Social Security Numbers: Use Is Widespread and Protections Vary
Released: 2004-06-15T00:00:00

Letter

Background

The Social Security Act of 1935 authorized SSA to establish a record- keeping system to help manage the Social Security program, and this resulted in the creation of the SSN. Through a process known as enumeration, unique numbers are created for every person as a work and retirement benefit record for the Social Security program. SSA generally issues SSNs to most U.S. citizens, and SSNs are also available to noncitizens lawfully admitted to the United States with permission to work. SSA estimates that approximately 277 million individuals currently have SSNs. The SSN has become the identifier of choice for government agencies and private businesses, and thus it is used for a myriad of non- Social Security purposes.

The growth in the use of SSNs is important to individual SSN holders because these numbers, along with names and birth certificates, are among the three personal identifiers most often sought by identity thieves. In addition, SSNs are used as breeder information to create additional false identification documents, such as drivers’ licenses. Recent statistics collected by federal agencies and CRAs indicate that the incidence of identity theft appears to be growing. The Federal Trade Commission (FTC), the agency responsible for tracking identity theft, reported that consumer fraud and identity theft complaints grew from 404,000 in 2002 to 516,740 in 2003. In 2003, consumers also reported losses from fraud of more than $437 million, up from $343 million in 2002. In addition, identity crime account for over 80 percent of SSN misuse allegations according to the SSA. Also, officials from two of the three national CRAs report an increase in the number of 7-year fraud alerts placed on consumer credit files, which they consider to be reliable indicators of the incidence of identity theft. Law enforcement entities report that identity theft is almost always a component of other crimes, such as bank fraud or credit card fraud, and may be prosecuted under the statutes covering those crimes.

Private Sector Entities Routinely Obtain and Use SSNs, and Certain Laws Affect The Disclosure of This Information

Private sector entities such as information resellers, CRAs, and health care organizations routinely obtain and use SSNs. Such entities obtain the SSNs from various public sources and their business clients wishing to use their services. We found that these entities usually use SSNs for various purposes, such as to build tools that verify an individual’s identity or match existing records. Certain federal laws have limited the disclosures private sector entities are allowed to make to their customers, and some states have also enacted laws to restrict the private sector’s use of SSNs.

Private Sector Entities Obtain SSNs from Public and Private Sources and Use SSNs for Various Purposes

Private sector entities such as information resellers, CRAs, and health care organizations generally obtain SSNs from various public and private sources and use SSNs to help identify individuals. Of the various public sources available, large information resellers told us they obtain SSNs from various records displayed to the public such as records of bankruptcies, tax liens, civil judgments, criminal histories, deaths, real estate ownership, driving histories, voter registrations, and professional licenses. Large information resellers said that they try to obtain SSNs from public sources where possible, and to the extent public record information is provided on the Internet, they are likely to obtain it from such sources. Some of these officials also told us that they have people that go to courthouses or other repositories to obtain hard copies of public records.

Additionally, they obtain batch files of electronic copies of all public records from some jurisdictions.

Given the varied nature of SSN data found in public records, some reseller officials said they are more likely to rely on receiving SSNs from their business clients than they are from obtaining SSNs from public records. These entities obtain SSNs from their business clients, who provide SSNs in order to obtain a reseller’s services or products, such as background checks, employee screening, determining criminal histories, or searching for individuals. Large information resellers also obtain SSN information from private sources. In many cases such information was obtained through review of data where a customer has voluntarily supplied information resellers with information about himself or herself. In addition, large reseller officials said they also use their clients’ records in instances where the client has provided them with information.

We also found that Internet-based resellers rely extensively on public sources and records displayed to the public. These resellers listed on their Web sites public information sources, such as newspapers, and various kinds of public record sources at the county, state, and national levels. During our investigation, we determined that once Internet-based resellers obtained an individual’s SSN they relied on information in public records to help verify the individual’s identity and amass information around the individual’s SSN.

