Medicare, the federal health insurance program that serves the nation's elderly, certain disabled individuals and individuals with end-stage renal disease, had total program expenditures of $565 billion in 2011, making it one of the largest federal programs. The Medicare program is administered by CMS and consists of four parts: A, B, C, and D. Medicare parts A and B are also referred to as fee-for-service programs. Part A covers hospital and other inpatient stays, hospice, and home health service; and Part B covers hospital outpatient, physician, and other services. The Medicare card is used as proof of eligibility for both of these programs. Part C is Medicare Advantage, under which beneficiaries receive benefits through private health plans. Part D is the Medicare outpatient prescription drug benefit. CMS requires that cards issued by Part C and Part D health plans do not display an SSN. For most individuals, SSA determines eligibility for Medicare and assigns the individual's HICN. However, for the approximately 550,000 Railroad Retirement beneficiaries and their dependents, the RRB determines Medicare eligibility and assigns this number. CMS or RRB mails paper cards to all beneficiaries, which display the individual's full name, gender, eligibility status (Part A and/or Part B), their effective date of eligibility, and the SSN-based HICN, referred to on the card as the Medicare Claim Number. (See fig. 1.) The HICN is constructed using the 9-digit SSN of the primary wage earner whose work history qualifies an individual for Medicare, followed by a 1- or 2-character code, referred to as the beneficiary identification code, that specifies the relationship of the card holder to the individual who makes the beneficiary eligible for benefits. In most cases, the SSN on the card is the card holder's own; however, approximately 14 percent of Medicare beneficiaries have cards that contain the SSN of the family member whose work history makes the beneficiary eligible for Medicare benefits. A unique identifier is an essential component for administering health insurance. Such an identifier is used by providers to identify beneficiaries and submit claims for payment. As Medicare's primary unique identifier, the HICN is used by beneficiaries, providers, and CMS and its contractors. State Medicaid programs, which are jointly funded federal- state health care programs that cover certain low-income individuals, use the HICN to coordinate payments for dual-eligible beneficiaries-- individuals who are enrolled in both Medicare and Medicaid. (See table 1 for examples of various interactions that require the HICN). Beneficiaries must use their HICN when interacting with CMS, such as when they log into the Medicare website or call 1-800-MEDICARE for assistance. Using their issued card, beneficiaries also provide this information to providers at the time of service, and providers use this information to confirm eligibility and submit claims to receive payment for services. CMS and its contractors operate approximately 50 information technology (IT) systems, many of which are interdependent, that use this information in some manner to process beneficiary services and claims and conduct a number of other activities related to payment and program-integrity efforts. These IT systems vary considerably in terms of age and interoperability, making them difficult to change. In its November 2011 report, CMS proposed three options for removing SSNs from Medicare cards. One option would involve altering the display of the SSN through truncation, and the other two options would involve the development of a new identifier. All three options would vary with regard to the type of identifier displayed on the card and the actions providers and beneficiaries would need to take in order to use the identifier for needed services. CMS officials told us that they limited their options to those retaining the basic format of the current paper card, and did not consider other options that they believed were outside the scope of the congressional request. For example, CMS did not consider using machine-readable technologies, such as bar codes or magnetic stripes. Option 1: Truncating the SSN: Under this option, the first five digits of the SSN would be replaced with 'X's (e.g., XXX-XX-1234) for display on the card. However, the full SSN would continue to be used for all Medicare business processes. As a result, when interacting with CMS, beneficiaries would need to recall the full SSN or provide additional personally identifiable information in order for CMS to match the beneficiary with his or her records. To interact with CMS, providers would also need to obtain the complete SSN using an existing resource. This would involve querying an existing database, calling a CMS help line, or asking the beneficiary for the complete SSN or other personally identifiable information. Option 2: Developing a New Identifier for Beneficiary Use: Under this option, the SSN would be replaced by a new identifier not based on the SSN that would be displayed on the card, similar to private health insurance cards. CMS refers to this new identifier as the Medicare Beneficiary Identifier (MBI). This number would be used by beneficiaries