The use of SSNs on identification cards by federal, state, and private organizations, such as health insurance companies, was prevalent until the early 2000s. However, many organizations have since replaced these types of identification cards with those that do not contain SSNs. This step was taken, in large part, in response to certain federal and state laws that place restrictions on entities’ use and disclosure of consumers’ personal information, including SSNs. Examples of federal laws include the Driver’s Privacy Protection Act, which generally prohibits a state department of motor vehicles from disclosing or otherwise making available SSNs and other personal information from a motor vehicle record, and the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations, which protect the privacy of health information that identifies an individual (including by SSNs) and restricts health care organizations from disclosing such information to others without the patient’s consent. Additionally, several state statutes include provisions related to restricting the display of SSNs, their unnecessary collection, and their disclosure without the individual’s consent. Many state agencies have discontinued the use of the numbers on identification cards and other documents, such as driver’s licenses, to comply with such laws. Similarly, private sector health insurers have discontinued use of SSNs on insurance cards in an effort to protect beneficiaries’ personal health information. The numbers on the VA cards are identification numbers that allow beneficiaries to access facilities; the cards are not insurance cards. DOD’s cards are also used primarily for identification purposes, and are not insurance cards. the numbers in magnetic stripes on the cards. However, both DOD and VA continued to use the number as an identifier and have described other steps they are taking to better protect beneficiaries against theft or improper use of the numbers. Specifically, DOD officials stated that the department is in the process of developing and implementing a solution for removing embedded SSNs from the bar codes on military identification cards and replacing them with a new identifier; they plan to complete this project in late 2016. Additionally, VA is working to remove the number embedded in magnetic stripes because of increased security risks introduced by the prevalence of electronic readers on devices such as smart phones; it plans to complete this project in late 2016. Since the inception of Medicare in 1965, CMS and its program stakeholders—SSA, the Railroad Retirement Board, and state Medicaid programs—have used an SSN-based identifier when filing and processing fee-for-service claims, and when exchanging data related to the Medicare program. This number, referred to as the Health Insurance Claim Number (HICN), is displayed on Medicare beneficiaries’ health insurance cards. Individuals’ eligibility to participate in the Medicare fee-for-service programs is initially determined by SSA, based on factors such as age, work history, contributions made to the programs through payroll deductions, and the presence of certain medical conditions. Once SSA determines that an individual is eligible, it provides information about the individual to CMS, including the SSN and a 1- or 2-digit beneficiary identification code.Enrollment Database—the repository of data about individuals who are or have ever been on Medicare. This system combines these two data fields to create the 10- or 11-digit HICN. CMS prints and issues to the individual These data are transmitted to and stored in CMS’s a paper identification card (similar to the example shown in fig. 1) that displays the HICN (i.e., the Medicare claim number), the cardholder’s full name, his or her gender, and the effective dates of Medicare program eligibility. The HICN is maintained and referenced throughout CMS’s IT environment. For example, health care providers may reference Medicare beneficiaries’ printed cards at the point of care to determine eligibility for the fee-for-service program. Providers may then query a CMS system using the HICN printed on the card, along with other demographic data, to obtain information regarding eligibility for specific treatments or services they intend to deliver, such as glaucoma screening or smoking cessation counseling. Specifically, the agency provides verification services through its HIPAA Eligibility Transaction System (HETS), which allows providers to access real-time data regarding beneficiaries’ eligibility at the point at which care is scheduled or delivered. Likewise, providers are required by CMS to use the number when they submit claims to receive payment for those treatments and services. CMS’s and its contractors’ systems also process data based on the HICN to check for duplicate claims, apply claims and medical policy edits, issue Medicare Summary Notices, authorize or deny payment of claims, and conduct printing and mailing operations. For example, CMS’s Medicare Administrative Contractors, who are responsible for processing and paying claims, use their own systems to determine whether fee-for- service claims meet certain requirements, such as completeness of data. Specifically, if a claim did not include the HICN or