CMS Slow to Change ID Numbers, Leaving Medicare Beneficiaries Vulnerable to ID Theft
Published: October 23, 2013
A new GAO report shows that Medicare beneficiaries may be at risk for identity theft due Social Security Numbers (SSN) printed on Medicare cards. An estimated 50 million Medicare insurance cards include printed SSNs.
CMS uses SSNs as the beneficiary’s unique identifying number. Private insurers have abandoned the practice due to privacy concerns. Use of a person’s SSN as a printed ID number, makes them vulnerable to identity theft. CMS has been studying how to correct the problem. GAO was asked to review CMS’s efforts to date.
CMS has identified two possible approaches for removing SSNs, replacing them with new identifiers or masking all but the last four digits of the SSN on cards. CMS has also explored, at a high level, the IT system changes that would be necessary to implement either solution. However, GAO found that CMS has not designated a business owner or established a business case for an information technology (IT) project. According to CMS officials, agency leadership has not directed them to initiate such a project.
“While CMS has spent time and resources over the past seven years studying approaches that could be taken toward removing the SSN from Medicare beneficiaries’ cards, the agency has not actively established and pursued a goal to identify an IT solution for doing so,” GAO said.
GAO proposed that CMS use in-process upgrades to its IT infrastructure as an opportunity to include improvements that would make it easier to remove SSN numbers from cards. Previous assessments of CMS’s IT environment have found that it consists of many aging, “stove-piped” systems that cannot easily share data or be enhanced. In addition, officials say, replacing the cards will likely cost the agency millions of dollars.
Between 2004 and 2011, DoD and VA phased out printed SSNs on almost 18 million cards, and switched to a system of storing the information on bar codes or magnetic strips. DoD and VA are still planning to phase out use of SSNs.
HHS agreed with the goal of removing SSNs from printed cards, but said it needs cooperation from SSA and the Railroad Retirement Board where they have data sharing agreements.
Contractors should watch this issue and look for potential opportunities that might arise for removing SSNs from Medicare cards, as well as CMS system changes that will need to accompany the effort.