The use of SSNs on identification cards by federal, state, and private organizations, such as health insurance companies, was prevalent until the early 2000s. However, many organizations have since replaced these types of identification cards with those that do not contain SSNs. This step was taken, in large part, in response to certain federal and state laws that place restrictions on entities’ use and disclosure of consumers’ personal information, including SSNs. Examples of federal laws include the Driver’s Privacy Protection Act, which generally prohibits a state department of motor vehicles from disclosing or otherwise making available SSNs and other personal information from a motor vehicle record, and the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations, which protect the privacy of health information that identifies an individual (including by SSNs) and restricts health care organizations from disclosing such information to others without the patient’s consent. Additionally, several state statutes include provisions related to restricting the display of SSNs, their unnecessary collection, and their disclosure without the individual’s consent. Many state agencies have discontinued the use of the numbers on identification cards and other documents, such as driver’s licenses, to comply with such laws. Similarly, private sector health insurers have discontinued use of SSNs on insurance cards in an effort to protect beneficiaries’ personal health information. The numbers on the VA cards are identification numbers that allow beneficiaries to access facilities; the cards are not insurance cards. DOD’s cards are also used primarily for identification purposes, and are not insurance cards. the numbers in magnetic stripes on the cards. However, both DOD and VA continued to use the number as an identifier and have described other steps they are taking to better protect beneficiaries against theft or improper use of the numbers. Specifically, DOD officials stated that the department is in the process of developing and implementing a solution for removing embedded SSNs from the bar codes on military identification cards and replacing them with a new identifier; they plan to complete this project in late 2016. Additionally, VA is working to remove the number embedded in magnetic stripes because of increased security risks introduced by the prevalence of electronic readers on devices such as smart phones; it plans to complete this project in late 2016. Since the inception of Medicare in 1965, CMS and its program stakeholders—SSA, the Railroad Retirement Board, and state Medicaid programs—have used an SSN-based identifier when filing and processing fee-for-service claims, and when exchanging data related to the Medicare program. This number, referred to as the Health Insurance Claim Number (HICN), is displayed on Medicare beneficiaries’ health insurance cards. Individuals’ eligibility to participate in the Medicare fee-for-service programs is initially determined by SSA, based on factors such as age, work history, contributions made to the programs through payroll deductions, and the presence of certain medical conditions. Once SSA determines that an individual is eligible, it provides information about the individual to CMS, including the SSN and a 1- or 2-digit beneficiary identification code.Enrollment Database—the repository of data about individuals who are or have ever been on Medicare. This system combines these two data fields to create the 10- or 11-digit HICN. CMS prints and issues to the individual These data are transmitted to and stored in CMS’s a paper identification card (similar to the example shown in fig. 1) that displays the HICN (i.e., the Medicare claim number), the cardholder’s full name, his or her gender, and the effective dates of Medicare program eligibility. The HICN is maintained and referenced throughout CMS’s IT environment. For example, health care providers may reference Medicare beneficiaries’ printed cards at the point of care to determine eligibility for the fee-for-service program. Providers may then query a CMS system using the HICN printed on the card, along with other demographic data, to obtain information regarding eligibility for specific treatments or services they intend to deliver, such as glaucoma screening or smoking cessation counseling. Specifically, the agency provides verification services through its HIPAA Eligibility Transaction System (HETS), which allows providers to access real-time data regarding beneficiaries’ eligibility at the point at which care is scheduled or delivered. Likewise, providers are required by CMS to use the number when they submit claims to receive payment for those treatments and services. CMS’s and its contractors’ systems also process data based on the HICN to check for duplicate claims, apply claims and medical policy edits, issue Medicare Summary Notices, authorize or deny payment of claims, and conduct printing and mailing operations. For example, CMS’s Medicare Administrative Contractors, who are responsible for processing and paying claims, use their own systems to determine whether fee-for- service claims meet certain requirements, such as completeness of data. Specifically, if a claim did not include the HICN or other required data, the contractor’s system would return it to the provider as incomplete or invalid. The shared systems are the Fiscal Intermediary Shared System, which processes part A claims; the Multi-carrier system, which processes part B claims; and the ViPS Medicare System, which is used to process claims for durable medical equipment. including HETS, on a daily basis. These data are used to update those systems’ databases. In addition to using the HICN to support the provision of and payment for health care to Medicare beneficiaries, CMS and its federal stakeholders, SSA and the Railroad Retirement Board, use the number to share data needed to coordinate health insurance coverage and payments for premiums. In this regard, CMS provides information that includes the number to SSA when beneficiaries’ eligibility status or other data change, and SSA refers to the HICN when beneficiaries request replacement of lost Medicare cards. CMS also shares data that include the number with the Railroad Retirement Board when it administers health benefits for railroad retirees who are eligible for Medicare. Further, CMS and the 56 state and territorial Medicaid