SSA’s primary mission is to pay benefits under its Old-Age, Survivors, and Disability Insurance and Supplemental Security Income programs, in accordance with Titles II and XVI of the Social Security Act of 1935 (the Act), as amended.(SSN)—a unique identifier assigned to each person through a process known as “enumeration”—as a way of tracking individuals’ work activities and the benefits paid to retired workers and eligible family members. In order to properly administer payments, SSA also tracks death information of SSN-holders. In addition, SSA issues the Social Security Number SSA issues SSNs and uses them to administer its programs, including tracking U.S. workers’ earnings in order to determine the types and amounts of benefits individuals may be eligible for. As a result, SSA has also historically collected death information about SSN-holders so it does not pay Social Security benefits to deceased individuals and to establish benefits for survivors. The 57 vital records jurisdictions—the 50 states, New York City, the District of Columbia, and five territories—are responsible for registering deaths. Fifty-three of these jurisdictions, along with a number of other parties, provide SSA with decedents’ names, dates of death, dates of birth, and SSNs. SSA receives state death data under contracts with the 50 states, New York City, the District of Columbia, and Puerto Rico.matches that information against corresponding information in its databases, verifies the information for certain cases, and records the individual as deceased. When SSA receives a report of death it Various entities, including federal agencies, can obtain SSA’s death data. The complete file, which we refer to as “SSA’s full death file,” is available to certain eligible entities. A subset of the full death file, which SSA calls “the Death Master File (DMF),” is available to the public. The Social Security Act requires that SSA share its full death file, to the extent feasible, with agencies that provide federally funded benefits (for the purposes of this report, we refer to these as “benefit-paying agencies”), provided the arrangement meets statutory requirements. However, SSA may not include death data received from states in the DMF, which can be accessed publicly. Agencies may use the data to determine if individuals receiving benefits under their respective programs are deceased, and thus no longer entitled to those benefits. GAO has noted the value of using this information for guarding against improper payments. For example, in a June 2013 report, we recommended that the U.S. Department of Agriculture (USDA) match its payment records against SSA’s full death file to prevent improper payments to deceased farmers. Given the focus on guarding against improper payments, there has been new emphasis on how agencies access critical data, such as death records, while maintaining the security of sensitive information such as SSNs. The Improper Payments Elimination and Recovery Improvement Act of 2012 established the Do Not Pay Initiative and requires federal agencies to review a number of databases, as appropriate, including the DMF, to verify eligibility prior to making payments with federal funds. A component within the U.S. Department of Treasury (Treasury) administers the Do Not Pay Business Center, which operates the centralized portal through which agencies can verify individuals’ eligibility to receive payments. Recent legislative proposals have also sought to encourage federal agencies to use SSA’s death information. For example, a Senate bill introduced in July 2013 would provide for federal agency access to the full death file for specified purposes, such as ensuring authorized payments and facilitating other agency functions, including public health or safety, law enforcement, tax administration, health administration oversight, and debt collection, as determined appropriate by the SSA Commissioner. At the same time, other proposals have sought to limit public access to SSA’s death data. For example, proposed legislation introduced in the House in July 2013 seeks to deter identity theft and tax fraud by limiting public access to the DMF, according to the bill’s sponsor. The current administration has also advanced a proposal that includes critical elements of both legislative proposals, and SSA officials have publicly supported their central provisions. SSA receives death reports from a variety of sources, including states, family members, funeral directors, post offices, financial institutions, and other federal agencies. According to agency officials, SSA received about 7 million death reports in 2012. However, except for reports submitted by states, it does not collect data identifying how many reports come from each source.received within 30 days of the date of death. Officials also said nearly all death reports are Because of states’ custodial role in collecting and maintaining death records, SSA considers states to be a critical partner in its collection of death information. Thirty-four states, the District of Columbia, and New York City submit their death reports through an Electronic Death Registration System (EDRS), which automates the electronic registering and processing of death reports in order to improve timeliness and accuracy. SSA considers reports submitted by states through EDRS to be the most accurate because these systems are used by most states to verify the name and SSN of the decedent with SSA databases before the report is submitted to SSA. To get death reports from the states, SSA has established contracts that set forth a payment structure to compensate states for the reasonable costs of providing these records, in accordance with the Social Security Act. Payments are higher for reports submitted via EDRS and pre-verified with SSA databases, and those that are submitted relatively soon after decedents’ deaths. For example, for calendar year 2013, SSA paid $2.93 for each EDRS report that was pre- verified and submitted to SSA within 6 days of the date of death, compared to $0.82 for non-EDRS reports submitted within 120 days of the date of death. Because of the time saved through automated transmission of data and the use of pre-verification to ensure accuracy, SSA has encouraged the expanded use of EDRS. The contracts with the states provide that SSA will not share this information, except as authorized by federal law and section 205(r) of the Act. Some states and other sources provide death information voluntarily to SSA through methods other than EDRS. For example, funeral directors routinely submit a form that includes the decedent’s full name and SSN, as provided by the decedent’s family. In addition, family members often contact SSA field offices directly to report a death. SSA considers reports from families and funeral directors generally to be accurate because those sources have first-hand knowledge of the death and the decedent’s identity. SSA views death reports from post offices, financial institutions, and other government agencies generally to be