Medicare Information Technology: Centers for Medicare and Medicaid Services Needs to Pursue a Solution for Removing Social Security Numbers from Cards
Published: 2013-09-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The health insurance claims number on Medicare beneficiaries' cards includes as one component the beneficiary's (or other eligible person's, such as a spouse's) SSN. This introduces risks to beneficiaries' personal information, as the number may be obtained and used to commit identity theft. Many organizations have replaced SSNs on these types of cards with alternative identifiers. However, the introduction of such a new data element into IT environments can require changes to systems that process and share data. Moreover, previous assessments of CMS's IT environment have found that it consists of many aging, "stove-piped" systems that cannot easily share data or be enhanced; thus the agency has ongoing efforts to modernize its environment.
As requested, GAO studied CMS's efforts related to the removal of SSNs from Medicare cards. GAO's objectives were to (1) assess actions CMS has taken to identify and implement IT solutions for removing SSNs from Medicare cards and (2) determine whether CMS's ongoing IT modernization initiatives could facilitate SSN removal efforts. To do this, GAO reviewed agency documentation and interviewed officials.
section_title: What GAO Found
paragraphs: The Centers for Medicare and Medicaid Services (CMS)--which is the agency within the Department of Health and Human Services (HHS) responsible for administering Medicare--has not taken needed steps, such as designating a business owner and establishing a business case for an information technology (IT) project, that would result in selecting and implementing a technical solution for removing Social Security numbers (SSN) from Medicare cards. However, the agency has collected information and data as part of its most recent study of SSN removal that could contribute to the identification and development of an IT solution. These include information relevant to examining alternative approaches, identifying costs and risks, and assessing the impact of different approaches on the agency's existing IT systems. For example, the agency identified two approaches for removing the SSN: (1) replacing it with a new identifier, referred to as the Medicare Beneficiary Identifier, and (2) masking the first five digits of the SSN for display on Medicare cards. CMS system and business owners also conducted high-level assessments of the types of changes that would need to be made to systems identified in the agency's IT inventory. For example, system owners estimated the level of complexity of the changes, the number of hours of work at each life-cycle phase, business and technical risks, and the potential to leverage related efforts. CMS noted in its most recent study that replacing the SSN with a new identifier could reduce the risk of identity theft from a lost or stolen card, and actions taken thus far could inform a future IT project to address SSN removal. However, according to CMS officials, agency leadership has not directed them to initiate such a project. Until such a project is undertaken, the agency will not be positioned to identify or implement a solution to support the removal of SSNs from beneficiaries' cards.
CMS has efforts under way to modernize its IT systems, some of which could be leveraged to facilitate the removal of SSNs from Medicare cards. Specifically, one of CMS's high-level modernization goals is to establish an architecture to support "shared services"--IT functions that can be used by multiple organizations and facilitate data sharing. According to agency officials, a service established to automate and manage certain aspects of CMS programs could be used to support a "crosswalk" function that would translate the existing claims number to the new beneficiary identifier (and vice versa). This would enable internal systems to receive information containing the new identifier and continue to process data based on the existing number. Another project was intended to consolidate eligibility determination services from four systems, which could reduce the extent of modifications that would have to be made to each of the systems. However, because the agency has not initiated a project for removing SSNs from identification cards, officials have not considered including shared services or other IT initiatives in their modernization activities and related plans to specifically support changes needed as a result of SSN removal. As a result, CMS may miss opportunities to incorporate such a project into ongoing agencywide modernization initiatives that could facilitate efforts to design, develop, and implement an IT solution for SSN removal in a timely and cost-effective manner.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS initiate an IT project to develop a solution for SSN removal and incorporate such a project into plans for ongoing IT modernization initiatives. HHS agreed with GAO's recommendations, if certain constraints were addressed. However, GAO maintains that its recommendations are warranted as originally stated.

section_title: Letter
paragraphs: As one of the federal government’s largest programs, Medicare provides  health insurance to the nation’s elderly, certain disabled individuals, and  individuals with end-stage renal disease. The program, which served  approximately 50 million beneficiaries in 2012, consists of four parts: A, B,  C, and D. Parts A and B are referred to as fee-for-service programs, and  respectively, provide health insurance coverage for (1) hospital and  inpatient stays, hospice, and home health services; and (2) hospital  outpatient, physician, and other services such as home health care, and  durable medical equipment such as wheelchairs and walkers.
CMS’s contractors that process fee-for-service claims are referred to a Medicare  Administration Contractors. reimbursed by Medicare for services and supplies that they deliver to  beneficiaries in accordance with Parts A and B rules.
For their part, Medicare beneficiaries show proof of eligibility for coverage  under Parts A and B by presenting printed insurance cards to their  providers at the point of care. The approximately 50 million cards that  have been issued and are currently in use display Social Security  numbers (SSN) as a component of beneficiaries’ claims identification  numbers. However, the visual display of the SSN introduces risks to the  security of beneficiaries’ personal information, as the number may,  among other things, be obtained and used by criminals to conduct identity  theft.
CMS depends on more than 200 information technology (IT) systems to  support administration of the Medicare program, including determination  of eligibility for benefits, processing and payment of claims, and exchange  of Medicare-related data with external stakeholders. Many of these  systems were developed decades ago and are difficult to modify or  update to incorporate changes in business rules or data, or to integrate  with other systems. In 2010 the agency assessed its IT environment in  response to direction from the Patient Protection and Affordable Care  Actmodernization initiative.   and began to take steps toward planning an agencywide IT  At your request, we conducted a study of CMS’s efforts related to the  removal of SSNs from Medicare cards. Our specific objectives were to (1)  assess the actions CMS has been taking to identify and implement IT  solutions for removing SSNs from Medicare beneficiaries’ cards, and (2)  determine whether CMS’s ongoing IT modernization initiatives could offer  opportunities to facilitate efforts to remove the SSN from the cards.