Like information resellers, CRAs also obtain SSNs from public and private sources as well as from their customers or the businesses that furnish data to them. CRA officials said that they obtain SSNs from public sources, such as bankruptcy records, a fact that is especially important in terms of determining that the correct individual has declared bankruptcy. CRA officials also told us that they obtain SSNs from other information resellers, especially those that specialize in obtaining information from public records. However, SSNs are more likely to be obtained from businesses that subscribe to their services, such as banks, insurance companies, mortgage companies, debt collection agencies, child support enforcement agencies, credit grantors, and employment screening companies. Individuals provide these businesses with their SSNs for reasons such as applying for credit, and these businesses voluntarily report consumers’ charge and payment transactions, accompanied by SSNs, to CRAs.

We found that health care organizations were less likely to rely on public sources for SSN data. Health care organizations obtain SSNs from individuals themselves and from companies that offer health care plans. For example, subscribers or policyholders provide health care plans with their SSNs through their company or employer group when they enroll in health care plans. In addition to health care plans, health care organizations include health care providers, such as hospitals. Such entities often collect SSNs as part of the process of obtaining information on insured people. However, health care officials said that, particularly with hospitals, the medical record number rather than the SSN is the primary identifier.

Information resellers, CRAs, and health care organization officials all said that they use SSNs to verify an individual’s identity. Most of the officials we spoke to said that the SSN is the single most important identifier available, mainly because it is truly unique to an individual, unlike an individual’s name and address, which can often change over an individual’s lifetime. Large information resellers said that they generally use the SSN as an identity verification tool. Some of these entities have incorporated SSNs into their information technology, while others have incorporated SSNs into their clients’ databases used for identity verification. For example, one large information reseller that specializes in information technology solutions has developed a customer verification data model that aids financial institutions in their compliance with some federal laws regarding “knowing your customer.” We also found that Internet-based information resellers use the SSN as a factor in determining an individual’s identity. We found these types of resellers to be more dependent on SSNs than the large information resellers, primarily because their focus is more related to providing investigative or background-type services to anyone willing to pay a fee. Most of the large information resellers officials we spoke to said that although they obtain the SSN from their business clients, the information they provide back to their customers rarely contains the SSN. Almost all of the officials we spoke to said that they provide their clients with a truncated SSN, an example of which would be xxx-xx-6789.

CRAs use SSNs as the primary identifier of individuals, which enables them to match the information they receive from their business clients with the information stored in their databases on individuals. Because these companies have various commercial, financial, and government agencies furnishing data to them, the SSN is the primary factor that ensures that incoming data is matched correctly with an individual’s information on file. For example, CRA officials said they use several factors to match incoming data with existing data, such as name, address, and financial account information. If all of the incoming data, except the SSN, match with existing data, then the SSN will determine the correct person’s credit file. Given that people move, get married, and open new financial accounts, these officials said that it is hard to distinguish among individuals. Because the SSN is the one piece of information that remains constant, they said that it is the primary identifier that they use to match data.

Health care organizations also use the SSN to help verify the identity of individuals. These organizations use SSNs, along with other information, such as name, address, and date of birth, as a factor in determining a member’s identity. Health care officials said that health care plans, in particular, use the SSN as the primary identifier of an individual, and it often becomes the customer’s insurance number. Health care officials said that they use SSNs for identification purposes, such as linking an individual’s name to an SSN to determine if premium payments have been made. They also use the SSN as an online services identifier, as an alternative policy identifier, and for phone-in identity verification. Health care organizations also use SSNs to tie family members together where family coverage is used, to coordinate member benefits, and as a cross- check for pharmacy transactions. Health care industry association officials also said that SSNs are used for claims processing, especially with regard to Medicare. According to these officials, under some Medicare programs, SSNs are how Medicare identifies benefits provided to an individual.