programs share data based on beneficiaries’ HICNs. Specifically, these programs provide the number along with other data on their beneficiaries that are used to help identify individuals who are eligible for both Medicare and Medicaid benefits. The states also provide information regarding Medicaid beneficiaries for whom their programs pay Medicare Part A or B premiums. In turn, CMS provides several types of data to the Medicaid programs based on the HICN, including data needed to coordinate payment for claims when a beneficiary is covered by multiple insurers and information on the current drug prescription insurer for beneficiaries who are covered by Medicare Part D private plans. Figure 2 depicts a simplified view of the flow of data and the use of the HICN in CMS’s and its stakeholders’ systems. In 2010, CMS officials developed a plan to upgrade the agency’s IT environment and noted that the modernization of enterprise information systems and the supporting infrastructure was necessary in order for CMS to continue to meet its mission. Further, two scientific advisory committees that later evaluated CMS’s IT environmentagency operated in a “stove-piped” environment in which many systems were developed to meet specific time-sensitive and legislatively driven needs, such as claims processing and eligibility determination, without consideration of the need for systems to interoperate or integrate data from other sources. The committees indicated that, because the agency continues to operate in such an environment, enhancement and sharing of data across its systems can be costly, risky, and time-consuming. In 2013 the agency took steps to update the 2010 IT modernization plan. According to officials in the Office of Information Services, this was to address recommendations resulting from the two advisory committees’ evaluations. These officials described seven goals of the plan, the first of which is to establish an architecture that supports the development and implementation of IT functions, known as “shared services,” that can be provided to support multiple needs of organizations conducting business within or between federal agencies. limited to, the transformation of the agency’s IT operations to enable CMS to use technologies such as cloud computing and virtual data centers; improvements to privacy and security controls to better protect personal health information stored and processed by the agency; and the transition to a coordinated, enterprise approach toward developing and implementing IT solutions. The Chief Information Officer stated that the agency was continuing to work toward addressing the seven goals defined in 2013. Use of shared services can be cost efficient because when a service is reused by multiple IT systems, initial system development costs occur once, and these costs can be avoided each time the service is reused. In addition, use of shared services promotes standardization and interoperation of data and can reduce stove piping. Both the SSA and HHS inspectors general have reported on risks associated with the use of the SSN on Medicare cards and have recommended that SSA and CMS work toward identifying alternate identifiers to better safeguard Medicare beneficiaries’ SSNs. Additionally, we have previously issued reports that addressed federal agencies’ use and display of SSNs on identification cards and for other purposes, as well as CMS’s study of this issue. In a 2004 study, we found that SSNs were widely exposed to view in a variety of public records, particularly those held by state and local governments, and appeared in some public records nearly everywhere in the nation. in identity thefts, and that the widespread use and retention of the number by both the public and private sectors may provide opportunities for criminals to easily obtain and misuse this personal information. We stressed that the display of nine-digit SSNs on such cards, which may need to be carried and must often be disclosed, puts cardholders at risk for identity theft due to the increased potential for accidental loss, theft, or visual exposure. To help mitigate this risk, we recommended that the Office of Management and Budget (OMB) identify those federal activities that require or engage in the display of SSNs on health insurance, identification, or any other cards issued to federal government personnel or program beneficiaries, and devise a governmentwide policy to ensure a consistent approach to this type of display. In response to our recommendation, in May 2007 OMB issued a memorandum that required federal departments to establish a plan to eliminate unnecessary use of SSNs. GAO, Social Security Numbers: Governments Could Do More to Reduce Display in Public Records and on Identity Cards, GAO-05-59 (Washington, D.C.: Nov. 9, 2004). SSNs shared with contractors by private companies. We also reported in 2006 that the threat of identity theft was heightened by the visual display of SSNs on federal identification cards. We noted that there were gaps in federal and state agencies’ practices for protecting SSNs and that Congress was still considering actions to address the issues that remain. More recently, in 2012 we assessed the results of CMS’s 2011 study of the cost and effort associated with three approaches to removing SSNs from Medicare cards. As a result of our assessment, we reported in August 2012 that CMS had not committed to removing the SSNs and lagged behind other federal agencies. We recommended that the agency select an approach for removing the SSN from the Medicare card that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS. We also recommended that it develop an accurate, well-documented cost estimate for such an option using standard cost-estimating procedures. CMS officials concurred with our recommendations and, as discussed later in this report, took actions to address them. CMS has not yet taken steps needed to select and implement a technical solution for removing SSNs from Medicare cards. Since 2006, the agency has conducted three studies on potential approaches to replacing the SSN-based Medicare identifier, issuing reports to Congress on the results of those studies in October 2006, November 2011, and May 2013. However, while each of the studies addressed, at a high level, the impact of various approaches on CMS’s IT environment, they were not intended to identify a specific technical solution for removing SSNs