To address the first objective, we examined documentation that described  studies the agency conducted in 2006, 2011, and 2013 of different  approaches toward removing SSNs from Medicare cards. Specifically, we  focused our work on results of the most recent study and assessed  relevant technical documents, such as those which identify system  components that would be affected by the removal of the SSN from  cards, and other documents that describe the data and message format  requirements for exchanging data between systems. We compared  activities identified in these documents to department-level requirements  for identifying, developing, and implementing technical solutions for  business processes. We also assessed a sample of the systems that  CMS identified as ones that would be affected by the removal of the SSN  from cards. We based our selection on the level of effort CMS estimated  would be needed to implement modifications and the functionality  provided by the systems. Specifically, we identified 29 systems that we  determined accounted for over 90 percent of the total estimated level of  effort and selected 3 for our assessment—1 with a low estimate, 1 with a  high estimate, and 1 that provided critical functionality within the claims  processing IT environment. We examined technical documents for these  3 systems, such as those that describe architectural characteristics, data  formats, and exchanges with other systems. To further address the  objective, we examined data collected by CMS from the federal  stakeholders with whom it exchanges data related to Medicare  beneficiaries—the Social Security Administration (SSA) and the Railroad  Retirement Board. We also held discussions with Medicaid program  officials from eight states to obtain their perspectives on roles they played  in CMS’s SSN removal study. We selected these states based on the  level of effort they estimated would be needed to make changes to their  systems to address SSN removal. The information we obtained from  them is not generalizable to all Medicaid programs but provides insight  into the extent to which CMS involved program stakeholders in  conducting its 2013 study.
To address the second objective, we identified criteria by examining  federal laws and guidance for leveraging IT modernization initiatives to  guide systems development, and assessed plans and briefings  describing CMS’s initiatives to modernize its IT environment. To  determine the extent to which the goals and objectives of these initiatives  could be leveraged to facilitate the SSN removal effort, we compared  descriptions of specific modernization projects to information obtained  from agency technical documents describing the systems that would have  to be modified if the SSN were to be removed from cards. In making  these comparisons, we identified common characteristics and efforts that  could be coordinated to achieve efficiencies in implementing system  changes.
To supplement our assessment of documentation and data relevant to  both objectives, we held discussions with CMS officials from the agency’s  Office of Information Services, including the Chief Information Officer  (CIO), regarding actions taken to collect and analyze information needed  to complete the 2013 study. We also discussed with these officials the  steps they took to involve stakeholders in identifying approaches for  removing the SSN from cards and assessing the potential impact on IT  systems. Finally, we obtained descriptive information from the agency’s  CIO and other Office of Information Services officials regarding plans and  ongoing initiatives intended to lead to the modernization of CMS’s IT  environment. A more detailed description of our objectives, scope, and  methodology is provided in appendix I.
We conducted this performance audit from October 2012 to September  2013 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The use of SSNs on identification cards by federal, state, and private  organizations, such as health insurance companies, was prevalent until  the early 2000s. However, many organizations have since replaced these  types of identification cards with those that do not contain SSNs. This  step was taken, in large part, in response to certain federal and state laws  that place restrictions on entities’ use and disclosure of consumers’  personal information, including SSNs. Examples of federal laws include  the Driver’s Privacy Protection Act, which generally prohibits a state  department of motor vehicles from disclosing or otherwise making  available SSNs and other personal information from a motor vehicle  record, and the Health Insurance Portability and Accountability Act  (HIPAA) and its implementing regulations, which protect the privacy of  health information that identifies an individual (including by SSNs) and  restricts health care organizations from disclosing such information to  others without the patient’s consent. Additionally, several state statutes  include provisions related to restricting the display of SSNs, their  unnecessary collection, and their disclosure without the individual’s  consent. Many state agencies have discontinued the use of the numbers  on identification cards and other documents, such as driver’s licenses, to  comply with such laws. Similarly, private sector health insurers have  discontinued use of SSNs on insurance cards in an effort to protect  beneficiaries’ personal health information.
The numbers on the VA cards are identification numbers that allow beneficiaries to  access facilities; the cards are not insurance cards. DOD’s cards are also used primarily  for identification purposes, and are not insurance cards. the numbers in magnetic stripes on the cards. However, both DOD and  VA continued to use the number as an identifier and have described other  steps they are taking to better protect beneficiaries against theft or  improper use of the numbers. Specifically, DOD officials stated that the  department is in the process of developing and implementing a solution  for removing embedded SSNs from the bar codes on military identification  cards and replacing them with a new identifier; they plan to complete this  project in late 2016. Additionally, VA is working to remove the number  embedded in magnetic stripes because of increased security risks  introduced by the prevalence of electronic readers on devices such as  smart phones; it plans to complete this project in late 2016.
subsections: section_title: Use of SSN-Based Health Insurance Claim Number by CMS and Its Stakeholders
paragraphs: Since the inception of Medicare in 1965, CMS and its program  stakeholders—SSA, the Railroad Retirement Board, and state Medicaid  programs—have used an SSN-based identifier when filing and  processing fee-for-service claims, and when exchanging data related to  the Medicare program. This number, referred to as the Health Insurance  Claim Number (HICN), is displayed on Medicare beneficiaries’ health  insurance cards.