other required data, the contractor’s system would return it to the provider as incomplete or invalid. The shared systems are the Fiscal Intermediary Shared System, which processes part A claims; the Multi-carrier system, which processes part B claims; and the ViPS Medicare System, which is used to process claims for durable medical equipment. including HETS, on a daily basis. These data are used to update those systems’ databases. In addition to using the HICN to support the provision of and payment for health care to Medicare beneficiaries, CMS and its federal stakeholders, SSA and the Railroad Retirement Board, use the number to share data needed to coordinate health insurance coverage and payments for premiums. In this regard, CMS provides information that includes the number to SSA when beneficiaries’ eligibility status or other data change, and SSA refers to the HICN when beneficiaries request replacement of lost Medicare cards. CMS also shares data that include the number with the Railroad Retirement Board when it administers health benefits for railroad retirees who are eligible for Medicare. Further, CMS and the 56 state and territorial Medicaid programs share data based on beneficiaries’ HICNs. Specifically, these programs provide the number along with other data on their beneficiaries that are used to help identify individuals who are eligible for both Medicare and Medicaid benefits. The states also provide information regarding Medicaid beneficiaries for whom their programs pay Medicare Part A or B premiums. In turn, CMS provides several types of data to the Medicaid programs based on the HICN, including data needed to coordinate payment for claims when a beneficiary is covered by multiple insurers and information on the current drug prescription insurer for beneficiaries who are covered by Medicare Part D private plans. Figure 2 depicts a simplified view of the flow of data and the use of the HICN in CMS’s and its stakeholders’ systems. In 2010, CMS officials developed a plan to upgrade the agency’s IT environment and noted that the modernization of enterprise information systems and the supporting infrastructure was necessary in order for CMS to continue to meet its mission. Further, two scientific advisory committees that later evaluated CMS’s IT environmentagency operated in a “stove-piped” environment in which many systems were developed to meet specific time-sensitive and legislatively driven needs, such as claims processing and eligibility determination, without consideration of the need for systems to interoperate or integrate data from other sources. The committees indicated that, because the agency continues to operate in such an environment, enhancement and sharing of data across its systems can be costly, risky, and time-consuming. In 2013 the agency took steps to update the 2010 IT modernization plan. According to officials in the Office of Information Services, this was to address recommendations resulting from the two advisory committees’ evaluations. These officials described seven goals of the plan, the first of which is to establish an architecture that supports the development and implementation of IT functions, known as “shared services,” that can be provided to support multiple needs of organizations conducting business within or between federal agencies. limited to, the transformation of the agency’s IT operations to enable CMS to use technologies such as cloud computing and virtual data centers; improvements to privacy and security controls to better protect personal health information stored and processed by the agency; and the transition to a coordinated, enterprise approach toward developing and implementing IT solutions. The Chief Information Officer stated that the agency was continuing to work toward addressing the seven goals defined in 2013. Use of shared services can be cost efficient because when a service is reused by multiple IT systems, initial system development costs occur once, and these costs can be avoided each time the service is reused. In addition, use of shared services promotes standardization and interoperation of data and can reduce stove piping. Both the SSA and HHS inspectors general have reported on risks associated with the use of the SSN on Medicare cards and have recommended that SSA and CMS work toward identifying alternate identifiers to better safeguard Medicare beneficiaries’ SSNs. Additionally, we have previously issued reports that addressed federal agencies’ use and display of SSNs on identification cards and for other purposes, as well as CMS’s study of this issue. In a 2004 study, we found that SSNs were widely exposed to view in a variety of public records, particularly those held by state and local governments, and appeared in some public records nearly everywhere in the nation. in identity thefts, and that the widespread use and retention of the number by both the public and private sectors may provide opportunities for criminals to easily obtain and misuse this personal information. We stressed that the display of nine-digit SSNs on such cards, which may need to be carried and must often be disclosed, puts cardholders at risk for identity theft due to the increased potential for accidental loss, theft, or visual exposure.