Those Revealing Social Security Cards: Protecting You From Identity Theft
CMS Needs an Approach and a Reliable Cost Estimate for Removing Social Security Numbers from Medicare Cards
*GAO-12-831, Aug 1, 2012
The Centers for Medicare & Medicaid Services’ (CMS) 2011 report to Congress proposed three options for removing Social Security numbers (SSN) from Medicare cards. One option would truncate the SSN displayed on the card, but beneficiaries and providers would continue to rely on the SSN. The other two options would replace the SSN with a new identifier that would be displayed on the card and either be used only by beneficiaries, or by both beneficiaries and those who provide Medicare services. CMS, however, has not selected or committed to implementing any of these options. The Departments of Defense (DOD) and Veterans Affairs (VA), and private insurers have already removed or taken steps to remove SSNs from display on their identification or health insurance cards.
CMS’s option to replace the SSN with a new identifier for use by both beneficiaries and providers offers the greatest protection against identity theft. Beneficiaries’ vulnerability to identity theft would be reduced because the card would no longer display the SSN and providers would not need the SSN to provide services or submit claims (negating the need for providers to store the SSN). This option would also pose fewer burdens than the other two options because beneficiaries would not have to remember an SSN to receive services or to interact with CMS. Providers also would not need to conduct additional activities, such as querying a CMS database, to obtain the SSN. The burdens for CMS would generally be similar across all the options, but CMS reported that this option would require more information technology (IT) system modifications.
CMS reported that each of the three options would cost over $800 million to implement, and that the option to replace the SSN with a new identifier for use by both beneficiaries and providers would be somewhat more expensive, largely because of the IT modifications. However, the methodology and assumptions CMS used to develop its estimates raise questions about their reliability. For example, CMS did not use appropriate guidance, such as GAO’s cost-estimating guidance, when preparing the estimates to ensure their reliability. Additionally, CMS could provide only limited documentation related to how it developed the estimates for the two largest cost areas, both of which involve modifications to IT systems.
Why GAO Did This Study
More than 48 million Medicare cards display the SSN, which increases Medicare beneficiaries’ vulnerability to identity theft. GAO was asked to review the options and associated costs for removing SSNs from the Medicare card. This report (1) describes the various options for removing the SSN from Medicare cards; (2) examines the potential benefits and burdens associated with different options; and (3) examines CMS’s cost estimates for removing SSNs from Medicare cards.
To do this work, GAO reviewed CMS’s report, cost estimates, and relevant supporting documentation. GAO also interviewed officials from CMS and other agencies that perform Medicare related activities (the Social Security Administration and Railroad Retirement Board), as well as officials from DOD and VA, which have undertaken SSN removal efforts. GAO also interviewed private health insurance companies and relevant stakeholder groups.
What GAO Recommends
GAO recommends that CMS (1) select an approach for removing SSNs from Medicare cards that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS and (2) develop an accurate, well-documented cost estimate for such an option. CMS concurred with our recommendations. VA, DOD, and RRB had no substantive comments. SSA had a technical comment.
*The US Government Accountability Office (GAO) is an independent, nonpartisan agency that works for Congress. Often called the "congressional watchdog," GAO investigates how the federal government spends taxpayer dollars. The head of GAO, the Comptroller General of the United States, is appointed to a 15-year term by the President from a slate of candidates Congress proposes.
- Congressional Bills Introduced: Parental Leave, Abortion, Child Soldier Prevention,National Day of Awareness for Missing and Murdered Native Women and Girls
- New Ammunition For An Appeal: Judge Accepts Medicare’s Plan To Remedy Misunderstanding On Therapy Coverage
- Researchers Warn of Financial Risks in Retirement Jobs: Rethink Those SSA Benefit Calculations
- The Seasonal Tsunami of Senior Mail; No Longer a Pandora's Box
- What Do You Know About Capturing End-of-Life Preferences in Electronic Health Records?
- What is the Status of VA Primary Health Care Scheduing? Actions Needed to Improve Access to Primary Care for Newly Enrolled Veterans
- Medicare Delays Plans For New Star Ratings On Hospitals After Congressional Pressure
- Hospices Inappropriately Billed Medicare Over $250 Million for General Inpatient Care
- Medicare Fraud Reports From the Office of Inspector General and Recent State Enforcement Actions
- To Survive, Rural Hospitals Join Forces: What It's Like to Lose a Hospital