Individuals’ eligibility to participate in the Medicare fee-for-service  programs is initially determined by SSA, based on factors such as age,  work history, contributions made to the programs through payroll  deductions, and the presence of certain medical conditions. Once SSA  determines that an individual is eligible, it provides information about the  individual to CMS, including the SSN and a 1- or 2-digit beneficiary  identification code.Enrollment Database—the repository of data about individuals who are or  have ever been on Medicare. This system combines these two data fields  to create the 10- or 11-digit HICN. CMS prints and issues to the individual   These data are transmitted to and stored in CMS’s  a paper identification card (similar to the example shown in fig. 1) that  displays the HICN (i.e., the Medicare claim number), the cardholder’s full  name, his or her gender, and the effective dates of Medicare program  eligibility.
The HICN is maintained and referenced throughout CMS’s IT  environment. For example, health care providers may reference Medicare  beneficiaries’ printed cards at the point of care to determine eligibility for  the fee-for-service program. Providers may then query a CMS system  using the HICN printed on the card, along with other demographic data, to  obtain information regarding eligibility for specific treatments or services  they intend to deliver, such as glaucoma screening or smoking cessation  counseling. Specifically, the agency provides verification services through  its HIPAA Eligibility Transaction System (HETS), which allows providers  to access real-time data regarding beneficiaries’ eligibility at the point at  which care is scheduled or delivered. Likewise, providers are required by  CMS to use the number when they submit claims to receive payment for  those treatments and services.
CMS’s and its contractors’ systems also process data based on the HICN  to check for duplicate claims, apply claims and medical policy edits, issue  Medicare Summary Notices, authorize or deny payment of claims, and  conduct printing and mailing operations. For example, CMS’s Medicare  Administrative Contractors, who are responsible for processing and  paying claims, use their own systems to determine whether fee-for- service claims meet certain requirements, such as completeness of data.  Specifically, if a claim did not include the HICN or other required data, the  contractor’s system would return it to the provider as incomplete or  invalid.
The shared systems are the Fiscal Intermediary Shared System, which processes part A  claims; the Multi-carrier system, which processes part B claims; and the ViPS Medicare  System, which is used to process claims for durable medical equipment. including HETS, on a daily basis. These data are used to update those  systems’ databases.
In addition to using the HICN to support the provision of and payment for  health care to Medicare beneficiaries, CMS and its federal stakeholders,  SSA and the Railroad Retirement Board, use the number to share data  needed to coordinate health insurance coverage and payments for  premiums. In this regard, CMS provides information that includes the  number to SSA when beneficiaries’ eligibility status or other data change,  and SSA refers to the HICN when beneficiaries request replacement of  lost Medicare cards. CMS also shares data that include the number with  the Railroad Retirement Board when it administers health benefits for  railroad retirees who are eligible for Medicare.
Further, CMS and the 56 state and territorial Medicaid programs share  data based on beneficiaries’ HICNs. Specifically, these programs provide  the number along with other data on their beneficiaries that are used to  help identify individuals who are eligible for both Medicare and Medicaid  benefits. The states also provide information regarding Medicaid  beneficiaries for whom their programs pay Medicare Part A or B  premiums. In turn, CMS provides several types of data to the Medicaid  programs based on the HICN, including data needed to coordinate  payment for claims when a beneficiary is covered by multiple insurers and  information on the current drug prescription insurer for beneficiaries who  are covered by Medicare Part D private plans. Figure 2 depicts a  simplified view of the flow of data and the use of the HICN in CMS’s and  its stakeholders’ systems.
In 2010, CMS officials developed a plan to upgrade the agency’s IT  environment and noted that the modernization of enterprise information  systems and the supporting infrastructure was necessary in order for  CMS to continue to meet its mission. Further, two scientific advisory  committees that later evaluated CMS’s IT environmentagency operated in a “stove-piped” environment in which many systems  were developed to meet specific time-sensitive and legislatively driven  needs, such as claims processing and eligibility determination, without  consideration of the need for systems to interoperate or integrate data  from other sources. The committees indicated that, because the agency  continues to operate in such an environment, enhancement and sharing  of data across its systems can be costly, risky, and time-consuming.
In 2013 the agency took steps to update the 2010 IT modernization plan.  According to officials in the Office of Information Services, this was to  address recommendations resulting from the two advisory committees’  evaluations. These officials described seven goals of the plan, the first of  which is to establish an architecture that supports the development and  implementation of IT functions, known as “shared services,” that can be  provided to support multiple needs of organizations conducting business  within or between federal agencies. limited to, the transformation of the agency’s IT operations to enable CMS  to use technologies such as cloud computing and virtual data centers;  improvements to privacy and security controls to better protect personal  health information stored and processed by the agency; and the transition  to a coordinated, enterprise approach toward developing and  implementing IT solutions. The Chief Information Officer stated that the  agency was continuing to work toward addressing the seven goals  defined in 2013.
Use of shared services can be cost efficient because when a service is reused by  multiple IT systems, initial system development costs occur once, and these costs can be  avoided each time the service is reused. In addition, use of shared services promotes  standardization and interoperation of data and can reduce stove piping.
section_title: Prior Reports on CMS’s and Other Agencies’ Use and Display of SSNs
paragraphs: Both the SSA and HHS inspectors general have reported on risks  associated with the use of the SSN on Medicare cards and have  recommended that SSA and CMS work toward identifying alternate  identifiers to better safeguard Medicare beneficiaries’ SSNs.  Additionally, we have previously issued reports that addressed federal  agencies’ use and display of SSNs on identification cards and for other  purposes, as well as CMS’s study of this issue.