when interacting with CMS. Providers, however, would be required to continue to use the SSN when interacting with CMS and conducting their business processes. To obtain this information, providers would be expected to electronically request it from CMS using the new identifier. CMS said it would need to create a new database for this purpose. Option 3: Developing a New Identifier for Beneficiary and Provider Use: Under this option, the SSN would be replaced by a new identifier not based on the SSN, which would be displayed on the card. As in option 2, CMS referred to this number as the MBI. In contrast to option 2, however, this new number would be used by both beneficiaries and providers for all interactions with CMS. Under this option, the SSN would no longer be used by beneficiaries or providers when interacting with CMS, which could eliminate the need for providers to collect or keep the SSN on file. CMS and its contractors would continue to use the SSN for internal data purposes, such as claims processing. Table 2 summarizes the characteristics of the CMS options. CMS, SSA, and RRB reported that all three options would generally require similar efforts, including coordinating with stakeholders; converting IT systems; conducting provider and beneficiary outreach and education; conducting training of business partners; and issuing new cards. However, the level and type of modifications required to IT systems vary under each option. These systems are responsible for various business functions that perform claims processing, eligibility verification, health plan enrollment, coordination of benefits, program integrity, and research efforts. According to CMS, between 40 and 48 of its IT systems would require modifications, depending on the option selected. The truncated SSN option would require modifications to 40 systems; the option that uses a new identifier for beneficiary use would require modifications to 44 systems; and the option that uses a new identifier for beneficiary and provider use would require modifications to 48 systems. In its 2011 report, CMS estimated that any of the 3 proposed options would likely take up to 4 years to implement. During the first 3 years, CMS would coordinate with stakeholders; complete necessary IT system conversions; conduct provider and beneficiary outreach and education; and conduct training of business partners. In the fourth year, CMS would issue new Medicare cards to all beneficiaries over a 12-month period. CMS officials stated that the agency could not implement any of the options without additional funding from Congress. In its report, CMS noted that the actual time needed for implementation could vary due to changing resources or program requirements. Similar to its 2006 report, CMS has not taken action needed to implement any of the options for removing the SSN it presented in its report. DOD has taken steps to remove the SSN from display on the approximately 9.6 million military identification cards that are used by active-duty and retired military personnel and their dependents to access health care services. DOD is replacing the SSNs previously displayed on these cards with two different unique identifiers not based on the SSN. In 2008, DOD began its SSN removal effort by removing dependents' SSNs from display on their military identification cards, but retained the sponsor's SSN and left SSNs embedded in the cards' bar codes. The dependents' cards did not display any unique identifier. On June 1, 2011, DOD discontinued issuing any military identification card that displayed an SSN and began issuing cards that displayed two different unique identifiers; however, SSNs continued to be embedded in the cards' bar codes. Starting December 1, 2012, DOD will discontinue embedding the SSN in the cards' bar codes. With the exception of cards issued to retired military personnel, DOD anticipates that the SSNs will be completely removed from all military identification cards by December 2016.contain the SSN as an identifier, and because some contractors providing DOD officials reported that because retirees' cards may still health care services may continue to use the SSN for eligibility purposes and processing claims, DOD's IT systems will continue to support multiple identifiers, including the SSN, until such time as all SSNs have been replaced with the two new unique identifiers. DOD cards issued to active- duty military personnel also contain a smart chip, which is used for accessing facilities and IT systems, and may be used to access health care services in some facilities. Cardholders' SSNs are concealed in the smart chip. VA has also taken steps to remove the SSN from display on its identification and health care cards. The Veterans Identification Card (VIC) is issued by VA to enrollees and can be used by veterans to access health care services from VA facilities and private providers. In 2011, 8.6 million veterans were eligible to receive health care services and, according to VA officials, about 363,000 dependents of veterans were VA eligible to receive care through VA's dependent-care programs. began removing SSNs from display on the VIC in 2004, but the SSN continues to be embedded in the cards' magnetic stripes and