from cards. Specifically, according to CMS, a 2006 study was initiated in response to congressional concerns regarding identity theft and expectations that the Secretary of Health and Human Services would accelerate ongoing plans to convert the HICN to a non-SSN based identifier for display on Medicare beneficiaries’ health insurance cards. The second study was conducted to respond to congressional requests for CMS to re-examine approaches and costs of removing the SSN from the cards. Officials in the Office of Information Services, the CMS entity that would be responsible for identifying and implementing a technical solution for SSN removal, stated that the 2006 and 2011 studies were intended to develop “rough order of magnitude” estimates of costs and efforts associated with a potential SSN removal project. In response to a request by congressional committee members and to address our August 2012 recommendation, the agency initiated a third study in August 2012 and issued the resulting report to Congress in May 2013. According to CMS officials, the third study was conducted to provide cost estimates that were more reliable than those previously reported. The new estimates for two approaches documented in the 2013 report were approximately $255 million and approximately $317 million, including the cost of efforts to develop, test, and implement modifications that would have to be made to the agency’s IT systems. The costs of the IT-related efforts for the two approaches were estimated at about $26 million (10 percent of the $255 million total estimated cost) and $64 million (20 percent of the $317 million total estimated cost), respectively.According to the May 2013 report, the estimates were based on the assumption that these efforts would span an 18-month period, from October 2013 to April 2015. According to Office of Information Services officials, however, these costs and schedules represented high-level estimates based on the two overall approaches and did not fully reflect the effort that would be required to implement a specific IT solution. Furthermore, while the 2013 report noted that one of the two approaches would better protect beneficiaries’ personal information, the officials said that the agency did not intend for this study to result in the identification of an IT solution to address SSN removal. CMS officials stated that any initiatives specifically intended to identify an IT solution to address SSN removal would need to be conducted in accordance with departmental processes and requirements for managing the life cycle of IT projects. In this regard, CMS’s IT project life-cycle management guidance, the Expedited Life Cycle (XLC) framework, defines the activities that are required to execute and monitor the development of IT projects throughout five phases—project initiation, requirements analysis and design, development and test, implementation, and operations and maintenance. The framework requires the following activities to be completed as part of a project initiation phase before the IT organization takes subsequent steps to identify technical solutions that support business needs: designate a business owner to serve as an advocate for the project; identify a business need for which a technological solution is required and a business case is established; explore alternative concepts and methods to satisfy the need; develop and approve initial project cost, preliminary schedule, performance baseline, and basic business and technical risks; conduct a preliminary enterprise architecture review to determine whether the proposed project potentially duplicates, interferes with, contradicts, or can leverage another project that already exists or is proposed, under development, or planned for near-term disposition; identify significant assumptions and constraints on solutions relative to that need; issue a project charter; and conduct a selection review to determine if the proposed project is sound, viable, and worthy of funding, support, and inclusion in the information technology project portfolio. However, CMS has not taken a number of the key steps called for by the IT project life-cycle management guidance to identify an IT solution to address SSN removal and has not made plans to do so. For example, it has not completed several steps of a project initiation phase, such as designating a business owner who would submit a request to the Chief Information Officer to initiate an IT project. Additionally, the agency has not established a business case for developing an IT solution to address SSN removal, issued a project charter, or presented a potential IT project for SSN removal to an architectural review board for preliminary review and approval. Furthermore, CMS has not conducted a selection review to determine if such an IT project should be included in its portfolio of IT investments. Nonetheless, when conducting the 2013 study, agency officials undertook activities that could address certain steps called for by the agency’s IT project life-cycle management processes for initiating a project, and that could provide information needed for identifying and implementing a technical solution, including the following: CMS officials and program stakeholders explored alternative concepts for addressing the business need, which is one of the steps called for by agency IT project management guidance. Specifically, from September 2012 through December 2012, Railroad Retirement Board and SSA officials participated in work groups with CMS to determine potential approaches to SSN removal. As a result, they identified two approaches: (1) replacing the SSN-based HICN with a new identifier that does not include the SSN, referred to as the Medicare Beneficiary Identifier; and (2) truncating the first five digits of the SSN for display on Medicare cards. Agency officials conducting the study ruled out other options, such as embedding the number in smart cards or magnetic strips, because they were determined to be too costly, technically infeasible, or burdensome to providers and beneficiaries. Project officials collected information that could be used to develop initial project costs and identify basic business and technical risks associated with implementing each approach. Specifically, officials conducting the 2013 study collected data that could be used for establishing a technical baseline for cost estimates, such as the level of effort system