April 22, 2015
Government (Finally) Takes a Concrete Step to Fight Identity Theft: Medicare Cards No Longer to Include Social Security Numbers
President Obama recently signed a bill to stop the printing of Social Security numbers on Medicare cards. The bill, entitled the Medicare Access and CHIP Reauthorization Act of 2015, is focused on overhauling the way that doctors are paid for treating Medicare patients. However, it also includes a provision mandating that Social Security account numbers must not be “displayed, coded or embedded on the Medicare card.” Importantly, the bill provides $320 million over four years to pay for this change.
Private insurers long ago abandoned the use of social security numbers to identify individuals based on fears of identify theft and fraud. In fact, the federal government forbids private insurers who provide medical or drug benefits under contract with Medicare from putting Social Security numbers on insurance cards. Medicare itself, however, has not yet discontinued the practice.
Passage of the bill illustrates how a problem can have a seemingly simple fix (like removing a number from a card), yet nevertheless require a mammoth effort over countless years.
Staggering Potential for Identify Theft and Fraud
Medicare currently uses social security numbers as the primary means of identifying beneficiaries, and the numbers are placed on the front of each card it issues. And that is a lot of cards. Medicare currently covers approximately 50 million people. An additional 4,500 people reportedly sign up for Medicare each day. It is expected that 18 million additional people are will qualify for Medicare in the next decade, bringing Medicare enrollment to 74 million people by 2025.
Government’s Slow Response to Calls for Change
Consumer advocates and government officials had long argued for the change. In 2004, the Government Accountability Office began urging officials to curtail the use of Social Security numbers as identifiers. In 2007, the White House’s Office of Management and Budget called for federal agencies to stop collecting and using Social Security numbers within two years. A year later, the inspector general of the Social Security program called for an immediate remove of the numbers from Medicare cards based on the risk of identify theft. Nevertheless, the Department of Health and Human Services (which supervises the agency that administers Medicare) did not respond to calls for change.
Congress finally acted in response to the rash of recent cyberattacks, including the data breach at health insurer Anthem, and the proliferation of electronic health records.
Changing Cards Will Be Neither Simple Nor Quick
The switch to cards without the Social Security numbers might sound like a simple fix, but the budgetary and logistical challenges are enormous. The agency that administers Medicare depends on 200 computer systems and pays over a billion claims every year from 1.5 million health care providers. Accordingly, the bill gives Medicare officials up to four years to start issuing cards with new identifiers, and four more years to reissue cards that current beneficiaries hold.
Exact details of how Medicare beneficiaries should be identified are yet to be worked out. In addition, some worry that even the $320 million provided in the bill will not be enough to complete the switch.