In a 2004 study, we found that SSNs were widely exposed to view in a  variety of public records, particularly those held by state and local  governments, and appeared in some public records nearly everywhere in  the nation. in identity thefts, and that the widespread use and retention of the number  by both the public and private sectors may provide opportunities for  criminals to easily obtain and misuse this personal information. We  stressed that the display of nine-digit SSNs on such cards, which may  need to be carried and must often be disclosed, puts cardholders at risk  for identity theft due to the increased potential for accidental loss, theft, or  visual exposure. To help mitigate this risk, we recommended that the  Office of Management and Budget (OMB) identify those federal activities  that require or engage in the display of SSNs on health insurance,  identification, or any other cards issued to federal government personnel  or program beneficiaries, and devise a governmentwide policy to ensure  a consistent approach to this type of display. In response to our  recommendation, in May 2007 OMB issued a memorandum that required  federal departments to establish a plan to eliminate unnecessary use of  SSNs.
GAO, Social Security Numbers: Governments Could Do More to Reduce Display in  Public Records and on Identity Cards, GAO-05-59 (Washington, D.C.: Nov. 9, 2004).
SSNs shared with contractors by private companies. We also reported in  2006 that the threat of identity theft was heightened by the visual display  of SSNs on federal identification cards. We noted that there were gaps  in federal and state agencies’ practices for protecting SSNs and that  Congress was still considering actions to address the issues that remain.
More recently, in 2012 we assessed the results of CMS’s 2011 study of  the cost and effort associated with three approaches to removing SSNs  from Medicare cards. As a result of our assessment, we reported in  August 2012 that CMS had not committed to removing the SSNs and  lagged behind other federal agencies. We recommended that the agency  select an approach for removing the SSN from the Medicare card that  best protects beneficiaries from identity theft and minimizes burdens for  providers, beneficiaries, and CMS. We also recommended that it develop  an accurate, well-documented cost estimate for such an option using  standard cost-estimating procedures. CMS officials concurred with our  recommendations and, as discussed later in this report, took actions to  address them.
section_title: CMS Has Not Actively Pursued an IT Solution but Has Taken Actions That Could Support Efforts to Do So
paragraphs: CMS has not yet taken steps needed to select and implement a technical  solution for removing SSNs from Medicare cards. Since 2006, the agency  has conducted three studies on potential approaches to replacing the  SSN-based Medicare identifier, issuing reports to Congress on the results  of those studies in October 2006, November 2011, and May 2013.  However, while each of the studies addressed, at a high level, the impact  of various approaches on CMS’s IT environment, they were not intended  to identify a specific technical solution for removing SSNs from cards.
Specifically, according to CMS, a 2006 study was initiated in response to  congressional concerns regarding identity theft and expectations that the  Secretary of Health and Human Services would accelerate ongoing plans  to convert the HICN to a non-SSN based identifier for display on  Medicare beneficiaries’ health insurance cards. The second study was  conducted to respond to congressional requests for CMS to re-examine  approaches and costs of removing the SSN from the cards. Officials in  the Office of Information Services, the CMS entity that would be  responsible for identifying and implementing a technical solution for SSN  removal, stated that the 2006 and 2011 studies were intended to develop  “rough order of magnitude” estimates of costs and efforts associated with  a potential SSN removal project.
In response to a request by congressional committee members and to  address our August 2012 recommendation, the agency initiated a third  study in August 2012 and issued the resulting report to Congress in May  2013. According to CMS officials, the third study was conducted to  provide cost estimates that were more reliable than those previously  reported. The new estimates for two approaches documented in the 2013  report were approximately $255 million and approximately $317 million,  including the cost of efforts to develop, test, and implement modifications  that would have to be made to the agency’s IT systems. The costs of the  IT-related efforts for the two approaches were estimated at about $26  million (10 percent of the $255 million total estimated cost) and $64  million (20 percent of the $317 million total estimated cost), respectively.According to the May 2013 report, the estimates were based on the  assumption that these efforts would span an 18-month period, from  October 2013 to April 2015. According to Office of Information Services  officials, however, these costs and schedules represented high-level  estimates based on the two overall approaches and did not fully reflect  the effort that would be required to implement a specific IT solution.  Furthermore, while the 2013 report noted that one of the two approaches  would better protect beneficiaries’ personal information, the officials said  that the agency did not intend for this study to result in the identification of  an IT solution to address SSN removal.
CMS officials stated that any initiatives specifically intended to identify an  IT solution to address SSN removal would need to be conducted in  accordance with departmental processes and requirements for managing  the life cycle of IT projects. In this regard, CMS’s IT project life-cycle  management guidance, the Expedited Life Cycle (XLC) framework,  defines the activities that are required to execute and monitor the  development of IT projects throughout five phases—project initiation,  requirements analysis and design, development and test, implementation,  and operations and maintenance. The framework requires the following  activities to be completed as part of a project initiation phase before the IT  organization takes subsequent steps to identify technical solutions that  support business needs: designate a business owner to serve as an advocate for the project; identify a business need for which a technological solution is required  and a business case is established; explore alternative concepts and methods to satisfy the need; develop and approve initial project cost, preliminary schedule,  performance baseline, and basic business and technical risks;  conduct a preliminary enterprise architecture review to determine  whether the proposed project potentially duplicates, interferes with,  contradicts, or can leverage another project that already exists or is  proposed, under development, or planned for near-term disposition;  identify significant assumptions and constraints on solutions relative to  that need;  issue a project charter; and  conduct a selection review to determine if the proposed project is  sound, viable, and worthy of funding, support, and inclusion in the  information technology project portfolio.