owners estimated would be required for each life- cycle phase. Project officials also collected input from system and business owners regarding technical and business risks associated with the two approaches. For example, the owners of one of the shared systems described a risk that unacceptable processing times would result from the implementation of a mechanism for translating between the HICN and a new identifier. This information could be useful in identifying efficient translation mechanisms that would be less likely to introduce such a risk. Agency officials took steps to determine the changes that would have to be made throughout the agency’s and program stakeholders’ IT environment. The results of these actions could provide information essential to conducting a preliminary enterprise architecture review— another step required for initiating an IT project. Specifically, officials conducting the 2013 study identified internal and external stakeholder systems that could be affected if the SSN was removed from cards, and identified other IT initiatives that could be coordinated with an SSN removal project. For example, during the 2013 study, CMS system and functional-level business owners conducted high-level impact assessments of the two approaches on the agency’s business processes and all systems identified in its information technology inventory. Of CMS’s more than 200 systems, these officials identified 72 systems that could be affected by the introduction of a new identifier and 41 that would be affected by the second approach (masking the first 5 digits of the SSN). They conducted high-level assessments of the types of changes that would need to be made to those systems, including the level of complexity of the changes, the number of hours of work at each life-cycle phase, and the potential to leverage related efforts. Appendix II provides a detailed assessment of the types of system changes that would have to be made to three internal CMS systems that provide functionality key to determining beneficiaries’ eligibility for specific treatments and services, validating and adjudicating Part A claims, and sharing data for coordination of benefits payment between Medicare and program stakeholders. Agency officials also established assumptions regarding the two approaches for SSN removal. For example, when collecting data regarding the impact on its internal systems, system owners were instructed to assume that a crosswalk service would be available to translate the HICN to a new identifier, and that the new identifier would retain the same length as the existing HICN but have a different format. CMS officials also established assumptions regarding conditions under which data exchanged with external stakeholders would include either number. CMS collected data from its federal partners to estimate the impact of the proposed approaches on external systems. For example, officials conducting the 2013 study collected level-of-effort estimates from SSA and the Railroad Retirement Board for implementing changes to their affected systems. Although their estimates varied, the changes these stakeholder officials described were similar. SSA officials stated that they would have to make system changes to identify beneficiaries when they contact SSA and provide the new identifier, instead of the HICN, to request a new Medicare card. Railroad Retirement Board officials also stated that they would have to make changes in order to use the new identifier instead of the HICN when issuing or replacing retirees’ Medicare cards. CMS also involved state program stakeholders and collected high- level estimates of changes that would have to be made to states’ Medicaid systems. Because each state implements IT solutions to support its unique Medicaid program, the design, implementation, and level of effort estimated to modify their systems varied widely. For example, we assessed Medicaid program estimates provided to CMS by eight states. Of these, three states estimated that less than 500 hours would be needed to make the changes, in part because some of the systems already convert identifiers. One of these states reported that no effort would be required since their systems were already capable of updating records when changes to identifiers are made. On the other hand, officials with another state Medicaid program estimated that about 22,000 hours of effort would be needed to, among other things, expand databases to include a new identifier, and another estimated that over 58,000 hours would be required to modify systems to process functions based on a new identifier, including Medicare buy-in, eligibility determination, and Part D processing systems. Three other states estimated around 4,000 hours of work to implement mechanisms to cross reference or convert the HICN to a new identifier. While the data and information collected during the 2013 study could be leveraged to support a future IT project to address SSN removal, according to officials with CMS’s Office of Information Services, the agency’s Chief Information Officer has not received direction from CMS’s leadership to submit a proposal for an IT project that would lead to the identification, development, and implementation of a technical solution. We have noted in prior reports the importance of protecting Medicare beneficiaries from increased risks of identity theft, and OMB has required federal agencies to take steps to eliminate unnecessary uses of SSNs. We have also noted that federal agencies’ Chief Information Officers are responsible for, among other key IT management areas, information security along with systems development and integration. Additionally, CMS has designated the Office of Information Services as the lead for developing and enforcing the agency’s IT policies, standards, and practices. As such, these entities should play an active role in pursuing IT solutions for securing personal data, such as Medicare beneficiaries’ SSNs. The data and information the Office of Information Services collected during the 2013 study could provide valuable input to future efforts to define such a solution. Nonetheless, until the agency designates a business owner, establishes a business case, issues a project charter, and conducts architectural and IT project selection reviews for SSN removal, it will lack sufficient information and resources needed to actively pursue the identification of an IT solution