bar codes. Since that time, VA officials report that the department has issued approximately 7.7 million VICs. VA officials also stated that, in the first quarter of fiscal year 2013, VA will start issuing new VICs that will display a new unique identifier for the veteran and embed the new identifier in the card's magnetic stripe and bar code, replacing the SSN. VA also removed SSNs from display on the cards issued to beneficiaries in VA dependent-care programs without replacing it with a new identifier, and beneficiaries in these programs now provide their SSN verbally at the time of service. Representatives from a national organization representing private health insurers told us that, to their knowledge, all private health insurers have removed the SSN from display on insurance cards and replaced it with a unique identifier not based on the SSN. Private insurers use these new identifiers for all beneficiary and provider interactions, including determining eligibility and processing claims. According to these officials, private health insurers took those steps to comply with state laws and protect beneficiaries from identity theft. Consistent with this, representatives from the private health insurers we interviewed reported removing SSNs from their cards' display and issuing beneficiaries new identifiers not based on the SSN, which are now used in all beneficiary and provider interactions. Officials we interviewed from DOD, VA, and private health insurers all reported that the process to remove the SSN from cards and replace the SSN with a different unique identifier is taking or took several years to implement and required considerable planning. During their transition periods, DOD, VA, and private health insurers reported that they made modifications to IT systems; collaborated with providers and contractors; and educated providers and beneficiaries about the change. One private health insurer we interviewed reported that it allowed for a transition period during which providers could verify eligibility or submit claims using either the SSN or the new unique identifier. This health insurer noted that this allowance, along with the education and outreach it provided to both beneficiaries and providers, resulted in a successful transition. Another health insurer reported that it is providing IT support for both the SSN and the new unique identifier indefinitely in case providers mistakenly use the SSN when submitting claims. Replacing the SSN with a new identifier for use by beneficiaries and providers offers beneficiaries the greatest protection against identity theft relative to the other options CMS presented in its report. (See fig. 2.) Under this option, only the new identifier would be used by beneficiaries and providers. This option would lessen beneficiaries' risk of identity theft in the event that their card was lost or stolen, as the SSN would no longer be printed on the card. Additionally, because providers would not need to collect a beneficiary's SSN or maintain that information in their files, beneficiaries' vulnerability to identity theft would be reduced in the event of a provider data breach. The other two options CMS presented in its 2011 report provide less protection against identity theft. For example, replacing the SSN with a new number just for beneficiary use would offer some protection against identity theft for beneficiaries because no portion of the SSN would be visible on the Medicare card. This would reduce the likelihood of identity theft with the SSN if a card is lost or stolen. However, providers would still need to collect and store the SSN, leaving beneficiaries vulnerable to identity theft in the event of a provider data breach. CMS's truncated SSN option would provide even less protection against identity theft. This option would eliminate full visibility of the SSN on the Medicare card, making it more difficult to use for identity theft. However, we have previously reported that the lack of standards for truncation mean that identity thieves can still construct a full SSN fairly easily using truncated SSNs from various electronic and hard copy records. In addition, under this option, providers would still store the SSN in their files, thereby making beneficiaries vulnerable to identity theft in the event of a provider data breach. We found that CMS's option to replace the SSN with a new identifier for use by beneficiaries and providers presents fewer burdens for beneficiaries and providers relative to the other options presented in CMS's 2011 report. (See fig. 3.) Under this option, the new identifier would be printed on the card, and beneficiaries would use this identifier when interacting with CMS, eliminating the need for beneficiaries to memorize their SSN or store it elsewhere as they might do under other options. This option may also present fewer burdens for providers, as they would not have to query databases or make phone calls to obtain a Private health insurers we beneficiary's information to submit claims.interviewed all reported using a similar approach to remove SSNs from their insurance cards. Representatives from these insurers reported that while there was some initial confusion and issues with claims submission