Social Security: Government and Other Uses of the Social Security Number
are Widespread (Testimony, 05/18/2000, GAO/T-HEHS-00-120).

GAO discussed the usage of the Social Security number (SSN), focusing
on: (1) the ways that the federal government uses SSNs and current
restrictions on these uses; (2) the nonfederal purposes for which the
number is used; and (3) what businesses and state governments believe
the effect would be if federal laws limiting the use of SSNs were
passed.

GAO noted that: (1) the federal government, state and local governments,
and private businesses all widely use SSNs; (2) in the case of the
federal government, a number of laws and regulations require the use of
SSNs for various programs, but they generally also impose limitations on
how these SSNs may be used; (3) however, no federal law imposes broad
restrictions on businesses' and state and local governments' use of SSNs
when that use is unrelated to a specific federal requirement; (4)
governments and businesses frequently use SSNs to identify and organize
individuals' records; (5) some may also use SSNs to exchange information
with other organizations to verify information on file, to coordinate
benefits or services, or to ensure compliance with certain federal laws;
(6) for example, by sharing information about applicants for the
Supplemental Security Income (SSI) program, the Social Security
Administration (SSA) can identify individuals whose benefits should be
reduced, such as those in prison; (7) in addition, some information
brokers use SSNs to retrieve the large amount of personal information on
individuals that they collect and sell; (8) public concern over the
availability of personal information has encouraged some to consider
ways to limit using SSNs to disclose such information; (9) however,
officials from both state governments and private businesses have stated
that if the federal government passed laws that limited their use of
SSNs, their ability to reliably identify individuals' records would be
limited, as would their subsequent ability to administer programs and
conduct data exchanges with others; and (10) nonetheless, some state
agencies and businesses have voluntarily taken steps to limit their
disclosure of SSNs.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-HEHS-00-120
     TITLE:  Social Security: Government and Other Uses of the Social
	     Security Number are Widespread
      DATE:  05/18/2000
   SUBJECT:  Social security number
	     Right of privacy
	     Federal social security programs
	     Tax administration
	     Reporting requirements

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************

GAO/T-HEHS-00-120

   * For Release on Delivery
     Expected at 2:00 p.m.

Thursday,

May 18, 2000

GAO/T-HEHS-00-120

social security

Government and Other Uses of the Social Security Number are Widespread

        Statement of Barbara D. Bovbjerg, Associate Director

Education, Workforce, and Income Security Issues

Health, Education, and Human Services Division

Testimony

Before the Subcommittee on Government Management, Information, and
Technology, Committee on Government Reform, House of Representatives

United States General Accounting Office

GAO

Social Security: Government and Other Uses of the Social Security Number are
Widespread

Mr. Chairman and Members of the Subcommittee:

Thank you for inviting me here today to discuss usage of the Social Security
number (SSN). The SSN was created in 1936 as a means of tracking workers'
earnings and eligibility for Social Security benefits. Today over 277
million individuals have a unique SSN. For this reason it is used for myriad
purposes not related to Social Security. Both private businesses and
government agencies frequently ask individuals for their SSNs because in
certain instances they are required to or because SSNs provide a convenient
means to track and exchange information.

Perceived widespread sharing of personal information and occurrences of
identity theft have raised public concern. To provide information about how
the SSN is currently used, in my remarks today I will describe (1) the ways
that the federal government uses SSNs and current restrictions on these
uses, (2) the nonfederal purposes for which the number is used, and (3) what
businesses and state governments believe the effect would be if federal laws
limiting the use of SSNs were passed. My testimony is based on findings from
a study we conducted during 1998 and recent work conducted to update our
information.

In summary, the federal government, state and local governments, and private
businesses all widely use SSNs. In the case of the federal government, a
number of laws and regulations require the use of SSNs for various programs,
but they generally also impose limitations on how these SSNs may be used.
However, no federal law imposes broad restrictions on businesses' and state
and local governments' use of SSNs when that use is unrelated to a specific
federal requirement. Currently, governments and businesses frequently use
SSNs to identify and organize individuals' records. Some may also use SSNs
to exchange information with other organizations to verify information on
file, to coordinate benefits or services, or to ensure compliance with
certain federal laws. For example, by sharing information about applicants
for the Supplemental Security Income (SSI) program, the Social Security
Administration (SSA) can identify individuals whose benefits should be
reduced, such as those in prison. In addition, some information brokers use
SSNs to retrieve the large amount of personal information on individuals
that they collect and sell. Public concern over the availability of personal
information has encouraged some to consider ways to limit using SSNs to
disclose such information. However, officials from both state governments
and private businesses have stated that if the federal government passed
laws that limited their use of SSNs, their ability to reliably identify
individuals' records would be limited, as would their subsequent ability to
administer programs and conduct data exchanges with others. Nonetheless,
some state agencies and businesses have voluntarily taken steps to limit
their disclosure of SSNs.