for SSN removal that best protects beneficiaries’ identities. CMS has efforts under way to modernize its IT systems, a number of which could be leveraged to facilitate the removal of SSNs from Medicare cards. For example, one of the agency’s modernization goals is to establish IT functionality that can be used to support multiple business needs of organizations and facilitate data sharing among the agency and its stakeholders. This and other goals were described by Office of Information Services officials who indicated that the agency is in the process of developing an agencywide IT modernization strategy to align with newly defined business goals. A well-defined modernization strategy includes plans for systems that are integrated into an enterprise’s IT environment and that do not duplicate other systems’ functionality. By planning accordingly, agencies increase the likelihood that they will design and develop systems that easily exchange information with other systems and improve their ability to modernize systems in a timely and cost-effective manner. In this regard, CMS has initiated actions that could eliminate duplicative programming efforts and help establish standards for integrating new systems and making the modifications to existing systems needed to implement an IT solution for SSN removal. For example, CMS officials with the Office of Information Services described modernization projects that were initiated to support administrators’ ability to carry out other programs and that were aligned with the first of the seven stated modernization goals—to establish an IT architecture capable of supporting the development and implementation of shared services. Specifically, the agency established such an architecture to implement five shared services to support the administration of other agency programs, including but not limited to, programs established by the Affordable Care Act. The shared services are Enterprise Identity Management, which is planned to enable individuals to use a single online identity (e.g., user ID) for engaging in business with CMS that meets all federal security requirements; Master Data Management, which is a suite of data records and services that will allow CMS to link and synchronize beneficiary, provider, and organization data to multiple disparate sources; Enterprise Portal, a central channel for beneficiaries, providers, organizations, and states to receive CMS information, products, and services via consistent web pages; Business Rules Enterprise Service, which provides a framework for automating and managing decision logic and routines for CMS programs (e.g., provider and beneficiary cross check for Accountable Care Organization programs); and Enterprise Eligibility, a consistent and reusable way for business applications to access beneficiary eligibility data for a variety of uses (e.g., claims processing, providers and plans, and external programs). In implementing these services, the agency has taken some steps that could help define and put into place the necessary architectural components and standardized interfaces to enable sharing of the services’ capabilities across the IT infrastructure and CMS’s business areas. One of the five shared services that CMS implemented, the Business Rules Enterprise Service could facilitate the implementation of an IT solution for SSN removal. For example, the IT infrastructure that was established to implement the service could support the implementation of a crosswalk service needed by multiple systems to translate a new identifier to the HICN (and vice versa). By providing this functionality through a shared service, the crosswalk would be available for use by any system within CMS’s IT infrastructure and therefore eliminate the need to duplicate programming efforts for each system to implement such functionality. Specifically, if such a shared service were implemented to support an SSN-removal IT project, it would be available for use by all the systems that, according to CMS officials, would have to be modified to use a new identifier. As a result, of the 20 systems that the agency estimated would account for 86 percent of the costs to modify, systems changes would only have to be developed and tested for one implementation rather than for 18 of the 20 systems that would need to perform a crosswalk between a new identifier and the existing HICN. In addition to the five shared services described, another shared service, the Beneficiary Data Streamlining service, was designed to consolidate into one system the functionality for determining fee-for-service eligibility that is currently implemented in four different systems (the Common Working File and the three shared systems). This new service, which is planned to be implemented in October 2013, would be used by these systems to eliminate duplicate or unnecessary processing. Consequently, the implementation of the service could also facilitate SSN removal efforts. For example, it could reduce the extent of modifications that would have to be made to the four systems by eliminating the need to make changes to their current eligibility determination functions to process a new non-SSN-based identifier. Instead, that capability would be provided by the new service. As a result, the agency could save unnecessary costs and efforts associated with duplicative programming changes to the four affected systems. While these projects could offer opportunities for leveraging ongoing modernization initiatives to facilitate SSN removal, CMS officials stated that because the agency has not yet established a business case and IT project for removing SSNs from Medicare cards, they have not included shared services or other IT initiatives in their modernization activities and related plans to specifically support changes needed as a result of SSN removal. Until CMS establishes an IT project for SSN removal that could be incorporated into ongoing agencywide modernization initiatives, it may miss opportunities to leverage other ongoing system development activities that could facilitate efforts to design, develop, and implement an IT solution in a timely and cost-effective manner. While CMS has spent time and resources over the past 7 years studying approaches that could be taken toward removing the SSN from Medicare beneficiaries’ cards, the agency has not actively established and pursued a goal to identify an IT solution for doing so. The