less accurate because SSA does not consider these sources to have first-hand knowledge of the death. Death reports from sources other than states and federal agencies are generally provided to SSA field offices. in other SSA records so payments to deceased beneficiaries can be stopped. As shown in figure 1, death reports from some sources are sent to DACUS directly, while reports from other sources are entered into DACUS by field office staff. DACUS matches the information in the death reports with SSA’s benefit payment systems to determine if the decedents are currently receiving Social Security program benefits (i.e. whether they are program beneficiaries). It then matches the information to SSA’s database of all SSN-holders, known as the Numerical Index File (Numident). Information in death reports from certain sources (see fig. 2) is also verified by field office staff. If the name, date of birth, gender and SSN all match a record on the Numident, SSA marks that record with a death indicator. The Numident is updated with death information on a daily basis. Numident records with new death indicators are then extracted for inclusion in the death data file also on a daily basis. SSA does not track how long it takes from the time it receives a death report until the death is recorded in the Numident. SSA does not independently verify all death reports it receives. In accordance with policy, the agency only verifies death reports for Social Security beneficiaries, and then verifies only those reports from sources it considers less accurate. For example, SSA only verifies death reports for persons currently receiving Social Security retirement or disability benefits because, according to agency officials, it is essential to SSA’s core mission to stop payments to deceased Social Security beneficiaries. As a result, death reports for non-beneficiaries are not verified. Officials told us it would be difficult to verify death reports for individuals who do not receive Social Security benefits because SSA would not likely have current contact information for these individuals or their family members. As shown in figure 2, SSA verifies death reports of Social Security beneficiaries received from other federal agencies; third parties that learn about the death, such as post offices and financial institutions; and states that do not submit reports via EDRS. SSA considers these sources to be less accurate because they do not have first-hand knowledge of the death and, unlike states using EDRS, do not perform any verification before submitting the death report to SSA. To verify reports, SSA field office staff typically contact families or other parties with first-hand knowledge of the death to confirm the fact and date of death and confirm the decedent’s SSN. SSA does not verify death reports submitted by families, funeral directors, or states using EDRS. According to SSA officials, families and funeral directors have first-hand knowledge of decedents’ identities and deaths, and the information in death reports submitted through EDRS is typically already verified with SSA databases. They also noted, for example, that SSA would very quickly find out about an erroneous report because, if that beneficiary were still alive, he or she would quickly contact SSA once benefit payments stopped. SSA does not track the proportion of death reports it verifies or how long verifications take. Moreover, according to agency officials, SSA has never performed an analysis validating the accuracy of the various sources of death reports, but instead has based its decisions about which ones to verify on general experience over time. For example, officials told us that for death reports submitted by family members, general experience over many years has shown that a large portion of these reports are accurate. Some death reports, including those that SSA cannot match with a Numident record, are not included in SSA’s death data. Agency officials told us that staff conduct some follow-up steps to see if they can match the information in these reports with other agency records, but if these efforts are unsuccessful, the reports are not included. SSA also does not attempt to follow up with the source of these reports. According to agency officials, it is unlikely the sources would know any additional information beyond what they already provided. Moreover, a subsequent death report for the same individual may arrive from another source. They also added that federal privacy laws may prevent SSA from providing identifying information on the decedent because the individual’s living status is unclear. SSA does not track these cases, so officials were unable to tell us how often this occurs. There are also some deaths that SSA cannot reasonably be expected to include in its death information. These include deaths not reported to SSA because the identity of the decedent cannot be established or a body has not been recovered. While improper benefit payments to these individuals may occur, it would not be appropriate to attribute them to lack of a record in SSA’s death data. After receiving death reports and updating the Numident with death information, SSA makes the information available, in the appropriate form, to federal agencies and other parties (see Fig. 3). SSA provides the full death file, containing over 98 million records, directly to federal benefit-paying agencies that have an agreement with SSA for use in preventing improper payments to deceased beneficiaries or program participants. SSA also extracts Numident death records that are reported by non-state sources to create the DMF, which contains over 87 million records. SSA makes the DMF available publicly via the Department of Commerce’s National Technical Information Service (NTIS), from which any interested party or member of the public— including other federal agencies—can make a one-time purchase, subscribe for periodic updates, or subscribe to an on-line query service. For example, financial institutions or firms conducting background investigations can purchase the DMF from NTIS and subscribe to receive monthly or weekly updates. SSA does not guarantee the completeness or accuracy of its death data, stating that SSA does not have a death record for all deceased individuals. SSA also informs users of its death data that all deaths should be verified before any action, such as stopping benefits, is taken. SSA’s methods for processing death reports may result in inaccurate, incomplete, or untimely information for users of its death data. Consequently, this could lead to improper payments if benefit-paying agencies rely on this data. The specific procedures include (1) verifying a limited portion of death reports, (2) not including death reports that do not match with the Numident file, and (3) not performing additional reviews of reports of deaths that occurred years or decades in the past. Because SSA does not verify death reports from sources it considers most accurate, the agency risks having erroneous information in its death data, such as