Certain Laws Limit the Private Sectors’ Disclosure of Personal Information That Includes SSNs

Certain federal and state laws have placed restrictions on certain private sector entities use and disclosure of consumers’ personal information that includes SSNs. Such laws include the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Drivers Privacy Protection Act (DPPA), and the Health Insurance Portability and Accountability Act (HIPAA). As shown in table 1, the laws either restrict the disclosures that entities such as information resellers, CRAs, and health care organizations are allowed to make to specific purposes or restrict whom they are allowed to give the information to. Moreover, as shown in table 1, these laws focus on limiting or restricting access to certain personal information and are not specifically focused on information resellers. See appendix I for more information on these laws.

We reviewed selected legislative documents of 18 states and found that at least 6 states have enacted their own legislation to restrict either the display or use of SSNs by the private sector. Notably, in 2001, California enacted Senate Bill (SB) 168, restricting private sector use of SSNs. Specifically, this law generally prohibits companies and persons from certain uses such as, posting or publicly displaying SSNs and printing SSNs on cards required to access the company’s products or services. Furthermore, in 2002, shortly after the enactment of SB 168, California’s Office of Privacy Protection published recommended practices for protecting the confidentiality of SSNs. These practices were to serve as guidelines to assist private and public sector organizations in handling SSNs.

Similar to California’s law, Missouri’s law (2003 Mo. SB 61), which is not effective until July 1, 2006, bars companies from requiring individuals to transmit SSNs over the Internet without certain safety measures, such as encryption and passwords. However, while SB 61 prohibits a person or private entity from publicly posting or displaying an individual’s SSN “in any manner,” unlike California’s law, it does not specifically prohibit printing the SSN on cards required to gain access to products or services. In addition, Arizona’s law (2003 Ariz. Sess. Laws 137), effective January 1, 2005, restricts the use of SSNs in ways very similar to California’s law. However, in addition to the private sector restrictions, it adds certain restrictions for state agencies and political subdivisions. For example, state agencies and political subdivisions are prohibited from printing an individual’s SSN on cards and certain mailings to the individual. Last, Texas prohibits the display of SSNs on all cards, while Georgia and Utah’s laws are directed at health insurers and, therefore, pertain primarily to insurance identification cards. None of these three laws contain the provisions mentioned above relating to Internet safety measures and mailing restrictions. Table 2 lists states that have enacted legislation and related provisions.

Public Sector Entities Also Use SSNs and Some Agencies Limit Their Use and Display Even Though SSNs are Displayed in Some Public Records

Agencies at all levels of government frequently obtain and use SSNs. A number of federal laws require government agencies to obtain SSNs, and these agencies use SSNs to administer their programs, verify applicants’ eligibility for services and benefits, and do research and evaluation. Given the potential for misuse, some government agencies are taking steps to limit their use and display of SSNs and prevent the proliferation of false identities. However, given the open nature of certain government records, SSNs appear in some records displayed to the public. Our ongoing work is looking at the storage, display, and protection of SSNs in records displayed to the public.

Public Sector Entities Are Required by Laws and Regulations to Obtain SSNs and Use SSNs for Various Purposes

Government agencies obtain SSNs because a number of federal laws and regulations require certain programs and federally funded activities to use the SSN for administrative purposes. Such laws and regulations require the use of the SSN as an individual’s identifier to facilitate automated exchanges that help administrators enforce compliance with federal laws, determine eligibility for benefits, or both. For example, the Internal Revenue Code and regulations, which govern the administration of the federal personal income tax program, require that individuals’ SSNs serve as taxpayer identification numbers. A number of other federal laws require program administrators to use SSNs in determining applicants’ eligibility for federally funded benefits. The Social Security Act requires individuals to provide their SSNs in order to receive benefits under the SSI, Food Stamp, Temporary Assistance for Needy Families, and Medicaid programs. In addition, the Commercial Motor Vehicle Safety Act of 1986 requires the use of SSNs to identify individuals and established the Commercial Driver’s License Information System, a nationwide database where states may use individuals’ SSNs to search the database for other state-issued licenses commercial drivers may hold. Federal law also requires the use of SSNs in state child support programs to help states locate noncustodial parents, establish and enforce support orders, and recoup state welfare payments from parents. The law also allows states to record SSNs on many other state documents, such as professional, occupational, and marriage licenses; divorce decrees; paternity determinations; and death certificates, and to make SSNs associated with these documents available for state child support agencies to use in locating and obtaining child support payments from noncustodial parents.