efforts made thus far by CMS and its stakeholders could provide some of the information needed to initiate an IT project to design and develop the system changes that would have to be made to address an agencywide effort to better safeguard Medicare beneficiaries’ identity. However, until the agency takes other critical steps, such as designating a business owner, establishing a business case, issuing a project charter, and conducting architectural and IT project selection reviews, it will not be in a position to design, develop, and implement the changes that would have to be made to systems affected by the removal of SSNs from display on Medicare beneficiaries’ health insurance cards. Additionally, the agency may miss opportunities to improve the timeliness and cost effectiveness of any actions taken to develop and implement a technical solution that could be achieved if it incorporated such actions into plans for ongoing enterprisewide IT modernization initiatives. To better position the agency to efficiently and cost-effectively identify, design, develop, and implement an IT solution that addresses the removal of SSNs from Medicare beneficiaries’ health insurance cards, we recommend that the Administrator of CMS take the following two actions: direct the initiation of an IT project for identifying, developing, and implementing changes that would have to be made to CMS’s affected systems, including designating a business owner and establishing a business case, issuing a project charter, and conducting project selection and architectural reviews of proposed approaches for the removal of SSNs from Medicare beneficiaries’ cards; and incorporate such a project into plans for ongoing enterprisewide IT modernization initiatives. In written comments on a draft of this report, signed by HHS’s Assistant Secretary for Legislation (and reprinted in appendix III), HHS stated that it appreciated the opportunity to review the report prior to its publication. Further, the department stated that it concurred with both of our recommendations under the condition that certain constraints were addressed. With respect to our first recommendation, HHS agreed that removing the SSN from Medicare cards is an appropriate step toward reducing the risk of identity theft, but that the agency could not make a decision to proceed with such a project without agreement from SSA and the Railroad Retirement Board. In addition, the department stated that a clear source of funding for both IT and non-IT activities associated with SSN removal would need to be identified before proceeding. However, as we noted in our report, CMS’s Chief Information Officer and the Office of Information Services should play an active role in pursuing IT solutions for securing personal data, such as Medicare beneficiaries’ SSNs. For this reason, it is important that CMS determine the appropriate actions to take toward initiating an IT project for addressing the removal of SSNs from cards and guide its stakeholders, such as SSA and the Railroad Retirement Board, in taking the steps needed to achieve the goals of any SSN removal project. In addition, the final step of the IT project initiation phase, as defined by CMS’s IT life-cycle project management guidance, is a review to determine if proposed projects are worthy of funding and inclusion in an IT project portfolio. Accordingly, uncertainties regarding a clear source of funding should not constrain CMS from taking steps to initiate an IT project to address SSN removal. Regarding our second recommendation, HHS concurred, again with the caveat that the above-mentioned constraints were addressed. The department also noted that while CMS had not implemented its shared services initiative specifically for the purpose of SSN removal, the general functionality exists in the shared services to support this effort, and this was reflected in the agency’s 2013 cost estimate. However, unless the agency considers SSN removal as part of its enterprisewide modernization initiative, it may miss additional opportunities for leveraging system changes being made as part of the modernization to support SSN removal. In this regard, we believe that CMS is currently positioned to implement both our recommendations, regardless of perceived constraints, and to take the actions needed to initiate an IT project as part of its agencywide modernization initiative. If such actions are taken CMS could improve HHS’s ability to protect Medicare beneficiaries against increased risk of identity theft introduced by the use of SSNs on Medicare cards. HHS also provided technical comments, which we incorporated into the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS and interested congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The objectives of our review were to (1) assess the actions the Centers for Medicare and Medicaid Services (CMS) has been taking to identify and implement information technology (IT) solutions for removing Social Security numbers (SSN) from Medicare beneficiaries’ cards, and (2) determine whether CMS’s ongoing information technology modernization initiative could offer opportunities to facilitate efforts to remove the SSN from the cards. To determine the extent to which CMS has been taking steps to implement a technical solution for removing the SSN from Medicare cards, we examined studies conducted by agency officials in 2006, 2011, and 2013 of different approaches. We reviewed supporting documents that were used by project officials to gather information from system and business owners regarding the impact that two approaches would have on the agency’s IT systems, including estimates of the levels of effort that would be needed to implement the changes that would have to be made to affected systems. We assessed the data from these documents, referred to as “workbooks,” to determine the steps agency officials took that could be used to identify a technical solution for the two approaches– one to introduce a new identifier that does not include the SSN and another to mask the first five digits of the SSN in the existing SSN-based identifier, the Health Insurance Claim Number (HICN). We determined which activities resulted in outcomes that could be used to initiate actions towards identifying a specific technical solution by comparing documented results of CMS’s efforts to requirements defined by CMS’s processes for managing information technology