[Congressional Record Volume 154, Number 148 (Wednesday, September 17, 2008)]
[Senate]
[Pages S8954-S8955]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. DURBIN (for himself, Mr. Bingaman, and Mr. Kohl):
  S. 3512. A bill to require the Secretary of Health and Human Services 
to remove social security account numbers from Medicare identification 
cards and communications provided to Medicare beneficiaries in order to 
protect Medicare beneficiaries from identity theft; to the Committee on 
Finance.
  Mr. DURBIN. Mr. President, today I am introducing legislation with 
Senator Bingaman and Senator Kohl to remove Social Security numbers 
from Medicare identification cards.
  Government agencies and private businesses have begun to recognize 
the danger of displaying Social Security numbers. A person's Social 
Security number can unlock a treasure trove of personal and financial 
information.
  If your Social Security number falls into the wrong hands, you are at 
risk of becoming a victim of identify theft and fraud. In 2006, the 
Federal Trade Commission reported that more than 8 million Americans 
were victims of identity theft in the prior year.
  Thirty-one states have enacted laws that limit how public and private 
entities use and display Social Security numbers. Social Security 
numbers are being removed from driver's licenses, and most private 
health insurance cards no longer display your Social Security number.
  Federal agencies are taking steps to reduce the threat of identify 
theft. Last year, the Office of Management and Budget called on federal 
agencies to establish plans to eliminate unnecessary collection and use 
of Social Security numbers and to explore alternatives to Social 
Security numbers.
  The Department of Veterans Affairs no longer displays Social Security 
numbers on new veteran identification cards. And the Office of 
Personnel Management has directed health insurers participating in the 
Federal Employees Health Benefit Program to eliminate Social Security 
numbers from insurance cards.
  Unfortunately, the Centers for Medicare and Medicaid Services is 
lagging behind other agencies.
  The same Social Security number that the Social Security 
Administration believes is so sensitive that it should not be carried 
in your wallet is found on the Medicare cards that 44 million 
beneficiaries carry with them at all times to access health care 
services. CMS expressly instructs Medicare beneficiaries to carry their 
Medicare card in their wallet or purse as proof of insurance, making 
their Social Security numbers readily available to any thief.
  In 2005, I offered an amendment to the fiscal year 2006 Labor-HHS-
Education appropriations bill to require CMS to report to Congress on 
what steps would be necessary for them to remove Social Security 
numbers from Medicare cards.
  CMS issued the report in 2006, but it has not yet begun to remove 
Social Security numbers from Medicare cards.
  Earlier this year, the Inspector General of the Social Security 
Administration took CMS to task for its inaction. The Inspector 
General's report confirmed that displaying Social Security numbers on 
Medicare cards places millions of people at risk for identity theft and 
concluded that ``immediate action is needed to address this significant 
vulnerability.''
  The bill that I am introducing today, the Social Security Number 
Protection Act of 2008, establishes a reasonable timetable for CMS to 
begin removing Social Security numbers from Medicare cards and a date 
certain by which CMS would be required to complete the process.
  Not later than three years after enactment, CMS would be prohibited 
from displaying Social Security numbers on newly issued Medicare cards. 
CMS would be prohibited from displaying the number on existing cards no 
later than five years after enactment.
  In addition to Medicare cards, the bill would prohibit CMS from 
displaying Social Security numbers on all written and electronic 
communications to Medicare beneficiaries, beginning no later than three 
years of enactment, except in cases where their display is essential 
for the operation of the Medicare program.
  Removing Social Security numbers from Medicare cards and 
communications to Medicare beneficiaries is long overdue. Medicare 
beneficiaries should not be placed at greater risk of identity theft 
than people with private health insurance. If other federal agencies 
can remove Social Security numbers, so can CMS.
  I am pleased that Consumers Union, the Medicare Rights Center, and 
the Center for Medicare Advocacy have endorsed this bill.
  This is an issue we should all be able to unite behind. I urge my 
colleagues to cosponsor this important legislation and work with me to 
enact it next year. Medicare beneficiaries deserve to be protected from 
criminals who seek to steal their identities in order to defraud them.

[[Page S8955]]

  Mr. President, I ask unanimous consent that the text of the bill be 
printed in the Record.
  There being no objection, the text of the bill was ordered to be 
printed in the Record, as follows:

                                S. 3512

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Social Security Number 
     Protection Act of 2008''.

     SEC. 2. REQUIRING THE SECRETARY OF HEALTH AND HUMAN SERVICES 
                   TO PROHIBIT THE DISPLAY OF SOCIAL SECURITY 
                   ACCOUNT NUMBERS ON MEDICARE IDENTIFICATION 
                   CARDS AND COMMUNICATIONS PROVIDED TO MEDICARE 
                   BENEFICIARIES.

       (a) In General.--Not later than 3 years after the date of 
     the enactment of this Act, the Secretary of Health and Human 
     Services shall establish and begin to implement procedures to 
     eliminate the unnecessary collection, use, and display of 
     social security account numbers of Medicare beneficiaries.
       (b) Medicare Cards and Communications Provided to 
     Beneficiaries.--
       (1) Cards.--
       (A) New cards.--Not later than 3 years after the date of 
     the enactment of this Act, the Secretary of Health and Human 
     Services shall ensure that each newly issued Medicare 
     identification card meets the requirements described in 
     subparagraph (C).
       (B) Replacement of existing cards.--Not later than 5 years 
     after the date of the enactment of this Act, the Secretary of 
     Health and Human Services shall ensure that all Medicare 
     beneficiaries have been issued a Medicare identification card 
     that meets the requirements of subparagraph (C).
       (C) Requirements.--The requirements described in this 
     subparagraph are, with respect to a Medicare identification 
     card, that the card does not display or electronically store 
     (in an unencrypted format) a Medicare beneficiary's social 
     security account number.
       (2) Communications provided to beneficiaries.--Not later 
     than 3 years after the date of the enactment of this Act, the 
     Secretary of Health and Human Services shall prohibit the 
     display of a Medicare beneficiary's social security account 
     number on written or electronic communication provided to the 
     beneficiary unless the Secretary determines that inclusion of 
     social security account numbers on such communications is 
     essential for the operation of the Medicare program.
       (c) Medicare Beneficiary Defined.--In this section, the 
     term ``Medicare beneficiary'' means an individual who is 
     entitled to, or enrolled for, benefits under part A of title 
     XVIII of the Social Security Act or enrolled under part B of 
     such title.
       (d) Conforming Reference in the Social Security Act.--
     Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 
     405(c)(2)(C)) is amended by adding at the end the following 
     new clause:
       ``(x) For provisions relating to requiring the Secretary of 
     Health and Human Services to prohibit the display of social 
     security account numbers on Medicare identification cards and 
     communications provided to Medicare beneficiaries, see 
     section 2 of the Social Security Number Protection Act of 
     2008.''.
       (e) Authorization of Appropriations.--There are authorized 
     to be appropriated such sums as may be necessary to carry out 
     this section.

                          ____________________