New Law to Strip Social Security Numbers From Medicare Cards – Original article published by Robert Pear of the New York Times on April 20, 2015
WASHINGTON — Concerned about the rising prevalence and sophistication of identity theft, most private health insurance companies have abandoned the use of Social Security numbers to identify individuals. The federal government even forbids private insurers to use the numbers on insurance cards when they provide medical or drug benefits under contract with Medicare.
But Medicare itself has continued the practice, imprinting Social Security numbers on more than 50 million benefit cards despite years of warnings from government watchdogs that it placed millions of people at risk for financial losses from identity theft.
That is about to change, after President Obama signed a bill last week that will end the use of those numbers on Medicare cards.
“The Social Security number is the key to identity theft, and thieves are having a field day with seniors’ Medicare cards,” said Representative Sam Johnson, Republican of Texas, who pushed for the change with Representative Lloyd Doggett, a Texas Democrat.
The main purpose of the law, adopted with broad bipartisan support, was to overhaul the way doctors are paid for treating Medicare patients. But it makes other changes as well. One section that received little attention says Social Security account numbers must not be “displayed, coded or embedded on the Medicare card.”
Congress provided $320 million over four years to pay for the change. The money will come from Medicare trust funds that are financed with payroll and other taxes and with beneficiary premiums.
In his budget for 2016, Mr. Obama requested $50 million as a down payment “to support the removal of Social Security numbers from Medicare cards” — a step that federal auditors and investigators had been recommending for more than a decade.
More than 4,500 people a day sign up for Medicare. In the coming decade, 18 million more people are expected to qualify, bringing Medicare enrollment to 74 million people by 2025.
New beneficiaries are often surprised, even shocked, to find that their Medicare cards carry their Social Security numbers. Medicare uses them as the primary means of identifying beneficiaries, placing the numbers on benefit cards along with one or two letters or digits that indicate the basis of a person’s eligibility.
In moving to halt the practice, Congress was motivated by the proliferation of electronic health records and a rash of recent cyberattacks, including a data breach at Anthem, one of the nation’s largest insurers.
Medicare officials have up to four years to start issuing cards with new identifiers. They have four more years to reissue cards held by current beneficiaries. They intend to replace the Social Security number with “a randomly generated Medicare beneficiary identifier,” but the details are still being worked out.
Paula L. Ercolini, a 70-year-old Medicare beneficiary in Sharpsburg, Ga., outside Atlanta, said she wished that her Medicare card did not include her Social Security number.
“The Social Security number has the potential to open up your files, your life to hackers and thieves,” she said. “But you almost have to provide it when you go to new doctors. They won’t see you if you don’t.”
The card itself tells beneficiaries: “Carry your card with you when you are away from home. Let your hospital or doctor see your card when you require hospital, medical or health services under Medicare.”
Ann H. Rossie, 81, of Seattle, said she worried that having Social Security numbers on Medicare cards “makes us all vulnerable if our wallet is stolen.”
“Changing to another number will be a humongous job,” said Ms. Rossie, a former Social Security claims representative. “But Medicare needs to recognize the terrible impact on anybody whose identity is stolen. It destroys your self-esteem, and it can take years to re-establish your identity and credit.”
Members of Congress said the use of Social Security numbers on Medicare cards provided a case study of bureaucratic inertia.
Since 2004, the Government Accountability Office, an investigative arm of Congress, has repeatedly urged officials to curtail the use of Social Security numbers as identifiers. In 2007, the White House Office of Management and Budget told agencies to “eliminate the unnecessary collection and use of Social Security numbers” within two years.
In 2008, the inspector general of Social Security called for immediate action to remove the numbers from Medicare cards, saying their display “unnecessarily places millions of individuals at risk for identity theft.” In that same year, the Defense Department and the Department of Veterans Affairs began carrying out elaborate plans to remove Social Security numbers from their identification cards.
But the Department of Health and Human Services, which supervises the agency that administers Medicare, has “lagged behind other federal agencies,” the Government Accountability Office said.
Senator Susan Collins, Republican of Maine and chairwoman of the Senate Special Committee on Aging, said she was puzzled by the delays. “This still does not appear to be a priority” for Medicare administrators, she said.
Medicare officials said their top information technology specialists had been preoccupied with efforts to build and repair HealthCare.gov, the online system for buying health insurance under the Affordable Care Act, which was overcome by technical problems soon after it began operating 18 months ago.
An internal agency report cites concerns about “the budgetary and logistical challenges of removing Social Security numbers from Medicare cards.” The Medicare agency depends on more than 200 computer systems and pays more than a billion claims a year from 1.5 million health care providers.
AARP, the lobby for older Americans, and another consumer group, the National Committee to Preserve Social Security and Medicare, said they supported the new prohibition.
“Older adults are targeted by fraud artists, who use their Social Security numbers to get loans and credit cards,” said Amy E. Nofziger, manager of the fraud prevention program at AARP.
In one case described by Stephen R. Wigginton, the United States attorney for the Southern District of Illinois, a hospital employee and a former employee were convicted of stealing personal information from the charts of older patients and then using the data to apply for credit cards in the victims’ names.
The former employee was caught on camera at a store using a credit card obtained with the personal information of a 90-year-old woman who had been admitted to the hospital from an assisted living center.