Government agencies use SSNs for a variety of reasons. We found that most of these agencies use SSNs to administer their programs, such as to identify, retrieve, and update their records. In addition, many agencies also use SSNs to share information with other entities to bolster the integrity of the programs they administer. As unique identifiers, SSNs help ensure that the agency is obtaining or matching information on the correct person.

Government agencies also share information containing SSNs for the purpose of verifying an applicant’s eligibility for services or benefits, such as matching records with state and local correctional facilities to identify individuals for whom the agency should terminate benefit payments. SSNs are also used to ensure program integrity. Agencies use SSNs to collect delinquent debts and even share information for this purpose. In addition, SSNs are used for statistics, research, and evaluation. Agencies responsible for collecting and maintaining data for statistical programs that are required by statute, make use of SSNs. In some cases, these data are compiled using information provided for another purpose. For example, the Bureau of the Census prepares annual population estimates for states and counties using individual income tax return data linked over time by SSN to determine immigration rates between localities. SSNs also provide government agencies and others with an effective mechanism for linking data on program participation with data from other sources to help evaluate the outcomes or effectiveness of government programs. In some cases, records containing SSNs are sometimes matched across multiple agency or program databases.

Finally, government agencies use employees’ SSNs to fulfill some of their responsibilities as employers. For example, personnel departments of these agencies use SSNs to help them maintain internal records and provide employee benefits. In addition, employers are required by law to use employees’ SSNs when reporting wages. Wages are reported to SSA, and the agency uses this information to update earnings records it maintains for each individual. The Internal Revenue Service (IRS) also uses SSNs to match the employer wage reports with amounts individuals report on personal income tax returns. Federal law also requires that states maintain employers’ reports of newly hired employees, identified by SSNs. States must forward this information to a national database that is used by state child support agencies to locate parents who are delinquent in child support payments.

Government Agencies Are Taking Steps to Limit the Use and Display of SSNs

Despite the widespread use of SSNs at all levels of government, not all agencies use SSNs. We found that some agencies do not obtain, receive, or use SSNs of program participants, service recipients, or individual embers of the public. Moreover, not all agencies use the SSN as their primary identification number for record-keeping purposes. These agencies maintain an alternative number that is used in addition to or in lieu of SSNs for certain activities.

Some agencies are also taking steps to limit SSNs displayed on documents that may be viewed by others who may not have a need to view this personal information. For example, the Social Security Administration has truncated individuals’ SSNs that appear on the approximately 120 million benefits statements it mails each year. Some states have also passed laws prohibiting the use of SSNs as a student identification number. Almost all states have modified their policies on placing SSNs on state drivers’ licenses.

At the federal level, SSA has taken steps in its enumeration process and verification service to help prevent SSNs from being used to proliferate false identities. SSA has formed a task force to address weaknesses in its enumeration process and has (1) increased document verifications and developed new initiatives to prevent the inappropriate assignment of SSNs to noncitizens, and (2) undertaken initiatives to shift the burden of processing noncitizen applications from its field offices. SSA also helps prevent the proliferation of false identities through its verification service, which allows state driver licensing agencies to verify the SSN, name, and date of birth of customers with SSA’s master file of Social Security records. Finally, SSA has also acted to correct deficiencies in its information systems’ internal controls. These changes were made in response to the findings of an independent audit that found that SSA’s systems were exposed to both internal and external intrusion, increasing the possibility that sensitive information such as SSNs could be subject to unauthorized access, modification, and disclosure, as well as the risk of fraud.