including living individuals or not including deceased individuals. Analysis we performed on records in the full death file that were erroneously included showed that most of these errors would not have occurred if SSA had verified the death reports when it received them. We identified nearly 8,200 deaths SSA deleted from its death data between February 2012 and January 2013. These data reflect cases where a death report matched a record in the Numident and SSA marked, then later removed, a death indicator for that record. SSA officials told us this could occur because the decedent turned out to be alive or was misidentified as another individual, or as a result of data entry errors. We drew a random but non-generalizable sample of 46 cases from this group and asked SSA to search its records to see if it could determine the reasons for deleting them from its death data. In 28 of these cases, SSA was able to identify a reason for deletion. Of these, 12 were false death reports filed while the reported decedent was still alive, and 4 involved decedents for whom identifying information—such as SSNs—of other people was mistakenly included in the death reports. Separately, SSA was also able to determine that 13 of the 46 cases were reported by either family members or funeral directors—sources SSA considers more accurate and from which it does not verify death reports. Nine of the 46 cases involved non-beneficiaries, which are also not verified. Another SSA practice—not contacting the source of a death report that does not match a Numident record—poses a risk to the data’s completeness. As described earlier, if SSA staff cannot match a death report to a corresponding Numident record, they do not contact the source that submitted the report or undertake any other outside investigation to resolve the discrepancy. SSA’s OIG has found that these omissions are substantial. In one case, data for about 182,000 deceased Supplemental Security Income recipients were not included in SSA’s death data. In another, it found that as many as 1.2 million deceased Old Age and Survivors Insurance beneficiaries were not included in the death data. The OIG determined that these gaps occurred because SSA could not match the identifying information for these individuals included in the death reports or other SSA records with Numident records. Therefore, no death indicator was added to the Numident records. Samples of the cases drawn for the OIG’s reviews showed that these individuals had As a result of this been deceased for an average of nearly 17 years. practice, other federal benefit-paying agencies relying on these data could make improper benefit payments. Social Security Administration, Office of the Inspector General, Title XVI Deceased Recipients Who Do Not Have Death Information on the Numident, A-09-12-22132 (Baltimore, MD: May 3, 2013); and Title II Deceased Beneficiaries Who Do Not Have Death Information on the Numident, A-09-11-21171 (Baltimore, MD: July 9, 2012). The OIG found that Social Security benefit payments to a sample of these deceased individuals had been terminated. Finally, we also identified cases in which death reports submitted to SSA in early 2013 listed dates of death that were more than a year old. Specifically, we found about 500 records in which the date of death recorded had occurred in 2011 or earlier; in about 200 of these, the date of death was recorded to be 10 or more years before SSA received the death report. For example, in 11 of the cases, the date of death was in 1976; in another 11, the date was 2004. This is of concern because, if these dates of death are accurate, SSA and other agencies may have been at risk of paying benefits to these individuals for long periods after they died. SSA officials were not able to explain with certainty why this was occurring, but suggested some cases might be the result of data entry errors, and in others, deaths of non-beneficiaries may not be reported to SSA until spouses or families become eligible for survivor’s They informed us that SSA payment systems would identify benefits.benefit payments the agency made after these deaths occurred. When these reports are sent to field offices for verification or other development, they added, it could take an extended period of time to complete because the contact information for someone who died years ago may not be available. We found other instances of potentially erroneous information in the death data that raise questions about its accuracy and usefulness. These included: 130 records where the recorded date of death was before the date of birth; 1,941 records where the recorded age at death was between 115 and 1,826 records where the recorded death preceded 1936, the year SSN’s were first issued, although these decedents had SSNs assigned to them. Agency officials told us SSA has never investigated how these errors occurred or whether they may affect payments to Social Security and other federal program beneficiaries. They did not think these types of errors would have resulted in improper benefit payments because they involved persons recorded as deceased. SSA officials said some of these anomalies were likely associated with records added prior to the mid- 1970’s that were manually processed. For example, SSA staff could have incorrectly keyed in a date of birth that occurred after the reported date of death. Officials added that SSA has undertaken or will soon undertake several initiatives aimed at correcting these types of errors and preventing them in the future. Among those they said have already been implemented are the following: SSA is using an edit check to identify records showing a date of birth that occurs after a date of death and taking corrective action before the report is processed further. SSA, however, has not decided whether to make corrections to these dates in records processed before the check was implemented. In December 2012, SSA identified cases and terminated benefits for individuals over 115 years old whose Numident record showed they were deceased and who had their benefits suspended or were entitled only to Medicare benefits. SSA plans to repeat this match for fiscal year 2013. SSA officials told us that, as a result of this initiative, the agency corrected about 17,000 cases to reflect terminated benefits due to death. In June 2013, SSA began making monthly comparisons of Numident records containing death information with its Title II and Title XVI payment records. It is sending alerts to field offices to resolve cases showing individuals who are receiving or scheduled to receive benefits in the near future even though they are listed as deceased. SSA officials told us, as a result of the initiative, the agency corrected about 14,500 payment records to reflect suspended or terminated payment status due to death. In September, 2013, SSA began a data exchange with CMS to identify beneficiaries ages 90 to 99 who are still receiving Title II benefits but have not used Medicare for 3 years or more and have no other insurance or nursing