during the transition period, proactive outreach efforts to educate providers about this change, as well as having a grace period during which the SSN or new identifier could be used by providers to submit claims, minimized issues and resulted in a relatively smooth transition. provider use) (Beneficiary use only) The other two options CMS presented in its 2011 report would create additional burdens for beneficiaries and providers. Beneficiaries may experience difficulties under the truncated SSN option, as they may need to recall their SSN, which could be their own SSN or that of a family member. CMS officials stated that the age of Medicare beneficiaries and the fact that their current identification number may be based on another family member's SSN could make it difficult for beneficiaries to remember the number. In addition, about 31 percent of Medicare beneficiaries residing in the community have a known cognitive or mental impairment, making recalling their number by memory potentially difficult. Under both of these remaining options, providers would need to perform additional tasks, such as querying a CMS database or calling CMS, to obtain the full SSN to verify eligibility and submit claims. Regardless of option, the burdens experienced by CMS would likely be similar because the agency would need to conduct many of the same activities and would incur many of the same costs. For example, it would need to reissue Medicare cards to current beneficiaries; conduct outreach and education to beneficiaries and providers; and conduct training for business partners. CMS would also likely see increased call volume to its 1-800-Medicare line with questions about the changes. In addition, there would likely be costs associated with changes to state Medicaid IT systems. However, according to CMS officials, the option that calls for replacing the SSN with a new identifier to be used by beneficiaries and providers would have additional burdens because of the more extensive changes required to CMS's IT systems compared to the other options. This option, however, would also potentially provide an additional benefit to CMS, as the agency would be able to completely "turn off" the identification number and replace it with a new one in the event that a beneficiary's number is compromised, something that is not possible with the SSN. CMS did not consider in its 2011 report how machine readable technologies--such as bar codes, magnetic stripes, or smart chips-- could assist in the effort to remove SSNs from Medicare cards. Machine- readable technologies have been implemented to varying degrees by DOD and VA. According to DOD and VA officials, DOD is using a smart chip and barcode to store the cardholder's personally identifiable information, and VA is issuing cards in which such information and other identifiers are stored in magnetic stripes and bar codes. Machine- readable technologies may provide additional benefits, such as increased efficiency for providers and beneficiaries. Furthermore, machine readable technologies provide some additional protection against identity theft, but officials we spoke with stated that the widespread availability of devices to read magnetic stripes and bar codes have made these technologies less secure. Because of this, both DOD and VA have plans to remove SSNs that are stored in these technologies on their cards. If CMS were to use machine-readable technologies, they could present significant challenges to providers. For example, providers could experience difficulties due to the lack of standardization across these technologies. Representatives from one private health insurer we interviewed stated that while the use of cards with magnetic stripes worked well within a small region where they have large market- penetration, implementing such an effort in regions where providers contract with multiple insurers would be more difficult due to this lack of standardization. In addition, use of machine-readable cards would likely require providers to purchase additional equipment and could be problematic for providers that lack the necessary infrastructure, such as high-speed internet connections, to make machine-readable technologies feasible. According to CMS officials, implementing machine-readable technologies may also require cards that cost more than the paper Medicare card currently in use. Removing the SSN from the Medicare card and not replacing it with a new identifier, an option also not considered in CMS's report to Congress, could reduce beneficiaries' vulnerability to identity theft, but would create burdens for beneficiaries, providers, and CMS. Complete removal of the SSN from the Medicare card would protect beneficiaries from identity theft in the event that a card is lost or stolen. However, like the truncation option, beneficiaries may have difficulty recalling their SSN at the time of service or when interacting with CMS. This could also be difficult because the SSN needed to show eligibility may not be the beneficiary's own. In addition, providers would likely need to change their administrative processes to obtain the needed information either by querying a database, calling CMS, or obtaining it directly from the beneficiary. Finally, because