GAO: Remove SSN from Medicare Cards

Report Highlights ID Theft Threat
GAO: Remove SSN from Medicare Cards

To protect beneficiaries from identity theft, the Medicare program needs to end the long delay in removing Social Security numbers from member ID cards, a new Government Accountability Office report urges.

See Also: AI in Cybersecurity: The Promise and Reality

The subject of dropping Social Security numbers from Medicare cards isn't exactly new. For at least eight years, the Centers for Medicare and Medicaid Services has been toying with the idea, notes the GAO in its report, CMS Needs an Approach and a Reliable Cost Estimate for Removing Social Security Numbers from Medicare Cards.

The GAO notes that in 2004, CMS, a unit of the Department of Health and Human Services, considered removing Social Security numbers from the cards, but determined it was too cost-prohibitive to do so. The subject resurfaced in 2006 in a CMS report to Congress that estimated removing the numbers would cost $300 million.

Then, in a 2011 report to Congress, CMS proposed three options for removing Social Security numbers from Medicare cards. On option called for truncating the number on the card but having providers and beneficiaries still use the full number. The other two options involved replacing the numbers with new identifiers that would be displayed on the card and used only by the beneficiary, or used by both the beneficiary and Medicare providers.

CMS estimated that each of the options would take four years to implement, including completing necessary IT work and beneficiary and provider outreach. Each option would require additional funding from Congress, and replacing Social Security numbers with an new ID would cost up to $845 million, according to CMS' report to Congress in 2011.

Still, CMS hasn't committed to implementing any of the three options, the GAO notes.

GAO Recommendations

So what did GAO recommend? The office determined that replacing Social Security numbers with a new identifier used by beneficiaries and providers would minimize the burden to all involved. GAO also determined that CMS' methods for calculating its latest cost estimates to replace Social Security numbers with new identifiers were not reliable, and it asked the agency to develop a more accurate, better document cost estimate.

In the meantime, says GAO, "Lack of action on this key initiative leaves Medicare beneficiaries exposed to the possibility of identity theft."

The GAO also advises CMS to explore the use of chips, magnetic stripes or bar codes to improve the efficiency of the cards.

In its comments on the report, the Department of Health and Human Services agrees to work on replacing Social Security numbers with a new identifier on Medicare ID cards. It also agrees to devise a new estimate of the cost of the change and "utilize GAO suggestions to strengthen our estimating methodology."

Although HIPAA, which was enacted in 1996, called for the creation of a universal patient identifier for all Americans, such an identifier has never been created because of a Congressional ban, initiated out of privacy concerns.

About the Author

Marianne Kolbasuk McGee

Marianne Kolbasuk McGee

Executive Editor, HealthcareInfoSecurity, ISMG

McGee is executive editor of Information Security Media Group's media site. She has about 30 years of IT journalism experience, with a focus on healthcare information technology issues for more than 15 years. Before joining ISMG in 2012, she was a reporter at InformationWeek magazine and news site and played a lead role in the launch of InformationWeek's healthcare IT media site.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.