Public Records Can Also Be a Source of SSNs

Given the open nature of certain government records, SSNs appear in these records for a number of reasons. For example, SSNs may already be a part of a document that is submitted to a recorder for official preservation, such as veterans’ discharge papers. Documents that record financial transactions, such as tax liens and property settlements, also contain SSNs to help identify the correct individual. As previously stated, government officials are required by law to collect SSNs in numerous instances. Moreover, some state laws allow government entities to collect SSNs on voter registries to help avoid duplicate registrations.

Courts at all three levels of government also collect and maintain records that are routinely made available to the public. Court records overall are presumed to be public. However, each court may have its own rules or practices governing the release of information. SSNs appear in court documents for a variety of reasons. In many cases, SSNs are already a part of documents that are submitted by attorneys or individuals. These documents could be submitted as part of the evidence for a proceeding or could be included as part of a petition for an action, such as a judgment or a divorce. In other cases, courts include SSNs on documents they and other government officials create, such as criminal summonses, arrest warrants, and judgments, to increase the likelihood that the correct individual is affected (i.e., to avoid arresting the wrong John Smith). Again, in some cases, federal law requires that SSNs be placed in certain records that courts maintain, such as child support orders.

In our prior report, we looked at the extent and nature of federal, state, and county governments’ use of SSNs when they are contained in public records, and the options available to better safeguard SSNs that are found in these public records. Our findings led us to suggest that Congress consider addressing SSN security and display issues in state and local government and in public records, including those maintained by the judicial branch of government at all levels. We proposed that Congress convene a representative group of officials from all levels of government to develop a unified approach to safeguard SSNs used in all levels of government and particularly those displayed in public records.

At the request of this subcommittee, GAO was asked what types of public records SSNs are stored in, how are those records maintained, and to what extent SSNs are displayed inside those records. To do this work, we are surveying over 2,500 officials in state and local government agencies, including officials in all 50 states and the District of Columbia, and are conducting structured interviews of federal agencies. Our preliminary survey data show that the types of records most likely to contain SSNs and be made available to the general public by state government entities are court records, death records, UCC filings, and professional licensing records. At the local level, court records and land records are those most often cited as containing SSNs and being available to the general public. Preliminary data analysis indicates that identity verification is the most frequently given reason by both state and local respondents for collecting or using SSNs that are in records available to the public. Data matching and complying with state laws or regulations are also frequently cited as reasons for the collection or use of the SSN. However, responding state offices reported over 35 instances where they had no specific use for collecting SSNs.

Conclusions

Public and private entities use SSNs for many legitimate and publicly beneficial purposes. However, the more frequently SSNs are obtained and used, the more likely they are to be misused. As we continue to learn more about the entities that obtain SSNs and the purposes for which they obtain them, Congress and state legislatures will be able to determine if there are ways to limit access to this valuable piece of information and prevent it from being misused. However, restrictions on access or use may make it more difficult for businesses and government agencies to verify an individual’s identity. Accordingly, policy makers will have to balance restrictions on the use of SSNs on the one hand with legitimate needs for the use of SSNs on the other.

Although individuals may choose to provide their SSNs to public and private sector entities to obtain their services, individuals are often required to have their SSNs in records that may ultimately be displayed to the public. Such public display of personal information can create opportunities for identity crimes. Safeguarding SSNs in records displayed to the public offers an additional challenge because of the inherent tension between the nature of public records, that is, the need for transparency in government activities, and the need to protect individuals’ privacy. For this reason, in prior work, we recommended that Congress convene a representative group of officials to develop a unified approach to safeguard SSNs used in all levels of government and particularly those displayed in public records. We continue to believe that this would be a useful step toward preventing SSN misuse while acknowledging the needs of various levels of government.

At this subcommittee's request, we are continuing work on SSNs and their presence in public records and look forward to supporting continuing congressional consideration of these important policy issues. That concludes my testimony, and I would be pleased to respond to any questions the subcommittee has.