providers would still need to collect and store the SSN for eligibility verification and claims submission, beneficiaries would remain vulnerable to identity theft in the event of a provider data breach. The VA used this approach to remove SSNs from the approximately 363,000 dependent care program cards, and officials stated that it requires providers to obtain the SSN at the time of service. However, Medicare covers over 48 million beneficiaries who receive services from 1.4 million providers, making such a change more burdensome. In addition, CMS would still encounter similar burdens as in the options presented in its 2011 report to Congress, including the need to educate beneficiaries and providers, and issue new cards, though the extent of the necessary changes to CMS IT systems under such an option is unknown. In its 2011 report to Congress, CMS, in conjunction with SSA and RRB, developed cost estimates for the three options to alter the display of the SSN on Medicare cards or replace the SSN with a different unique identifier. CMS projected that altering or removing the SSN would cost between $803 million and $845 million. CMS's costs represent the majority of these costs (approximately 85 percent); while SSA and RRB's costs represent approximately 12 percent and 0.2 percent, respectively. (See table 3.) Approximately two-thirds of the total estimated costs (between $512 million and $554 million depending on the option) are associated with modifications to existing state Medicaid IT systems and CMS's IT system conversions. While modifications to existing state Medicaid IT systems and related costs are projected to cost the same across all three options, the estimated costs for CMS's IT system conversions vary. This variation is due to the differences in the number of systems affected and the costs for modifying affected systems for the different options. CMS would incur costs related to modifying 40 IT systems under the truncated SSN option, 44 systems under the new identifier for beneficiary use option, and 48 systems under the new identifier for beneficiary and provider use option. In addition, the cost associated with changes to specific systems varied depending on the option. CMS's estimates for all non-IT related cost areas are constant across the options. Other significant cost areas for CMS include reissuing the Medicare card, conducting outreach and education to beneficiaries about the change to the identifier, and responding to beneficiary inquires related to the new card. Both SSA and RRB would also incur costs under each of the options described in CMS's 2011 report. SSA estimated that implementing any of the three options presented in the 2011 report would cost the agency $95 million. SSA's primary costs included $62 million for responding to inquiries and requests for new Medicare cards from beneficiaries and $28 million for processing new cards mailed by CMS that are returned as undeliverable. SSA officials told us that even though CMS would be responsible for distributing new Medicare cards, SSA anticipated that about 13 percent of the beneficiary population would contact SSA with questions. RRB's costs totaled between $1.1 million and $1.3 million. Between 21 and 34 percent of RRB's total costs were related to IT system updates and changes, depending on the option. The rest of RRB's costs were related to business functions, such as printing and mailing new cards; user costs related to system and procedure changes; and education and outreach. The cost estimates included in CMS's 2011 report were as much as 2.5 times higher than those estimated in its 2006 report to Congress. CMS attributed these increases to the inclusion of costs not included in the 2006 report, such as those associated with changes to state Medicaid systems and changes to its IT systems related to Part D, as well as a more thorough accounting of costs associated with many of the other cost areas, including SSA costs. In addition, CMS said in its 2006 report that phasing in a new identifier for beneficiaries over a 5- to 10-year period would reduce costs. However, in its 2011 report, CMS stated that such an option would be cost prohibitive because it would require running two parallel IT systems for an extended period of time. There are several key concerns regarding the methods and assumptions CMS used to develop its cost estimates that raise questions about the reliability of its overall cost estimates. First, CMS did not use any cost estimating guidance when developing its estimates. GAO's Cost Estimating and Assessment Guide identifies a number of best practices designed to ensure a cost estimate is reliable. However, CMS officials acknowledged that the agency did not rely on any specific cost-estimating guidance, such as GAO's cost-estimating guidance, during the development of the cost estimates presented in the agency's report to Congress. The agency also did not conduct a complete life-cycle cost estimate on relevant costs, such as those associated with IT system conversions. CMS officials told us they did not conduct a full life-cycle cost estimate for each option because this was a hypothetical analysis, and doing so would have been too resource intensive for