home information in their records. Agency officials stated that they identified and referred to SSA regional offices for action about 18,600 cases. SSA also plans to introduce a computer code that can be used to terminate benefits for certain Title II beneficiaries who are 115 or older, whose benefits have been continuously suspended for 7 or more years, and for whom SSA does not have a death record. The Social Security Act requires SSA to share its full death file, to the extent feasible, with federal benefit-paying agencies for the purpose of preventing improper payments, if the agency reimburses SSA for its reasonable costs and the arrangement does not conflict with SSA’s duties with respect to state data. However, SSA has no guidance on its process for determining an agency’s eligibility. As of September 2013, seven federal benefit-paying agencies obtained SSA’s full set of death information including the information reported by states, directly from SSA: Centers for Medicare & Medicaid Services (CMS) Department of Defense (Defense Manpower Data Center—DMDC) Department of Veterans Affairs (VA) Internal Revenue Service (IRS) Office of Personnel Management (OPM) Pension Benefit Guaranty Corporation (PBGC) Railroad Retirement Board (RRB) According to SSA officials, CMS also shares the full death file it obtains from SSA with the U.S. Department of Health and Human Services’ Health Resources and Services Administration, under an information exchange agreement between CMS and SSA, as authorized by 42 U.S.C. § 405(r)(9). determine whether they are eligible to receive access under the Act, officials told us that SSA asks the requesting agencies to explain how their proposed use of the information is in accordance with the allowable use outlined in the Act. Specifically, SSA bases its initial eligibility determinations on whether: (1) the agencies pay federally-funded benefits, and (2) the agencies propose to use the full death file to ensure proper payment of those benefits. According to officials, once SSA has determined an agency is eligible, it ensures the remaining statutory requirements regarding cost reimbursement and adherence to SSA’s duties with respect to state data are met, and establishes an information exchange agreement with the agency. However, in making this determination, SSA officials told us they do not use any criteria more specific than the language of the Act to guide decision-making, nor have they developed guidance for the procedures they follow. SSA’s determinations as to whether agencies meet these requirements have varied. In one example of an eligibility determination, officials told us they provide the full death file to IRS for purposes that include allowing IRS to confirm or deny taxpayers’ requests for exemptions and standard deductions. In addition, officials told us SSA would generally have the authority to share the full death file with the OIG at benefit-paying agencies for the purpose of ensuring proper payment of federally-funded benefits. In fact, SSA officials approved a request for access to the full death file for the OIG at the Department of Health and Human Services. However, officials also told us that Treasury, which operates the Do Not Pay Business Center for a similar purpose as OIGs—preventing improper payments—is not eligible to receive the full death file. Officials provided no documentation outlining their rationale for this determination, but explained that one concern they had with providing Treasury with it was that they were not authorized to provide the state-reported death data to Treasury to distribute it to other agencies. Because SSA has some discretion in making such determinations and agencies’ circumstances may differ, this variation in determinations may not represent inconsistency with the Act. However, since SSA does not make available written guidance describing the criteria it uses to make determinations as to whether the agencies meet the statutory requirements, there is no assurance that SSA’s eligibility determinations under the Act are consistent across agencies. Without written guidance explaining SSA’s criteria for approving or denying agencies’ requests for the full death file, such as the factors SSA considers in deciding whether an agency provides federal benefits, potential recipient agencies may not know whether they are eligible. For example, officials at PBGC told us that they undertook a comprehensive review of all the agency’s applicable legal authorities because they were unsure whether the benefits the agency paid met the requirements of the Act. According to federal internal control standards, agencies should have written documentation, such as this type of guidance, and it should be readily available for examination. The absence of written guidance may also pose a risk to the consistency of SSA’s future determinations in the event of staff turnover, changes in administration, or any other disruption that could lead to a loss of institutional knowledge. In a September 2008 report, we found that there was a risk to the management and operational continuity of ongoing projects at SSA due to a lack of written policies and procedures. We found that during organizational change, project objectives, designs, and evaluation may be affected absent comprehensive written policies and procedures. Also, until recently, SSA did not have an officially designated organizational component for monitoring use of death data or making decisions on access to its full death data, which could have introduced additional uncertainty to those decisions. However, officials told us the agency created the Office of Data Exchange in January 2013 to clarify, simplify, and strengthen existing data exchange programs. As part of this effort, it is looking at how SSA makes decisions regarding access to its death data, as well as how it shares the data with other agencies, and is monitoring the data exchange agreements. Any agency that does not access SSA’s full death file can instead access the publicly-available DMF. Agencies can purchase a DMF subscription through the Department of Commerce’s National Technical Information Service (NTIS), which reimburses SSA for the cost of providing the file.In accordance with the Act, SSA excludes state-reported death records from the DMF. Federal entities that purchase the DMF from NTIS include, among others: Department of Justice Department of Homeland Security Drug Enforcement Administration National Institute on Occupational Safety and Health Veterans Affairs medical facilities The death information included in the DMF is less complete and likely less accurate than that contained in SSA’s full death file, which may result in federal agencies that use the DMF receiving less useful information than agencies that use the full death file. According to SSA officials, agencies that purchase the DMF have access to 10 percent fewer records overall than agencies with access to the full death file due to the removal of state-reported deaths. Moreover, SSA officials said they expect the