Contacts and Acknowledgments

For further information regarding this testimony, please contact Barbara D. Bovbjerg, Director; Tamara Cross, Assistant Director; or Alicia Cackley, Assistant Director of Education, Workforce, and Income Security Issues at (202) 512-7215. Individuals making key contributions to this testimony include Melinda Bowman, Raun Lazier, Joel Marus, and Caroline Sallee.

Appendix I: Federal Laws Affecting Information Resellers, CRAs, and Health Care Organizations:

Gramm-Leach-Bliley Act (GLBA):

GLBA requires companies to give consumers privacy notices that explain the institutions’ information-sharing practices. In turn, consumers have the right to limit some, but not all, sharing of their nonpublic personal information. Financial institutions are permitted to disclose consumers’ nonpublic personal information without offering them an opt-out right in the following circumstances: to effect a transaction requested by the consumer in connection with a financial product or service requested by the consumer; maintaining or servicing the consumer’s account with the financial institution or another entity as part of a private label credit card program or other extension of credit; or a proposed or actual securitization, secondary market sale, or similar transaction; with the consent or at the direction of the consumer; to protect the confidentiality or security of the consumer’s records; to prevent actual or potential fraud, for required institutional risk control or for resolving customer disputes or inquiries, to persons holding a legal or beneficial interest relating to the consumer, or to the consumer’s fiduciary; to provide information to insurance rate advisory organizations, guaranty funds or agencies, rating agencies, industry standards agencies, and the institution’s attorneys, accountants, and auditors; to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978, to law enforcement agencies, self-regulatory organizations, or for an investigation on a matter related to public safety; to a consumer reporting agency in accordance with the Fair Credit Reporting Act or from a consumer report reported by a consumer reporting agency; in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business if the disclosure concerns solely consumers of such business; to comply with federal, state, or local laws; an investigation or subpoena; or to respond to judicial process or government regulatory authorities.

Financial institutions are required by GLBA to disclose to consumers at the initiation of a customer relationship, and annually thereafter, their privacy policies, including their policies with respect to sharing information with affiliates and non-affiliated third parties.

Provisions under GLBA place limitations on financial institutions disclosure of customer data, thus affecting some CRAs and information resellers. We found that some CRAs consider themselves to be financial institutions under GLBA. These entities are therefore directly governed by GLBA’s restrictions on disclosing nonpublic personal information to non- affiliated third parties. We also found that some of the information resellers we spoke to did not consider their companies to be financial institutions under GLBA. However, because they have financial institutions as their business clients, they complied with GLBA’s provisions in order to better serve their clients and ensure that their clients are in accordance with GLBA. For example, if information resellers received information from financial institutions, they could resell the information only to the extent that they were consistent with the privacy policy of the originating financial institution.

Information resellers and CRAs also said that they protect the use of non- public personal information and do not provide such information to individuals or unauthorized third parties. In addition to imposing obligations with respect to the disclosures of personal information, GLBA also requires federal agencies responsible for financial institutions to adopt appropriate standards for financial institutions relating to safeguarding customer records and information. Information resellers and CRA officials said that they adhere to GLBA’s standards in order to secure financial institutions’ information.

Drivers Privacy Protection Act (DPPA):

The DPPA specifies a list of exceptions when personal information contained in a state motor vehicle record may be obtained and used (18 U.S.C. § 2721(b)). These permissible uses include: for use by any government agency in carrying out its functions; for use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; motor vehicle market research activities, including survey research; for use in the normal course of business by a legitimate business, but only to verify the accuracy of personal information submitted by the individual to the business and, if such information is not correct, to obtain the correct information but only for purposes of preventing fraud by pursuing legal remedies against, or recovering on a debt or security interest against, the individual; for use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, state, or local court or agency; for use in research activities; for use by any insurer or insurance support organization in connection with claims investigation activities; for use in providing notice to the owners of towed or impounded vehicles; for use by a private investigative agency for any purpose permitted under the DPPA; for use by an employer or its agent or insurer to obtain information relating to the holder of a commercial driver’s license; for use in connection with the operation of private toll transportation facilities; for any other use, if the state has obtained the express consent of the person to whom a request for personal information pertains; for bulk distribution of surveys, marketing, or solicitations, if the state has obtained the express consent of the person to whom such personal information pertains; for use by any requester, if the requester demonstrates that it has obtained the written consent of the individual to whom the information pertains; for any other use specifically authorized under a state law, if such use is related to the operation of a motor vehicle or public safety.