the purpose of addressing policy options. Second, the procedures used to develop estimates for the two largest cost categories--changes to existing state Medicaid IT systems and CMS's IT system conversions--are questionable and not well documented. For each of CMS's options, the agency estimated Medicaid Given the size of this cost category, IT changes would cost $290 million. we have concerns about the age of the data, the number of states used to generalize these estimates, as well as the completeness of the information CMS collected. For example, CMS's estimates for costs associated with its proposed changes were based on data collected in 2008, at which time the agency had not developed all of the options In addition, while CMS asked for cost data presented in its 2011 report.from all states in 2008, it received data from only five states--Minnesota, Montana, Oklahoma, Rhode Island, and Texas--and we were unable to determine whether these states are representative of the IT system changes required by all states. CMS extrapolated national cost estimates based on the size of these states, determined by the number of Medicare eligible beneficiaries in them. However, the cost of IT modifications to Medicaid systems would likely depend more on the specific IT systems and their configurations in use by the state than on the number of Medicare beneficiaries in the state. CMS was unable to provide documentation about the data it requested from states related to its cost projections, or documentation of the responses it received from states on the specific modifications to Medicaid IT systems that would be required. CMS officials also acknowledged that each state is different and their IT systems would require different modifications. For the CMS IT-system conversion costs, officials told us that CMS derived its IT-system conversion cost estimates by asking its IT system owners for costs associated with changes to the systems affected under each of the three options. However, CMS provided us with limited documentation related to the information it supplied to its system owners when collecting cost data to develop its estimates, and no supporting documentation for the data it received from system owners. The documentation CMS provided asked system owners to provide the basis for their estimates (including, for example, costs related to labor and hardware, and software changes and additions), and laid out general assumptions for system owners to consider. However, because CMS asked for estimates for broad cost categories, the data it received were general in nature and not a detailed accounting of specific projected costs. CMS officials also told us that system requirements changed over the course of their work; however, they provided no documentation related to how these changes were communicated to system owners. In addition, CMS officials told us that they generally did not attempt to verify estimates submitted by system owners. CMS could not explain how or why a number of the systems the agency believed would require modifications would be affected under its three options, or the variance in the costs to modify these systems across the options. Moreover, CMS's cost estimates for the IT-related costs in its 2011 report were approximately three times higher than the estimate in the agency's 2006 report. That report stated that the majority of changes necessary to replace the existing number with a non-SSN-based identifier would affect only two systems; however, the agency estimated in its 2011 report that up to 48 systems would require modification, depending on the option selected. Furthermore, CMS's 2006 report stated that the 2 primary IT systems affected--the Medicare Beneficiary Database and the Enrollment Database--account for $70 million, or 85 percent, of the IT-related costs. However, in the 2011 report, these 2 systems accounted for 5 percent or less of the IT-related costs, depending on the option implemented. CMS officials we interviewed were unable to explain the differences in the number of systems affected, or the costs of required modifications to IT systems between the 2006 and 2011 reports. Third, there are inconsistencies in some assumptions used by CMS and SSA in the development of the estimates. For example, CMS and SSA used different assumptions regarding the number of Medicare beneficiaries that would require new Medicare cards. According to CMS officials, the agency based its cost estimates on the number of Medicare beneficiaries at the time the report was prepared (47 million), whereas SSA officials told us the agency based its estimates on the expected number of beneficiaries in 2015 (55 million), the year they estimated the new card would likely be issued. In addition, nearly 30 percent of SSA's costs were related to processing newly-issued Medicare cards that are returned as undeliverable. However, SSA officials told us that they were not aware that CMS's cost estimates included plans to conduct an address-verification mailing at a cost of over $45 million prior to issuing new cards. Such a mailing could reduce the number of cards returned as undeliverable, and thus SSA's costs associated with processing such cards. Finally, CMS did not take into