percentage of state-reported deaths as a proportion of all of SSA’s death records to increase over time, which could lead to a greater portion of death data being removed each year to create the DMF. For example, for deaths reported in 2012 alone, the DMF included about 40 percent fewer death records than what was included in SSA’s full death file. As a result, agencies that purchase the DMF will continue to access fewer records over time than those that obtain SSA’s full death file. In addition, because the deaths reported through EDRS by states are generally more accurate, it is likely that federal agencies using the DMF would encounter more errors than agencies using SSA’s full death file. In fact, the SSA OIG found that approximately 98 percent of deaths that SSA erroneously included in its death file were reported by non-state sources. It is not SSA’s practice to proactively notify agencies that may be eligible for access to the complete set of death information. Officials explained that distributing death information to other federal agencies is not a part of SSA’s mission, nor is it an activity for which SSA receives an appropriation. As a result, some agencies may not know to request the full death file directly from SSA and may be relying on the less complete, less accurate DMF to assist them in administering their programs. In at least one case, an agency administering federal benefit-paying programs was using the less comprehensive DMF to match against its payment systems until it received access to the full file in January 2013. In a June 2013 report, we found that two agencies within the U.S. Department of Agriculture (USDA) were not matching beneficiary lists against SSA’s full death file. We spoke with program officials at another benefit-paying agency that uses the DMF—the Department of Labor’s Division of Energy Employees Occupational Illness Compensation, within the Office of Workers’ Compensation Programs—who told us they did not know until very recently that obtaining the full set of death data was an option. Under the Act, one condition of receiving SSA’s full death data is that the recipient agency reimburses SSA for the reasonable cost of sharing death data. However, factors including legal requirements and a quid pro quo arrangement have resulted in varying projected reimbursement amounts for different agencies (see table 1). Some agencies do not reimburse SSA at all. For example, VA is not required to provide reimbursement by statute, while OPM provides federal retirement data to SSA that is critical to its mission, and the agencies have agreed that the expenses involved in the exchanges are reciprocal. However, SSA officials were unable to point to any reciprocity study supporting this decision. For other agencies, some of these differences in projected reimbursement amounts cannot fully be explained by the frequency with which the agencies expect to receive the data. For example, as noted in Table 1, CMS expected to receive updates to the full death file weekly from SSA and CMS officials told us the agency expected to reimburse SSA $9,900 in fiscal year 2013. RRB similarly expected to pay $9,000, despite expecting to receive the file less frequently—monthly, rather than weekly. At the same time, IRS expected to receive weekly updates to the full file plus the full file annually in fiscal year 2013, and PBGC expected to receive the file with the same frequency for fiscal year 2014. However, IRS expected to pay more than $87,000, while PBGC’s expected reimbursement amount was $70,000. While the reimbursement amounts for agencies are sometimes included in the inter-agency agreements governing how SSA provides its full death file, the agreements lack information on how these amounts were determined. According to SSA officials, these agreements specify the permissible purpose for using the death data and limitations on sharing the data within the agency. However, according to officials we spoke with at several agencies that receive the full death file, SSA staff did not provide an explanation for reimbursement amounts. SSA officials told us they calculate a detailed breakdown of expenses in an internal document, but provide only a summary of these expenses in the estimates and billing statements they send to agencies. As a result, recipient agencies do not know the factors that lead to the reimbursement amounts they are charged, which could prevent them from making informed decisions based on the amount they are spending. According to federal internal control standards, financial information is something agencies should communicate for external uses, because it is necessary to determine whether agencies are meeting goals for accountability for effective and efficient use of resources. In addition, SSA officials told us that because the Act provides for SSA to be reimbursed for its costs, the agency will not negotiate the reimbursement amounts if a prospective recipient agency indicates unwillingness to pay the quoted amount. In one case, SSA officials told us that while it approved a request for access to the file from the OIG for the U.S. Department of Health and Human Services, the two entities never finalized an agreement because the OIG determined it wanted to look for a lower-cost option for obtaining death information. Federal benefit programs’ need for accurate administrative data, such as death information, is increasingly evident in an environment of continuing budget shortages, where improper payments due to inaccurate information cost taxpayers billions of dollars in fiscal year 2012. Because of its mission, SSA is uniquely positioned to collect and manage death data at the federal level. SSA already has a responsibility to ensure that this information is as accurate and complete as possible for its own beneficiaries. Further, proposed legislation, if enacted, would require SSA to disseminate full death data to a number of additional eligible federal agencies. Only with more accurate and complete data can these agencies reduce the risk of paying deceased beneficiaries. However, because SSA has never analyzed the risk posed by errors or processes that could result in errors, it is not fully aware of steps that would be needed to address them. As a result, SSA and other federal agencies that use the full death data and the DMF are potentially vulnerable to making improper payments. Similarly, the absence of written guidelines for determining which agencies can access the full death data may impede federal agencies’ ability to obtain that information in a timely and efficient manner. Finally, SSA’s approach to calculating and charging agencies for death data lacks transparency about the fact that federal agencies pay varying amounts for the same information. In such a setting, there is a risk that federal agencies that could otherwise benefit from death information will decline to participate, whether due to confusion over SSA’s access protocols or uncertainty concerning its financial reimbursement policies. In order to enhance the