projects to develop and implement technical solutions for business processes. To better understand the extent of changes that would have to be made to the systems, we assessed a sample of the systems that the agency identified as being affected by the removal of the SSN from cards and replacement with a unique, non-SSN-based number. To select the systems for our sample, we obtained and analyzed system impact workbooks for 29 systems that we determined accounted for over 90 percent of the total estimated level of effort needed to modify existing systems to process the new identifier. Based on our assessment, we determined that these systems provided adequate examples of the types of system modifications that would be required to implement a technical solution for agencywide efforts to remove the SSN from Medicare cards. Additionally, we focused our analysis of the data included in the workbooks on the option to replace the SSN-based identifier, the HICN, on the Medicare card with a new identifier since findings resulting from our prior assessment of CMS’s 2011 report on SSN removal established this option as the one most likely to protect beneficiaries’ SSNs and help prevent identify theft. From the 29 systems, we selected 3—1 system that represented a low level of effort based on the estimated levels of effort reported by system and business owners in the workbooks, 1 that represented a high level of effort, and 1 of the shared systems that performs a critical function—fee-for-service claims processing. To determine the types of changes that would have to be made to the systems, we examined technical documents to identify architectural components, data types, message formats, and interfaces with other systems that would have to be modified to either translate a new identifier to the HICN for internal processing, or translate the HICN back to the new identifier for purposes such as printing notices or new cards. We also held discussions with owners of the selected systems to confirm our understanding of the systems and related files and databases, along with the functionality they provide. In addition, we held discussions with CMS officials from the agency’s Office of Information Services, including the Chief Information Officer, regarding actions taken to complete the 2013 study, particularly steps taken to collect information regarding the impact on CMS’s existing IT systems. To further address the first objective, we determined the extent to which CMS involved stakeholders to estimate the levels of effort that would have to be made to address the two approaches for removing the SSN from Medicare cards. To do so, we reviewed documentation that described the actions CMS took to solicit input from its federal Medicare and state Medicaid program stakeholders, such as CMS’s most recent report to Congress and documented results of stakeholders’ assessment of the impact the SSN removal would have on their systems. We obtained and analyzed such documentation from the Social Security Administration and the Railroad Retirement Board, CMS’s two federal program stakeholders. To select states for our study, we examined documents that were provided by 49 states and the District of Columbia in response to CMS’s request for data related to the system changes that would have to be made. We then calculated the median level of effort estimated and selected states whose estimates represented high, medium, and low levels of effort. Specifically, we identified the 3 states that estimated the highest level of effort, 4 states that estimated a medium (or closest to the median) level of effort, and the 3 that estimated the lowest level of effort. Of the 10 that we selected, we received responses from 8—the 3 lowest, 3 of the medium, and 2 of the highest estimators. We assessed the data they provided to CMS and collected additional data by conducting semistructured interviews or through written responses to a standard set of questions. While we could not generalize the information we collected from the 8 states to reflect the level of participation by all 49 states and the District of Columbia, the views obtained from these state officials offered insights into the extent to which CMS involved its program stakeholders in assessing approaches for removing SSNs. We also held discussions with program stakeholders from each of the federal and state entities. See Government Performance and Results Act of 1993, Pub. L. No. 103-62, 107 Stat. 285 (1993), as amended by the GPRA Modernization Act of 2010, Pub. L. No. 111-352, 124 Stat. 3866 (2011); Office of Management and Budget, Management of Federal Information Resources, Circular A-130 (Washington, D.C.: Nov. 28, 2000), and Planning, Budgeting, Acquisition, and Management of Capital Assets, Circular A-11, Part 7 (Washington, D.C.: July 2003). services, one of the modernization goals described by the Chief Information Officer and officials from the Office of Information Services. We then compared information obtained from this plan to descriptions of modifications to systems that would have to be made if the SSN were removed from cards. We also reviewed documentation provided to the Office of Information Services by the owners of these systems to identify other IT projects that could facilitate the development and implementation of a technical solution for an SSN removal effort. We interviewed CMS officials, including the Chief Information Officer, to obtain additional information regarding the agencywide IT modernization goals and objectives and the extent to which the goals and objectives addressed the removal of SSNs from Medicare cards. For each of the objectives, we assessed the reliability of the documentation we received from CMS, including the workbooks and technical documentation, by obtaining corroborating evidence through interviews with the agency’s system and business owners who were knowledgeable of the various systems, the individuals who were responsible for filling out the workbooks at the states, and individuals knowledgeable about CMS’s modernization efforts, including the Chief Information Officer. Based on how we used the information and the corroborating evidence provided in the interviews, we determined that the documentation and data provided by the agency were sufficiently reliable for the purposes of our review. We conducted this performance audit from October 2012 to September 