However, CMS has not taken a number of the key steps called for by the  IT project life-cycle management guidance to identify an IT solution to  address SSN removal and has not made plans to do so. For example, it  has not completed several steps of a project initiation phase, such as  designating a business owner who would submit a request to the Chief  Information Officer to initiate an IT project. Additionally, the agency has  not established a business case for developing an IT solution to address  SSN removal, issued a project charter, or presented a potential IT project  for SSN removal to an architectural review board for preliminary review  and approval. Furthermore, CMS has not conducted a selection review to  determine if such an IT project should be included in its portfolio of IT  investments.
Nonetheless, when conducting the 2013 study, agency officials undertook  activities that could address certain steps called for by the agency’s IT  project life-cycle management processes for initiating a project, and that  could provide information needed for identifying and implementing a  technical solution, including the following:
CMS officials and program stakeholders explored alternative concepts  for addressing the business need, which is one of the steps called for  by agency IT project management guidance. Specifically, from  September 2012 through December 2012, Railroad Retirement Board  and SSA officials participated in work groups with CMS to determine  potential approaches to SSN removal. As a result, they identified two  approaches: (1) replacing the SSN-based HICN with a new identifier  that does not include the SSN, referred to as the Medicare Beneficiary  Identifier; and (2) truncating the first five digits of the SSN for display  on Medicare cards. Agency officials conducting the study ruled out  other options, such as embedding the number in smart cards or  magnetic strips, because they were determined to be too costly,  technically infeasible, or burdensome to providers and beneficiaries.
Project officials collected information that could be used to develop  initial project costs and identify basic business and technical risks  associated with implementing each approach. Specifically, officials  conducting the 2013 study collected data that could be used for  establishing a technical baseline for cost estimates, such as the level  of effort system owners estimated would be required for each life- cycle phase. Project officials also collected input from system and  business owners regarding technical and business risks associated  with the two approaches. For example, the owners of one of the  shared systems described a risk that unacceptable processing times  would result from the implementation of a mechanism for translating  between the HICN and a new identifier. This information could be  useful in identifying efficient translation mechanisms that would be  less likely to introduce such a risk.
Agency officials took steps to determine the changes that would have  to be made throughout the agency’s and program stakeholders’ IT  environment. The results of these actions could provide information  essential to conducting a preliminary enterprise architecture review— another step required for initiating an IT project. Specifically, officials  conducting the 2013 study identified internal and external stakeholder  systems that could be affected if the SSN was removed from cards,  and identified other IT initiatives that could be coordinated with an  SSN removal project. For example, during the 2013 study, CMS  system and functional-level business owners conducted high-level  impact assessments of the two approaches on the agency’s business  processes and all systems identified in its information technology  inventory. Of CMS’s more than 200 systems, these officials  identified 72 systems that could be affected by the introduction of a  new identifier and 41 that would be affected by the second approach  (masking the first 5 digits of the SSN). They conducted high-level  assessments of the types of changes that would need to be made to  those systems, including the level of complexity of the changes, the  number of hours of work at each life-cycle phase, and the potential to  leverage related efforts. Appendix II provides a detailed assessment  of the types of system changes that would have to be made to three  internal CMS systems that provide functionality key to determining  beneficiaries’ eligibility for specific treatments and services, validating  and adjudicating Part A claims, and sharing data for coordination of  benefits payment between Medicare and program stakeholders.
Agency officials also established assumptions regarding the two  approaches for SSN removal. For example, when collecting data  regarding the impact on its internal systems, system owners were  instructed to assume that a crosswalk service would be available to  translate the HICN to a new identifier, and that the new identifier  would retain the same length as the existing HICN but have a different  format. CMS officials also established assumptions regarding  conditions under which data exchanged with external stakeholders  would include either number.
CMS collected data from its federal partners to estimate the impact of  the proposed approaches on external systems. For example, officials  conducting the 2013 study collected level-of-effort estimates from  SSA and the Railroad Retirement Board for implementing changes to  their affected systems. Although their estimates varied, the changes  these stakeholder officials described were similar. SSA officials stated  that they would have to make system changes to identify beneficiaries  when they contact SSA and provide the new identifier, instead of the  HICN, to request a new Medicare card. Railroad Retirement Board  officials also stated that they would have to make changes in order to  use the new identifier instead of the HICN when issuing or replacing  retirees’ Medicare cards.
CMS also involved state program stakeholders and collected high- level estimates of changes that would have to be made to states’  Medicaid systems. Because each state implements IT solutions to  support its unique Medicaid program, the design, implementation, and  level of effort estimated to modify their systems varied widely. For  example, we assessed Medicaid program estimates provided to CMS  by eight states. Of these, three states estimated that less than 500  hours would be needed to make the changes, in part because some  of the systems already convert identifiers. One of these states  reported that no effort would be required since their systems were  already capable of updating records when changes to identifiers are  made. On the other hand, officials with another state Medicaid  program estimated that about 22,000 hours of effort would be needed  to, among other things, expand databases to include a new identifier,  and another estimated that over 58,000 hours would be required to  modify systems to process functions based on a new identifier,  including Medicare buy-in, eligibility determination, and Part D  processing systems. Three other states estimated around 4,000 hours  of work to implement mechanisms to cross reference or convert the  HICN to a new identifier.