accuracy of and ensure appropriate agency access to SSA’s death data, we recommend that the Social Security Administration’s Acting Commissioner direct the Deputy Commissioner of Operations to take the following three actions: 1. To be more informed about ways to improve the accuracy and completeness of its death information, conduct a risk assessment of SSA’s death information processing systems and policies as a component of redesigning SSA’s death processing system. Such an assessment should identify the scope and extent of errors, and help SSA identify ways to address them. In addition, assess the feasibility and cost effectiveness of addressing various types of errors, given the risk they pose. 2. To clarify how SSA applies the eligibility requirements of the Social Security Act and enhance agencies’ awareness of how to obtain access, develop and publicize guidance it will use to determine whether agencies are eligible to receive SSA’s full death file. 3. To increase transparency among recipient agencies, share a more detailed explanation of how it determines reimbursement amounts for providing agencies with death information. We provided a draft of this report to the Social Security Administration (SSA), the National Technical Information Service, the Department of Treasury (Treasury), the Department of Defense, the Department of Labor, the Centers for Medicare & Medicaid Services (CMS), the Internal Revenue Service (IRS), the Office of Personnel Management, the Pension Benefit Guaranty Corporation, and the Office of Management and Budget (OMB) for review and comment. SSA officials provided written comments, which are reproduced in appendix II and described below. IRS officials provided technical comments that further supported the impact of late-reported deaths on federal users of SSA’s death data, and we incorporated an example they provided into that discussion. The Department of Labor, the Office of Personnel Management, the Pension Benefit Guaranty Corporation, and OMB also provided technical comments, which we incorporated in the report as appropriate. CMS, the Department of Defense, Treasury, and the National Technical Information Service had no comments. In its comments, SSA partially agreed with our first and third recommendations and disagreed with our second. In response to our first recommendation, SSA agreed to perform a risk assessment as part of its death information processing system redesign project, but raised concerns about performing risk assessments for other users of the death data. In making this recommendation, we did not intend for SSA to perform risk assessments for other agencies’ programs. However, we believe that by assessing the risks of inaccuracies in its death data, SSA’s efforts could shed light on risks posed to other agencies’ programs in addition to its own. To clarify this, we deleted the specific reference to other agencies. SSA also partially agreed with our third recommendation, stating that it has implemented improvements in its estimating procedures for future reimbursable agreements to ensure consistent estimates for all customers. However, the agency stated that it is not a typical government business practice to share these detailed costs for reimbursable agreements. We are encouraged that SSA has made efforts to standardize the estimates it shares with its federal partners, though we have not had the chance to evaluate their effectiveness, since these efforts were made recently. Also, we recognize that there may be limitations on the type of cost details SSA can provide to recipient agencies. However, we continue to believe that more transparency in conveying the factors that lead to the estimated and final reimbursement amounts recipient agencies are charged could help them make more informed decisions. SSA disagreed with our second recommendation, stating that each request to obtain the full death file is unique, and that officials must review them on a case-by-case basis to ensure compliance with various legal requirements. It also expressed concern that developing this guidance as we recommended would require agency expenditures unrelated to its mission in an already fiscally constrained environment. We appreciate that agencies may base their request for the full death file on different intended uses, and support SSA’s efforts to ensure compliance with all applicable legal requirements. However, we continue to believe that developing this guidance could help to ensure consistency in SSA’s future decision making by the new Office of Data Exchange, as well as enhance agencies’ ability to obtain the data in a timely and efficient manner. We do not expect such guidance, which could include information such as the factors SSA considers in deciding whether an agency provides federal benefits, would restrict SSA’s flexibility. SSA also outlined two general concerns with the body of the report. First, it expressed concern that we inaccurately described SSA officials’ reasons for determining that the agency could not provide Treasury with full death data for the Do Not Pay Initiative. We made revisions to the report to more accurately describe SSA’s reasoning. Second, SSA was concerned about the use of estimated reimbursement costs in Table 1 because these costs fluctuate throughout the year. SSA suggested instead using figures it provided reflecting the actual costs from fiscal year 2012. The agency also noted that Table 1 contains incorrect information related to the frequency at which the agencies receive the file. While we agree that actual costs are inherently more accurate than estimated costs, we chose to use estimated costs because this is the information federal agencies receive when they are deciding whether and how to obtain death data. In response to SSA’s assertion that our table contains incorrect information, we have added information to the table regarding whether agencies expected to receive the annual file. We followed up with an official, who clarified that our previous table was incomplete because, for some of the agencies, it lacked information about receipt of the annual full file. SSA also provided technical comments, which we incorporated in the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees and the heads of the agencies listed above. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202)512-7215 or bertonid@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. This report examines (1) how the Social Security Administration (SSA) obtains death reports for inclusion in the death data it maintains and steps it takes to ensure these reports are accurate; and (2) the factors affecting federal agency access to SSA’s death data. To address these objectives, we reviewed applicable federal laws and SSA procedures, as well as relevant reports and evaluations, such as reports from multiple Offices of Inspectors General. We interviewed SSA officials regarding how SSA obtains and processes death reports and maintains and shares its death information. We also interviewed representatives of some entities that provide death reports to SSA. We obtained and reviewed available corroborating documentation such as the data sharing agreements SSA made with other federal agencies. To evaluate SSA’s processes for obtaining, processing, and sharing death information, we reviewed standard criteria, such as the Standards for Internal Controls in the We performed independent testing of SSA’s death Federal Government.data to identify specific types of errors such as dates of birth that followed dates of death. We also drew a randomly selected but non-generalizable sample of cases that SSA removed from the death information for further review in order to identify potential explanations for that action. Finally, we interviewed officials at other federal agencies that use SSA’s death information about how they access and use it. We tested for specific types of errors within SSA’s death data in several different ways using the full death information file; however, we did not attempt to identify all possible errors in the death data. Our reliability tests included identifying cases in which the date of birth was listed as occurring after the date of death. We also looked for cases involving deaths at very old ages—115 and higher—and cases of death that occurred before 1936 (when account numbers were first issued for administering Social Security programs) after observing such cases in a publicly-available version of the Death Master File (DMF). We then systematically tested for incidences of these occurrences in the full death information file. As part of our tests to identify deaths that occurred at age 115 or older and those that occurred before 1936, we examined the monthly update file of cases SSA added in March 2013, which represent new death reports received by SSA. In conducting our analysis, we found a total of 539 deaths were added to the death data during this month that reportedly occurred in years prior to 2012 (and another 9,462 that occurred in 2012). At SSA’s request, we provided a sample of these cases to SSA staff to investigate. We selected and provided SSA lists of those cases in which the deaths were reported to have occurred in 1976 and 2004—a total of 22 cases. We chose these two years because each of these years included a sufficiently large number of cases to allow us to potentially identify patterns with respect to whether SSA had been paying benefits to deceased beneficiaries. We also chose two years that were nearly three decades apart to determine if there were any differences due to time period variation. SSA was unable to research these cases individually because of time constraints, but provided explanations of possible reasons why the agency receives reports this many years after a death. SSA also produces weekly and monthly update files listing deaths to be deleted from and death reports to be added to its death information files. To identify possible reasons for deleting deaths, we drew a random sample of 97 cases from the monthly update files produced from If all cases in this sample were February 2012 through January 2013. reviewed, we would have been able to make generalized observations about all of the deleted cases in this time period. We provided this list of cases listed in the order selected and requested SSA to research them— beginning at the top of the list—to determine if it had any record of the reason for deleting the case from its death data. To identify possible relationships with other characteristics, we also asked officials to provide, if available, the source of the death report, and whether or not the listed decedent was a Social Security beneficiary. We were satisfied we had a sufficient number of cases after SSA had completed work on 46 of the 97 cases. While still randomly-selected, this smaller sample was non- generalizable. In recognition of the time and resources SSA was committing to this work, we determined that the 46 cases would be sufficient to describe characteristics of these cases, even though we would not be able to make generalized statements about all deleted cases in our population. Of these 46 cases, SSA officials were able to determine reasons for deletion in 28 cases, source of the death report in 13, and determine the beneficiary/non-beneficiary status in all 46. They were able to identify all three of these characteristics in 11 of the cases. For all of the tests and sampling just described, we used the full death data file. We determined that the data we used was sufficiently reliable for our reporting purposes. The computer programming we used was checked by a second programmer for accuracy, giving us further assurance that the results we present in the report are reliable. To assess the factors affecting agencies’ access to SSA’s death data, we interviewed officials at seven federal agencies that used the death data— either the full death file or the Death Master File (DMF). We obtained the list of federal agencies that obtain the full death file directly from SSA, as well as the list of federal entities that purchase the public Death Master File (DMF) from the National Technical Information Service (NTIS). We obtained the former through prior discussions with SSA officials and congressional testimonies. For those federal entities that purchase the public DMF, we requested a list of federal customers from officials at NTIS. According to NTIS officials, they had to compile the list manually because, prior to our request, they had no business reason to separate federal customers from other customers. They described their manual compilation process as looking through the NTIS list of approximately 800 DMF subscription customers one-by-one and determining, for each one, whether it represented a federal customer by looking at the name and email address. Officials then sent us a list of 27 federal customers. Our primary criterion for selecting six of the seven agencies to interview was whether they administered programs that pay benefits. We selected the following four benefit-paying agencies that obtain SSA’s full death file because we wanted to gain an understanding of agencies’ experience with accessing and using the full death file: Centers for Medicare & Medicaid Services (CMS) Department of Defense/Defense Manpower Data Center (DMDC) Internal Revenue Service (IRS) Office of Personnel Management (OPM) We based this selection of four agencies on their reported improper payment amounts from 2012, focusing on those with higher amounts, such as CMS and IRS. We also selected one program within a benefit- paying agency—Department of Labor’s Division of Energy Employees Occupational Illness Compensation within the Office of Workers’ Compensation Programs—that was purchasing the DMF rather than obtaining the full file directly from SSA. We sought to understand this agency’s general experience using the DMF, as well as whether it had ever tried to obtain the full file from SSA. Additionally, we selected the Pension Benefit Guaranty Corporation (PBGC) for interviews because it transitioned from purchasing