steps to safeguard SSNs.
Accordingly, we recommend that SSA:
1. Proactively work with OMB and Congress to
expedite the removal of SSNs from Medicare cards in a manner that
ensures compliance with Federal guidelines and consistency with
approaches taken by other Federal agencies.
2. Continue to partner with CMS to develop an
alternative Medicare identifier that meets both agencies' needs.
More Information:
>>
Read more at USA Today
>> Parts of
this report are from the Kaiser Daily Health Policy Report
Click here
>> Link to
report by Office of the Inspector General of Social Security
Administration, Removing Social Security Numbers from Medicare Cards,
May 2008
Click here.