While the data and information collected during the 2013 study could be  leveraged to support a future IT project to address SSN removal,  according to officials with CMS’s Office of Information Services, the  agency’s Chief Information Officer has not received direction from CMS’s  leadership to submit a proposal for an IT project that would lead to the  identification, development, and implementation of a technical solution.  We have noted in prior reports the importance of protecting Medicare  beneficiaries from increased risks of identity theft, and OMB has required  federal agencies to take steps to eliminate unnecessary uses of SSNs.  We have also noted that federal agencies’ Chief Information Officers are  responsible for, among other key IT management areas, information  security along with systems development and integration. Additionally,  CMS has designated the Office of Information Services as the lead for  developing and enforcing the agency’s IT policies, standards, and  practices. As such, these entities should play an active role in pursuing IT  solutions for securing personal data, such as Medicare beneficiaries’  SSNs. The data and information the Office of Information Services  collected during the 2013 study could provide valuable input to future  efforts to define such a solution. Nonetheless, until the agency designates  a business owner, establishes a business case, issues a project charter,  and conducts architectural and IT project selection reviews for SSN  removal, it will lack sufficient information and resources needed to  actively pursue the identification of an IT solution for SSN removal that  best protects beneficiaries’ identities.
section_title: CMS Has Initiated Actions Intended to Address Modernization Goals That Could Facilitate SSN Removal but Has Not Made Specific Plans for Leveraging Efforts
paragraphs: CMS has efforts under way to modernize its IT systems, a number of  which could be leveraged to facilitate the removal of SSNs from Medicare  cards. For example, one of the agency’s modernization goals is to  establish IT functionality that can be used to support multiple business  needs of organizations and facilitate data sharing among the agency and  its stakeholders. This and other goals were described by Office of  Information Services officials who indicated that the agency is in the  process of developing an agencywide IT modernization strategy to align  with newly defined business goals.
A well-defined modernization strategy includes plans for systems that are  integrated into an enterprise’s IT environment and that do not duplicate  other systems’ functionality. By planning accordingly, agencies increase  the likelihood that they will design and develop systems that easily  exchange information with other systems and improve their ability to  modernize systems in a timely and cost-effective manner.
In this regard, CMS has initiated actions that could eliminate duplicative  programming efforts and help establish standards for integrating new  systems and making the modifications to existing systems needed to  implement an IT solution for SSN removal. For example, CMS officials  with the Office of Information Services described modernization projects  that were initiated to support administrators’ ability to carry out other  programs and that were aligned with the first of the seven stated  modernization goals—to establish an IT architecture capable of  supporting the development and implementation of shared services.  Specifically, the agency established such an architecture to implement  five shared services to support the administration of other agency  programs, including but not limited to, programs established by the  Affordable Care Act. The shared services are
Enterprise Identity Management, which is planned to enable  individuals to use a single online identity (e.g., user ID) for engaging in  business with CMS that meets all federal security requirements;
Master Data Management, which is a suite of data records and  services that will allow CMS to link and synchronize beneficiary,  provider, and organization data to multiple disparate sources;
Enterprise Portal, a central channel for beneficiaries, providers,  organizations, and states to receive CMS information, products, and  services via consistent web pages;
Business Rules Enterprise Service, which provides a framework for  automating and managing decision logic and routines for CMS  programs (e.g., provider and beneficiary cross check for Accountable  Care Organization programs); and
Enterprise Eligibility, a consistent and reusable way for business  applications to access beneficiary eligibility data for a variety of uses  (e.g., claims processing, providers and plans, and external programs).
In implementing these services, the agency has taken some steps that  could help define and put into place the necessary architectural  components and standardized interfaces to enable sharing of the  services’ capabilities across the IT infrastructure and CMS’s business  areas.
One of the five shared services that CMS implemented, the Business  Rules Enterprise Service could facilitate the implementation of an IT  solution for SSN removal. For example, the IT infrastructure that was  established to implement the service could support the implementation of  a crosswalk service needed by multiple systems to translate a new  identifier to the HICN (and vice versa). By providing this functionality  through a shared service, the crosswalk would be available for use by any  system within CMS’s IT infrastructure and therefore eliminate the need to  duplicate programming efforts for each system to implement such  functionality. Specifically, if such a shared service were implemented to  support an SSN-removal IT project, it would be available for use by all the  systems that, according to CMS officials, would have to be modified to  use a new identifier. As a result, of the 20 systems that the agency  estimated would account for 86 percent of the costs to modify, systems  changes would only have to be developed and tested for one  implementation rather than for 18 of the 20 systems that would need to  perform a crosswalk between a new identifier and the existing HICN.
In addition to the five shared services described, another shared service,  the Beneficiary Data Streamlining service, was designed to consolidate  into one system the functionality for determining fee-for-service eligibility  that is currently implemented in four different systems (the Common  Working File and the three shared systems). This new service, which is  planned to be implemented in October 2013, would be used by these  systems to eliminate duplicate or unnecessary processing. Consequently,  the implementation of the service could also facilitate SSN removal  efforts. For example, it could reduce the extent of modifications that would  have to be made to the four systems by eliminating the need to make  changes to their current eligibility determination functions to process a  new non-SSN-based identifier. Instead, that capability would be provided  by the new service. As a result, the agency could save unnecessary costs  and efforts associated with duplicative programming changes to the four  affected systems.
While these projects could offer opportunities for leveraging ongoing  modernization initiatives to facilitate SSN removal, CMS officials stated  that because the agency has not yet established a business case and IT  project for removing SSNs from Medicare cards, they have not included  shared services or other IT initiatives in their modernization activities and  related plans to specifically support changes needed as a result of SSN  removal. Until CMS establishes an IT project for SSN removal that could  be incorporated into ongoing agencywide modernization initiatives, it may  miss opportunities to leverage other ongoing system development  activities that could facilitate efforts to design, develop, and implement an  IT solution in a timely and cost-effective manner.