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We selected three systems for assessment to better understand the types of changes that would have to be made to process beneficiary data based on the introduction of a new identifier, or Medicare Beneficiary Identifier (MBI), to replace SSNs as data entered into the systems. The three systems are the HIPAA Eligibility Transaction System (HETS), the Fiscal Intermediary Standard System (FISS), and the Medicare Beneficiary Database Suite of Systems (MBDSS). (See app. I for a description of the methodology used to select and assess the systems.) The following tables provide descriptions of the systems and the functionality they provide, the number of hours that owners of the systems estimated would be required to modify the systems, and a summary of the technical characteristics and components (e.g., the programming languages and tools, software applications, data bases, data storage files, and outcomes of data processing) that would have to be considered in estimating the impact of removing SSNs from Medicare cards on these systems. Our assessments were conducted based on information collected from technical documentation relevant to each of the systems and from discussions with system owners in CMS’s Office of Information Services. In addition to the contact named above, Teresa F. Tucker (Assistant Director), Wilfred B. Holloway, Lee A. McCracken, Thomas E. Murphy, Maria Stattel, Daniel K. Wexler, Merry L. Woo, and Charles E. Youman made significant contributions to this report.

Summary: The health insurance claims number on Medicare beneficiaries' cards includes as one component the beneficiary's (or other eligible person's, such as a spouse's) SSN. This introduces risks to beneficiaries' personal information, as the number may be obtained and used to commit identity theft. Many organizations have replaced SSNs on these types of cards with alternative identifiers. However, the introduction of such a new data element into IT environments can require changes to systems that process and share data. Moreover, previous assessments of CMS's IT environment have found that it consists of many aging, "stove-piped" systems that cannot easily share data or be enhanced; thus the agency has ongoing efforts to modernize its environment. As requested, GAO studied CMS's efforts related to the removal of SSNs from Medicare cards. GAO's objectives were to (1) assess actions CMS has taken to identify and implement IT solutions for removing SSNs from Medicare cards and (2) determine whether CMS's ongoing IT modernization initiatives could facilitate SSN removal efforts. To do this, GAO reviewed agency documentation and interviewed officials. The Centers for Medicare and Medicaid Services (CMS)--which is the agency within the Department of Health and Human Services (HHS) responsible for administering Medicare--has not taken needed steps, such as designating a business owner and establishing a business case for an information technology (IT) project, that would result in selecting and implementing a technical solution for removing Social Security numbers (SSN) from Medicare cards. However, the agency has collected information and data as part of its most recent study of SSN removal that could contribute to the identification and development of an IT solution. These include information relevant to examining alternative approaches, identifying costs and risks, and assessing the impact of different approaches on the agency's existing IT systems. For example, the agency identified two approaches for removing the SSN: (1) replacing it with a new identifier, referred to as the Medicare Beneficiary Identifier, and (2) masking the first five digits of the SSN for display on Medicare cards. CMS system and business owners also conducted high-level assessments of the types of changes that would need to be made to systems identified in the agency's IT inventory. For example, system owners estimated the level of complexity of the changes, the number of hours of work at each life-cycle phase, business and technical risks, and the potential to leverage related efforts. CMS noted in its most recent study that replacing the SSN with a new identifier could reduce the risk of identity theft from a lost or stolen card, and actions taken thus far could inform a future IT project to address SSN removal. However, according to CMS officials, agency leadership has not directed them to initiate such a project. Until such a project is undertaken, the agency will not be positioned to identify or implement a solution to support the removal of SSNs from beneficiaries' cards. CMS has efforts under way to modernize its IT systems, some of which could be leveraged to facilitate the removal of SSNs from Medicare cards. Specifically, one of CMS's high-level modernization goals is to establish an architecture to support "shared services"--IT functions that can be used by multiple organizations and facilitate data sharing. According to agency officials, a service established to automate and manage certain aspects of CMS programs could be used to support a "crosswalk" function that would translate the existing claims number to the new beneficiary identifier (and vice versa). This would enable internal systems to receive information containing the new identifier and continue to process data based on the existing number. Another project was intended to consolidate eligibility determination services from four systems, which could reduce the extent of modifications that would have to be made to each of the systems. However, because the agency has not initiated a project for removing SSNs from identification cards, officials have not considered including shared services or other IT initiatives in their modernization activities and related plans to specifically support changes needed as a result of SSN removal. As a result, CMS may miss opportunities to incorporate such a project into ongoing agencywide modernization initiatives that could facilitate efforts to design, develop, and implement an IT solution for SSN removal in a timely and cost-effective manner. GAO recommends that CMS initiate an IT project to develop a solution for SSN removal and incorporate such a project into plans for ongoing IT modernization initiatives. HHS agreed with GAO's recommendations, if certain constraints were addressed. However, GAO maintains that its recommendations are warranted as originally stated.