account other factors when developing its cost estimates, including related IT modernization efforts or potential savings from removing the SSN from Medicare cards. In developing its estimates, CMS did not consider ways to integrate IT requirements for removing the SSN from Medicare cards with those necessitated by other IT modernization plans to realize possible efficiencies. DOD and a private health insurer we interviewed reported that when removing SSNs from their cards, they updated their systems to accommodate this change in conjunction with other unrelated system upgrades. CMS officials told us that because many of the agency's other IT modernization plans are unfunded, the agency does not know when or if these efforts will be undertaken. As a result, the agency is unable to coordinate the SSN removal effort or to estimate savings from combining such efforts. In its report, CMS also acknowledged that if the agency switched to a new identifier used by both beneficiaries and providers, there would likely be some savings due to improved program integrity and reduced need to monitor SSNs that may be stolen and used fraudulently. However, in developing its estimates, CMS did not include any potential savings the agency might accrue as a result of removing the SSN from Medicare cards. Nearly six years have passed since CMS first issued a report to Congress that explored options to remove the SSN from the Medicare card, and five years have elapsed since the Office of Management and Budget directed federal agencies to reduce the unnecessary use of the SSN. While CMS has identified various options for removing the SSN from Medicare cards, CMS has not committed to a plan to remove them. The agency lags behind other federal agencies and the private sector in reducing the use of the SSN. DOD, VA, and private health insurers have taken significant steps to eliminate the SSN from display on identification and health insurance cards, and reduce its role in operations. Of the options presented by CMS, the option that calls for developing a new identifier for use by beneficiaries and providers offers the best protection against identity theft and presents fewer burdens for beneficiaries and providers than the other two. Consistent with the approach taken by private health insurers, this option would eliminate the use and display of the SSN for Medicare processes conducted by beneficiaries and providers. While CMS reported that this option is somewhat more costly than the other options, the methods and assumptions CMS used to develop its estimates do not provide enough certainty that those estimates are credible. Moreover, because CMS did not have well-documented cost estimates, the reliability of its estimates cannot be assessed. Use of standard cost-estimating procedures, such as GAO's estimating guidance, would help ensure that CMS cost estimates are comprehensive, well documented, accurate and credible. Moving forward, CMS could also explore whether the use of magnetic stripes, bar codes, or smart chips could offer other benefits such as increased efficiencies. Absent a reliable cost estimate, however, Congress and CMS cannot know the costs associated with this option and how to prioritize it relative to other CMS initiatives. Lack of action on this key initiative leaves Medicare beneficiaries exposed to the possibility of identity theft. In order for CMS to implement an option for removing SSNs from Medicare cards, we recommend that the Administrator of CMS select an approach for removing the SSN from the Medicare card that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS, and develop an accurate, well-documented cost estimate for such an option using standard cost-estimating procedures. We provided a draft of this report to CMS, DOD, RRB, SSA, and VA for review and comment. CMS and RRB provided written comments which are reproduced in appendixes II and III. DOD, SSA, and VA provided comments by e-mail. CMS concurred with our first recommendation to select an approach for removing the SSN from Medicare cards that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS. The agency noted that such an approach could protect beneficiaries from identity theft resulting from loss or theft of the card and would allow CMS a useful tool in combating Medicare fraud and medical identity theft. CMS also concurred with our second recommendation that CMS develop an accurate, well-documented cost estimate using standard cost-estimating procedures for an option that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS. CMS noted that a more rigorous and detailed analysis of a selected option would be necessary in order for Congress to appropriate funding sufficient for implementation, and that it will utilize our suggestions to strengthen its estimating methodology for such an estimate. DOD had no comments and did not comment on the report's recommendations. RRB stated that the report accurately reflected its input and had no additional comment. SSA provided only one technical comment, which we incorporated as appropriate, but did not comment on the report's recommendations. VA concurred with our findings, but provided no additional comments. We are sending copies to the Secretaries of HHS, DOD and VA, the Administrator of CMS, the Commissioner of SSA, the Chairman of RRB, interested congressional committees, and others. