The Centers for Medicare and Medicaid Services has not taken needed steps such as designating a business owner and deciding on a technical solution for removing Social Security numbers from Medicare cards, GAO has said.
Two approaches are under consideration: replacing SSNs with a new "Medicare Beneficiary Identifier" or masking the first five digits of the SSN on Medicare cards.
However, agency leadership has not directed CMS officials to initiate a project, and GAO recommended that CMS incorporate replacing or removing the SSNs into ongoing IT modernization efforts at the agency.
For example, one of CMS’s high-level modernization goals is to establish an architecture to support "shared services," IT functions that can be used by multiple organizations and facilitate data sharing, GAO said.
CMS believes aservice established to automate and manage certain aspects of CMS programs could be used to support a "crosswalk" function that would translate the existing claims number to the new beneficiary identifier (and vice versa), according to GAO-13-761.
It said this would enable internal systems to receive information containing the new identifier and continue to process data based on the existing number.
Another project was intended to consolidate eligibility determination services from four systems, which could reduce the extent of modifications that would have to be made to each of the systems, GAO said.
However, it added that because the agency has not initiated a project for removing SSNs from identification cards, officials have not considered including shared services or other IT initiatives in their modernization activities and related plans to specifically support changes needed as a result of SSN removal.
CMS agreed to initiate an IT project to develop a solution for SSN removal and incorporate such a project into plans for ongoing IT modernization initiatives.