section_title: Conclusions
paragraphs: While CMS has spent time and resources over the past 7 years studying  approaches that could be taken toward removing the SSN from Medicare  beneficiaries’ cards, the agency has not actively established and pursued  a goal to identify an IT solution for doing so. The efforts made thus far by  CMS and its stakeholders could provide some of the information needed  to initiate an IT project to design and develop the system changes that  would have to be made to address an agencywide effort to better  safeguard Medicare beneficiaries’ identity. However, until the agency  takes other critical steps, such as designating a business owner,  establishing a business case, issuing a project charter, and conducting  architectural and IT project selection reviews, it will not be in a position to  design, develop, and implement the changes that would have to be made  to systems affected by the removal of SSNs from display on Medicare  beneficiaries’ health insurance cards. Additionally, the agency may miss  opportunities to improve the timeliness and cost effectiveness of any  actions taken to develop and implement a technical solution that could be  achieved if it incorporated such actions into plans for ongoing  enterprisewide IT modernization initiatives.
section_title: Recommendations for Executive Action
paragraphs: To better position the agency to efficiently and cost-effectively identify,  design, develop, and implement an IT solution that addresses the  removal of SSNs from Medicare beneficiaries’ health insurance cards, we  recommend that the Administrator of CMS take the following two actions: direct the initiation of an IT project for identifying, developing, and  implementing changes that would have to be made to CMS’s affected  systems, including designating a business owner and establishing a  business case, issuing a project charter, and conducting project  selection and architectural reviews of proposed approaches for the  removal of SSNs from Medicare beneficiaries’ cards; and  incorporate such a project into plans for ongoing enterprisewide IT  modernization initiatives.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, signed by HHS’s Assistant  Secretary for Legislation (and reprinted in appendix III), HHS stated that it  appreciated the opportunity to review the report prior to its publication.  Further, the department stated that it concurred with both of our  recommendations under the condition that certain constraints were  addressed.
With respect to our first recommendation, HHS agreed that removing the  SSN from Medicare cards is an appropriate step toward reducing the risk  of identity theft, but that the agency could not make a decision to proceed  with such a project without agreement from SSA and the Railroad  Retirement Board. In addition, the department stated that a clear source  of funding for both IT and non-IT activities associated with SSN removal  would need to be identified before proceeding. However, as we noted in  our report, CMS’s Chief Information Officer and the Office of Information  Services should play an active role in pursuing IT solutions for securing  personal data, such as Medicare beneficiaries’ SSNs. For this reason, it is  important that CMS determine the appropriate actions to take toward  initiating an IT project for addressing the removal of SSNs from cards and  guide its stakeholders, such as SSA and the Railroad Retirement Board,  in taking the steps needed to achieve the goals of any SSN removal  project. In addition, the final step of the IT project initiation phase, as  defined by  CMS’s IT life-cycle project management guidance, is a review  to determine if proposed projects are worthy of funding and inclusion in  an IT project portfolio. Accordingly, uncertainties regarding a clear source  of funding should not constrain CMS from taking steps to initiate an IT  project to address SSN removal.
Regarding our second recommendation, HHS concurred, again with the  caveat that the above-mentioned constraints were addressed. The  department also noted that while CMS had not implemented its shared  services initiative specifically for the purpose of SSN removal, the general  functionality exists in the shared services to support this effort, and this  was reflected in the agency’s 2013 cost estimate. However, unless the  agency considers SSN removal as part of its enterprisewide  modernization initiative, it may miss additional opportunities for leveraging  system changes being made as part of the modernization to support SSN  removal.
In this regard, we believe that CMS is currently positioned to implement  both our recommendations, regardless of perceived constraints, and to  take the actions needed to initiate an IT project as part of its agencywide  modernization initiative. If such actions are taken CMS could improve  HHS’s ability to protect Medicare beneficiaries against increased risk of  identity theft introduced by the use of SSNs on Medicare cards. HHS also  provided technical comments, which we incorporated into the report as  appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of HHS and  interested congressional committees. In addition, the report will be  available at no charge on the GAO website at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to (1) assess the actions the Centers  for Medicare and Medicaid Services (CMS) has been taking to identify  and implement information technology (IT) solutions for removing Social  Security numbers (SSN) from Medicare beneficiaries’ cards, and (2)  determine whether CMS’s ongoing information technology modernization  initiative could offer opportunities to facilitate efforts to remove the SSN  from the cards.
To determine the extent to which CMS has been taking steps to  implement a technical solution for removing the SSN from Medicare  cards, we examined studies conducted by agency officials in 2006, 2011,  and 2013 of different approaches. We reviewed supporting documents  that were used by project officials to gather information from system and  business owners regarding the impact that two approaches would have  on the agency’s IT systems, including estimates of the levels of effort that  would be needed to implement the changes that would have to be made  to affected systems. We assessed the data from these documents,  referred to as “workbooks,” to determine the steps agency officials took  that could be used to identify a technical solution for the two approaches–  one to introduce a new identifier that does not include the SSN and  another to mask the first five digits of the SSN in the existing SSN-based  identifier, the Health Insurance Claim Number (HICN). We determined  which activities resulted in outcomes that could be used to initiate actions  towards identifying a specific technical solution by comparing  documented results of CMS’s efforts to requirements defined by CMS’s  processes for managing information technology projects to develop and  implement technical solutions for business processes.
