U.S. Policy on Medicare Cards Is a Boon for Identity Thieves

To guard against identity theft, John and Mary Benbow of La Jolla took their first names off their personal checks, using their initials instead. They shred documents that show any of their identification numbers and carry credit cards only when they plan to use them.

Whenever they see a doctor or go to the pharmacy, however, they must present Medicare cards inscribed with their Social Security numbers -- numbers widely viewed as the keys to identify theft. Photocopies of the cards are routinely attached to their medical records, making the information available to anyone with access to their files.

Seeking to cut the risk of identity theft, California and other states have passed laws forcing private insurers to remove Social Security numbers from healthcare cards. But these laws don’t apply to federal agencies and programs such as Medicare or to other institutions that use Social Security numbers for identification, including many colleges and universities.

“I feel it’s very dangerous to have to carry a Medicare card with my Social Security number on it, knowing how valuable this is to people who are trying to steal my identity,” said Mary Benbow, 67.

“This is something that we have been screaming about for years,” said Linda Foley, co-executive director of the Identity Theft Resource Center in San Diego. “Our most vulnerable populations due to overexposure of their Social Security numbers are students, seniors and members of the armed forces.”

Foley and others say the federal government’s widespread use of Social Security numbers is even more exasperating given that the Federal Trade Commission -- the government’s primary consumer protection agency -- is on the front lines of efforts to combat identify theft.

Among other things, the FTC advises consumers with Social Security numbers on their health insurance cards to ask their insurer to use another number instead. Consumer groups offer similar advice.

“We tell people all the time that they shouldn’t carry their Social Security number in their wallet,” said Susanna Montezemolo, a policy analyst with Consumers Union in Washington. “Their response is, ‘Well, it’s on my Medicare card.’ ”

With an estimated 42 million Americans under its umbrella, the federal Centers for Medicare and Medicaid Services issues more cards with Social Security numbers than any other agency except for the Social Security Administration itself.

Spokesman Peter Ashkenaz said that Medicare officials were aware of the concerns involving use of the numbers and that alternatives had been discussed. But so far, he said, there were no plans to issue cards with different numbers, which would probably cost $100 million and require retooling the agency’s computer systems.

“What we tell people to do is treat it like a credit card,” Ashkenaz said. “Use it only when you need to and don’t share the information with anyone who doesn’t need to know.”

That answer hasn’t satisfied privacy advocates in Congress. In June, the House passed an appropriations bill with a rider introduced by Rep. Bob Filner (D-Chula Vista) that would require Medicare to stop issuing cards with the numbers starting Jan. 1. The bill is now in the Senate.

Filner says the measure is just a first step and that he expects to introduce bills that would strip Social Security numbers from other governmentissued cards.

“We are going to go agency by agency and get rid of the Social Security number on everything,” Filner said Friday. “These agencies keep telling us how difficult it is, but we are going to keep pushing it.”

One target will be the Defense Department. Social Security numbers are emblazoned on the identification cards carried around by an estimated 8 million military men and women and their families, which they use to gain access to computers at work or their base commissaries.

“The requirement that military personnel use the Social Security number for practically everything is nothing short of criminal,” said Beth Givens, executive director of the Privacy Rights Clearinghouse. “I got an e-mail from one military member who said he was required to stencil his name and Social Security number on his duffel bag. It’s really outrageous.”

Lt. Col. Ellen Krenke, a Defense Department spokeswoman, confirmed that armed forces personnel could be required by their superiors to stencil Social Security numbers on their belongings, but said it was not a department policy.

Krenke said that the Geneva Convention required military personnel to disclose their name, rank and serial number, and that the military used the Social Security number as the serial number. But she declined to discuss the rationale for the policy.

“The Department of Defense does not have any plans to change this requirement, but will continue to review it,” Krenke said in an e-mailed statement.

The FTC estimates that more than 3 million Americans have their identities stolen each year and that the number of thefts is on the rise.

Full identity theft occurs when a criminal hijacks a person’s identity to open charge accounts in that person’s name. A more limited form of identity theft occurs when someone uses stolen credit cards.

Obtaining a Social Security number is considered the key to full identity theft because having that number is needed to obtain new credit in the victim’s name.

A 2002 report by the Government Accountability Office noted that Medicare and the military were just part of the problem. A wide array of state, federal and municipal offices -- such as courts and licensing agencies -- are large-scale collectors of personal information, including Social Security numbers, and they do not uniformly enforce policies that would protect those numbers from disclosure.

Many agencies said “preserving the integrity of the record” was more important than preserving the privacy of the individual, the report said.

Neither the Government Accountability Office nor the FTC could estimate how many instances of identity theft might be linked to use of governmentissued papers such as Medicare cards, in part because an estimated 75% of victims say they have no idea how their identity was stolen, according to the GAO.

The 1974 federal Privacy Act limited the collection of Social Security numbers by government agencies and required that they inform consumers when providing the number was optional. Consumer advocates say the policy isn’t widely known and is often ignored.

Dick Harriff of San Diego said he recently had to give his Social Security number to get a rebate from the San Diego County Water Authority for a water-saving toilet. Harriff, who reluctantly provided the number, said, “My greed prevailed at the expense of the intellect.”

Spokesman John Liarakos confirmed that the water authority required the Social Security number for rebates, but said the information was kept secure and confidential.

Why the policy? Liarakos pointed to Uncle Sam.

“The federal government requires that we provide a 1099 [income tax form] for anyone who gets more than $600 a year in total rebates,” Liarakos said. “This is how we track who gets 1099s.”