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have questions about this report, you may contact us at: Kathleen King, (202) 512-7114 or kingk@gao.gov or Daniel Bertoni, (202) 512-7215 or bertonid@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Burdens of CMS's Proposed Options for Removal of SSN from Medicare Card (Accessible Text) provider use) (beneficiary use only) Social Security number (SSN) While any change to the beneficiary identifier could cause initial confusion for beneficiaries, this option creates no additional burden for the beneficiary because the number on the card would be used to receive services and interact with CMS. While any change for the beneficiary identifier could cause initial confusion for beneficiaries, this option creates no additional burdens to the beneficiary because the number on the card would be used to receive services and interact with CMS. While any change to the beneficiary identifier could cause initial confusion among providers, this option would not create additional burdens for the provider, as the provider would be able to obtain the number from the card provided by the beneficiary. Kathleen King, (202) 512-7114 or kingk@gao.gov or Daniel Bertoni, (202) 512-7215 or bertonid@gao.gov. In addition to the contacts named above, the following individuals made key contributions to this report: Lori Rectanus, Assistant Director; Thomas Walke, Assistant Director; David Barish; James Bennett; Carrie Davidson; Sarah Harvey; Drew Long; and Andrea E. Richardson.

Summary:
More than 48 million Medicare cards display the SSN, which increases Medicare beneficiaries' vulnerability to identity theft. GAO was asked to review the options and associated costs for removing SSNs from the Medicare card. This report (1) describes the various options for removing the SSN from Medicare cards; (2) examines the potential benefits and burdens associated with different options; and (3) examines CMS's cost estimates for removing SSNs from Medicare cards. To do this work, GAO reviewed CMS's report, cost estimates, and relevant supporting documentation. GAO also interviewed officials from CMS and other agencies that perform Medicare related activities (the Social Security Administration and Railroad Retirement Board), as well as officials from DOD and VA, which have undertaken SSN removal efforts. GAO also interviewed private health insurance companies and relevant stakeholder groups. The Centers for Medicare & Medicaid Services' (CMS) 2011 report to Congress proposed three options for removing Social Security numbers (SSN) from Medicare cards. One option would truncate the SSN displayed on the card, but beneficiaries and providers would continue to rely on the SSN. The other two options would replace the SSN with a new identifier that would be displayed on the card and either be used only by beneficiaries, or by both beneficiaries and those who provide Medicare services. CMS, however, has not selected or committed to implementing any of these options. The Departments of Defense (DOD) and Veterans Affairs (VA), and private insurers have already removed or taken steps to remove SSNs from display on their identification or health insurance cards. CMS's option to replace the SSN with a new identifier for use by both beneficiaries and providers offers the greatest protection against identity theft. Beneficiaries' vulnerability to identity theft would be reduced because the card would no longer display the SSN and providers would not need the SSN to provide services or submit claims (negating the need for providers to store the SSN). This option would also pose fewer burdens than the other two options because beneficiaries would not have to remember an SSN to receive services or to interact with CMS. Providers also would not need to conduct additional activities, such as querying a CMS database, to obtain the SSN. The burdens for CMS would generally be similar across all the options, but CMS reported that this option would require more information technology (IT) system modifications. CMS reported that each of the three options would cost over $800 million to implement, and that the option to replace the SSN with a new identifier for use by both beneficiaries and providers would be somewhat more expensive, largely because of the IT modifications. However, the methodology and assumptions CMS used to develop its estimates raise questions about their reliability. For example, CMS did not use appropriate guidance, such as GAO's cost-estimating guidance, when preparing the estimates to ensure their reliability. Additionally, CMS could provide only limited documentation related to how it developed the estimates for the two largest cost areas, both of which involve modifications to IT systems. GAO recommends that CMS (1) select an approach for removing SSNs from Medicare cards that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS and (2) develop an accurate, well-documented cost estimate for such an option. CMS concurred with our recommendations. VA, DOD, and RRB had no substantive comments. SSA had a technical comment.