the DMF to obtaining SSA’s full death file during the course of our review, so officials had the unique perspective of receiving both files. For the seventh agency, we interviewed officials from the U.S. Department of Treasury’s (Treasury) Do Not Pay Business Center, even though it does not pay benefits, because of its program goal to prevent improper payments. Also, we had learned that Do Not Pay officials had previously requested—and were denied—access to SSA’s full death file, and we wanted to better understand the circumstances of that interaction. One limitation of the approach we used to identify all federal users of SSA’s death data is the subjectivity with which NTIS officials judged its customers to be associated with federal agencies. As a result, the list we obtained of federal DMF customers may have been incomplete. However, based on our review of reports on improper federal payments and interviews with SSA officials, we are confident that the information we collected from officials at the agencies we selected accurately represents federal customers’ experience obtaining and using SSA death data. We conducted this performance audit from November 2012 to November 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Lori Rectanus, Acting Director; Jeremy Cox, Assistant Director; Keira Dembowski; Joel Marus; and Sara Pelton made significant contributions to this report. Also contributing to this report were Sarah Cornetto, Holly Dye, Justin Fisher, Alex Galuten, Mitch Karpman, Mimi Nguyen, Almeta Spencer, Walter Vance, Michelle Loutoo Wilson, and Amber Yancey-Carroll. GAO, Farm Programs: USDA Needs to Do More to Prevent Improper Payments to Deceased Individuals, GAO-13-503 (Washington, D.C.: June 28, 2013). GAO, Management Report: Improvements Are Needed to Enhance the Internal Revenue Service’s Internal Controls, GAO-13-420R (Washington, D.C.: May 13, 2013). GAO, Social Security Administration: Preliminary Observations on the Death Master File, GAO-13-574T (Washington, D.C.: May 8, 2013).

Summary: As the steward of taxpayer dollars, the federal government must guard against improper payments. Federal agencies may avoid paying deceased beneficiaries by matching their payment data with death data SSA maintains and shares. In addition, recent legislation has established additional requirements for federal agencies to use death data to prevent improper payments. However, the SSA Office of Inspector General has identified inaccuracies in SSA's death data, which could diminish its usefulness to federal agencies. GAO was asked to examine SSA's death data. This report explores (1) how SSA obtains death reports and steps it takes to ensure death reports are accurate; and (2) factors affecting federal agency access to SSA's death data. In addressing these objectives, GAO interviewed SSA officials and representatives of entities reporting or using the death data. GAO reviewed applicable federal laws, SSA procedures, and reports. GAO also performed independent testing of SSA's death data for certain errors. The Social Security Administration (SSA) receives death reports from multiple sources, including state vital records agencies (states), family members, and other federal agencies to create its set of death records. In accordance with the Social Security Act (Act), SSA shares its full set of death data with certain agencies that pay federally-funded benefits, for the purpose of ensuring the accuracy of those payments. For other users of SSA's death data, SSA extracts a subset of records into a file called the Death Master File (DMF), which, to comply with the Act, excludes state-reported death data. SSA makes the DMF available via the Department of Commerce's National Technical Information Service, from which any member of the public can purchase DMF data. Certain procedures that SSA uses for collecting, verifying, and maintaining death reports could result in erroneous or untimely death information. For example, SSA does not independently verify all reports before including them in its death records. In accordance with its policy, the agency only verifies death reports for Social Security beneficiaries in order to stop benefit payments, and then, verifies only those reports from sources it considers less accurate, such as other federal agencies. GAO identified instances where this approach led to inaccurate data. For example, GAO's analysis of a sample of death records SSA erroneously included in its death data found that these errors may not have occurred if SSA had verified them. In other cases, when data provided do not match SSA's records, SSA typically does not record these deaths. According to federal internal control standards, agencies should conduct risk assessments of factors impeding their ability to achieve program objectives, such as data errors that could result in improper benefit payments. Agency officials told us SSA has not performed such risk assessments, but has initiated work on a full redesign of its death processing system. SSA lacks written guidelines other than the language in the Act for determining whether agencies are eligible under the Act to access the full death file, and it does not share with agencies how it determines the reasonable cost of sharing the data, which recipients of the full file are required to reimburse SSA. Because SSA has not developed or shared guidance on how it determines agency eligibility, this could create confusion among potential recipients regarding eligibility. Ensuring appropriate access is important because the DMF contains about 10 percent fewer records than the full death file, and officials expect that difference to increase over time. Additionally, there is a lack of transparency of cost information about the amounts recipients expect to pay. As a result of not knowing the factors that lead to the reimbursement amounts, agencies may not have sufficient information to make informed decisions. We found that SSA provided differing estimates for agencies' reimbursement amounts. Some variation is due to legal requirements and a quid pro quo arrangement. For example, one agency does not reimburse SSA for the cost of providing the death data because it provides SSA with its own data, and the agencies have agreed that the expenses involved in the exchanges are reciprocal. However, for some agencies this variation could not fully be explained by the frequency with which they expected to receive the data. For example, two agencies expected to pay similar reimbursement amounts in 2013 despite expecting to receive the file at different frequencies. GAO recommends that SSA assess risks associated with inaccuracies; develop and publicize guidance it will use to determine agency access under the Act; and share detailed reimbursement estimates. SSA partially agreed with the recommendations to assess risks and share detailed reimbursement estimates, but did not agree to develop and publicize guidance, stating that each request is unique. GAO believes that the recommendation remains valid as discussed in the report.