As a result of DPPA, information resellers said they were restricted in their ability to obtain SSNs and other driver license information from state motor vehicle offices unless they were doing so for a permissible purpose under the law. These officials also said that information obtained from a consumer’s motor vehicle record has to be in compliance with DPPA’s permissible purposes, thereby restricting their ability to resell motor vehicle information to individuals or entities not allowed to receive such information under the law. Furthermore, because DPPA restricts state motor vehicle offices’ ability to disclose driver license information, which includes SSN data, information resellers said they no longer try to obtain SSNs from state motor vehicle offices, except for permissible purposes.

Health Insurance Portability and Accountability Act (HIPAA):

The HIPAA privacy rule also defines some rights and obligations for both covered entities and individual patients and health plan members. Some of the highlights are: Individuals must give specific authorization before health care providers can use or disclose protected information in most nonroutine circumstances, such as releasing information to an employer or for use in marketing activities.

Covered entities will need to provide individuals with written notice of their privacy practices and patients’ privacy rights. The notice will contain information that could be useful to individuals choosing a health plan, doctor, or other service provided. Patients will be generally asked to sign or otherwise acknowledge receipt of the privacy notice.

Covered entities must obtain an individual’s specific authorization before sending them marketing materials.

Health care organizations, including health care providers and health plan insurers, are subject to HIPAA’s requirements. In addition to providing individuals with privacy practices and notices, health care organizations are also restricted from disclosing a patient’s health information without the patient’s consent, except for purposes of treatment, payment, or other health care operations. Information resellers and CRAs did not consider themselves to be “covered entities” under HIPAA, although some information resellers said that their customers are considered to be business associates under HIPAA. As a result, they said they are obligated to operate under HIPAA’s standards for privacy protection, and therefore could not resell medical information without having made sure HIPAA’s privacy standards were met.

Fair Credit Reporting Act (FCRA):

Congress has limited the use of consumer reports to protect consumers’ privacy. All users must have a permissible purpose under the FCRA to obtain a consumer report (15 USC 1681b). These permissible purposes are: as ordered by a court or a federal grand jury subpoena; as instructed by the consumer in writing; for the extension of credit as a result of an application from a consumer or the review or collection of a consumer’s account; for employment purposes, including hiring and promotion decisions, where the consumer has given written permission; for the underwriting of insurance as a result of an application from a consumer; when there is a legitimate business need, in connection with a business transaction that is initiated by the consumer; to review a consumer’s account to determine whether the consumer continues to meet the terms of the account; to determine a consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status; for use by a potential investor or servicer or current insurer in a valuation or assessment of the credit or prepayment risks associated with an existing credit obligation; and for use by state and local officials in connection with the determination of child support payments, or modifications and enforcement thereof.

Under FCRA, Congress has limited the use of consumer reports to protect consumers’ privacy and limits access to credit data to those who have a legally permissible purpose for using the data, such as the extension of credit, employment purposes, or underwriting insurance. However, these limits are not specific to SSNs. All of the CRAs that we spoke to said that they are considered consumer reporting agencies under FCRA. In addition, some of the information resellers we spoke to who handle or maintain consumer reports are classified as CRAs under FCRA. Both CRAs and information resellers said that as a result of FCRAs restrictions they are limited to providing credit data to their customers that have a permissible purpose under FCRA. Consequently, they are restricted by law from providing such information to the general public.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.