GAO Recommends Removal of Social Security Numbers from Medicare Cards

On August 1, 2012, the House Ways and Means Committee held a hearing to discuss the removal of Social Security numbers (SSNs) from Medicare cards to avoid putting beneficiaries at risk of identity theft. Various options for SSN removal were considered along with their costs and impact. The Centers for Medicare and Medicaid Services (CMS) also faced scrutiny for its failure to implement a plan to remove SSNs while other private and public agencies have already done so. Testimony was offered by Tony Trenkle, CMS Director of the Office of Information Services and Chief Information Officer and Kathleen King, the Government Accountability Office (GAO) Director of Health Care.

Three CMS Proposals

Trenkle presented CMS’s three proposed options for SSN removal, all of which, he emphasized, would be complex, risky and expensive undertakings. The first and most costly option would completely eliminate the inclusion of SSNs as Health Insurance Claim Numbers (HICNs) on the beneficiary cards, which are used for checking eligibility and billing Medicare, and replacing them with new Medicare Beneficiary Identifiers (MBIs). CMS would then process transactions by using a translation utility to convert the MBI into the HICN. If the MBI was compromised, CMS could immediately terminate and replace the MBI by issuing a new card.

The second option would also replace the HICN on the card with an MBI, but the provider would query the CMS systems to obtain the corresponding HICN to use for its transactions with CMS. CMS would use only the MBI in its correspondence with beneficiaries. The third option would modify the HICN by issuing new cards that only showed the last four digits of the beneficiary’s SSN. Providers could then utilize existing resources to check verification and eligibility and still use the HICN for all transactions with CMS. The estimated cost of implementation, including systems modifications, development and beneficiary outreach, was $812 to $845 million, depending on the option chosen.

GAO Criticism

King based her remarks on the simultaneous release of a GAO report that examined each proposal and its potential costs, burdens and benefits. While the GAO favored the complete replacement of the SSN with an MBI, it questioned both the methodologies employed by CMS in forming its cost estimates and the failure of CMS to act on this matter earlier. GAO recommended that CMS commit to one of the options and use customary procedures to re-develop an “accurate, well-documented cost estimate.”