To better understand the extent of changes that would have to be made  to the systems, we assessed a sample of the systems that the agency  identified as being affected by the removal of the SSN from cards and  replacement with a unique, non-SSN-based number. To select the  systems for our sample, we obtained and analyzed system impact  workbooks for 29 systems that we determined accounted for over 90  percent of the total estimated level of effort needed to modify existing  systems to process the new identifier. Based on our assessment, we  determined that these systems provided adequate examples of the types  of system modifications that would be required to implement a technical  solution for agencywide efforts to remove the SSN from Medicare cards.  Additionally, we focused our analysis of the data included in the  workbooks on the option to replace the SSN-based identifier, the HICN,  on the Medicare card with a new identifier since findings resulting from  our prior assessment of CMS’s 2011 report on SSN removal established  this option as the one most likely to protect beneficiaries’ SSNs and help  prevent identify theft. From the 29 systems, we selected 3—1 system  that represented a low level of effort based on the estimated levels of  effort reported by system and business owners in the workbooks, 1 that  represented a high level of effort, and 1 of the shared systems that  performs a critical function—fee-for-service claims processing. To  determine the types of changes that would have to be made to the  systems, we examined technical documents to identify architectural  components, data types, message formats, and interfaces with other  systems that would have to be modified to either translate a new identifier  to the HICN for internal processing, or translate the HICN back to the new  identifier for purposes such as printing notices or new cards. We also held  discussions with owners of the selected systems to confirm our  understanding of the systems and related files and databases, along with  the functionality they provide. In addition, we held discussions with CMS  officials from the agency’s Office of Information Services, including the  Chief Information Officer, regarding actions taken to complete the 2013  study, particularly steps taken to collect information regarding the impact  on CMS’s existing IT systems.
To further address the first objective, we determined the extent to which  CMS involved stakeholders to estimate the levels of effort that would  have to be made to address the two approaches for removing the SSN  from Medicare cards. To do so, we reviewed documentation that  described the actions CMS took to solicit input from its federal Medicare  and state Medicaid program stakeholders, such as CMS’s most recent  report to Congress and documented results of stakeholders’ assessment  of the impact the SSN removal would have on their systems. We  obtained and analyzed such documentation from the Social Security  Administration and the Railroad Retirement Board, CMS’s two federal  program stakeholders. To select states for our study, we examined  documents that were provided by 49 states and the District of Columbia in  response to CMS’s request for data related to the system changes that  would have to be made. We then calculated the median level of effort  estimated and selected states whose estimates represented high,  medium, and low levels of effort. Specifically, we identified the 3 states  that estimated the highest level of effort, 4 states that estimated a  medium (or closest to the median) level of effort, and the 3 that estimated  the lowest level of effort. Of the 10 that we selected, we received  responses from 8—the 3 lowest, 3 of the medium, and 2 of the highest  estimators. We assessed the data they provided to CMS and collected  additional data by conducting semistructured interviews or through written  responses to a standard set of questions. While we could not generalize  the information we collected from the 8 states to reflect the level of  participation by all 49 states and the District of Columbia, the views  obtained from these state officials offered insights into the extent to which  CMS involved its program stakeholders in assessing approaches for  removing SSNs. We also held discussions with program stakeholders  from each of the federal and state entities.
See Government Performance and Results Act of 1993, Pub. L. No. 103-62, 107 Stat.  285 (1993), as amended by the GPRA Modernization Act of 2010, Pub. L. No. 111-352,  124 Stat. 3866 (2011); Office of Management and Budget, Management of Federal  Information Resources, Circular A-130 (Washington, D.C.: Nov. 28, 2000), and Planning,  Budgeting, Acquisition, and Management of Capital Assets, Circular A-11, Part 7  (Washington, D.C.: July 2003). services, one of the modernization goals described by the Chief  Information Officer and officials from the Office of Information Services.  We then compared information obtained from this plan to descriptions of  modifications to systems that would have to be made if the SSN were  removed from cards. We also reviewed documentation provided to the  Office of Information Services by the owners of these systems to identify  other IT projects that could facilitate the development and implementation  of a technical solution for an SSN removal effort. We interviewed CMS  officials, including the Chief Information Officer, to obtain additional  information regarding the agencywide IT modernization goals and  objectives and the extent to which the goals and objectives addressed the  removal of SSNs from Medicare cards.
For each of the objectives, we assessed the reliability of the  documentation we received from CMS, including the workbooks and  technical documentation, by obtaining corroborating evidence through  interviews with the agency’s system and business owners who were  knowledgeable of the various systems, the individuals who were  responsible for filling out the workbooks at the states, and individuals  knowledgeable about CMS’s modernization efforts, including the Chief  Information Officer. Based on how we used the information and the  corroborating evidence provided in the interviews, we determined that the  documentation and data provided by the agency were sufficiently reliable  for the purposes of our review.
We conducted this performance audit from October 2012 to September  2013 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: GAO’s Assessment of Three CMS Systems and the Types of Potential Changes Needed to Support SSN Removal
paragraphs: We selected three systems for assessment to better understand the types  of changes that would have to be made to process beneficiary data based  on the introduction of a new identifier, or Medicare Beneficiary Identifier  (MBI), to replace SSNs as data entered into the systems. The three  systems are the HIPAA Eligibility Transaction System (HETS), the Fiscal  Intermediary Standard System (FISS), and the Medicare Beneficiary  Database Suite of Systems (MBDSS). (See app. I for a description of the  methodology used to select and assess the systems.) The following  tables provide descriptions of the systems and the functionality they  provide, the number of hours that owners of the systems estimated would  be required to modify the systems, and a summary of the technical  characteristics and components (e.g., the programming languages and  tools, software applications, data bases, data storage files, and outcomes  of data processing) that would have to be considered in estimating the  impact of removing SSNs from Medicare cards on these systems. Our  assessments were conducted based on information collected from  technical documentation relevant to each of the systems and from  discussions with system owners in CMS’s Office of Information Services.
section_title: Appendix III: Comments from the Department of Health & Human Services
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Teresa F. Tucker (Assistant  Director), Wilfred B. Holloway, Lee A. McCracken, Thomas E. Murphy,  Maria Stattel, Daniel K. Wexler, Merry L. Woo, and Charles E. Youman  made significant contributions to this report.