Federal Laws and Regulations Require and Restrict Certain SSN Uses

The Internal Revenue Code and regulations that govern the administration of
the federal personal income tax program require that individuals' SSNs serve
as taxpayer identification numbers. Employers and others making payments to
individuals must include the individual's SSN in reporting to the Internal
Revenue Service (IRS) many of these payments. Reportable payments include
interest payments to customers, wages paid to employees, dividends paid to
stockholders, and retirement benefits paid to individuals. Other reportable
transactions include purchases involving more than $10,000 cash and mortgage
interest payments totaling $600 or more. In addition, the Code and
regulations require that individuals filing personal income tax returns
include their SSN and those of any dependents or former spouses to whom they
pay alimony. Using the SSNs, the IRS matches the information supplied by
entities reporting payments or other transactions with returns filed by
taxpayers to monitor individuals' compliance with federal income tax laws.

Similarly, the Social Security Act requires individuals to provide their
SSNs in order to receive benefits under the SSI, food stamp, Temporary
Assistance for Needy Families (TANF), and Medicaid programs-programs that
provide benefits to people with limited income. Applicants give program
administrators information about their income and resources, and program
administrators use applicants' SSNs to match records with those of other
organizations to verify the information. Using SSNs to match records
enhances program payment controls and reduces fraud and abuse. For example,
SSA uses SSNs to determine whether applicants for SSI benefits have
accurately reported their income by matching records with the Department of
Veterans Affairs, the Office of Personnel Management, and the Railroad
Retirement Board to identify any retirement or disability payments to these
individuals. In fact, we have recommended in previous reports that SSA match
its records with other state and federal program records to reduce SSI
payments to individuals whom agencies find residing in nursing homes and
prisons. In 1997, SSA estimated that overpayments to individuals in nursing
homes may have exceeded $100 million annually because SSA was unaware that
some SSI benefit recipients were in facilities where their care was paid by
Medicaid, and thus they continued to receive SSI benefits. In recent years,
SSA has made approximately $1 billion in annual overpayments to SSI
recipients. It is especially important to prevent these overpayments because
recovering them once they have been paid out is difficult. The gap between
what is collected and what is owed the SSI program is continuing to grow
each year.

Similarly, the Commercial Motor Vehicle Safety Act of 1986 requires states
to use individuals' SSNs to determine if an individual holds a commercial
license issued by another state. This checking is necessary because
commercial drivers are limited to owning one state-issued driver's license.
States may also use SSNs to search a database to determine whether an
applicant's license has been cancelled, suspended, or revoked by another
state. In these situations, states use SSNs to limit the possibility of
inappropriately licensing applicants. Also, federal law requires that states
use SSNs to maintain records of individuals who owe state-ordered child
support or are owed child support and to collect from employers reports of
new hires identified by SSN. States then transmit this information to the
Federal Parent Locator Service, an automated database searchable by SSNs.
The use of SSNs in these instances ensures compliance with federal tax laws,
enhances program payment controls, reduces the possibility of
inappropriately licensing applicants, and facilitates enforcement of child
support payments.

Federal laws that require the use of an SSN generally limit its use to the
statutory purposes described in each of the laws. For example, the Internal
Revenue Code, which requires the use of SSNs for tax purposes, also declares
tax return information, including SSNs, to be confidential and prescribes
both civil and criminal penalties for unauthorized disclosure. Similarly,
the Social Security Act, which requires the use of SSNs for disbursement of
benefits, declares that SSNs obtained or maintained by authorized
individuals on or after October 1, 1990, are confidential and prohibits
their disclosure. Finally, the Personal Responsibility and Work Opportunity
Act, which expanded the Federal Parent Locator Service, explicitly restricts
the use of SSNs to purposes set out in the act, such as locating absentee
parents to enforce child support payments.

In addition to the restrictions contained in laws that require the use of
SSNs, the Privacy Act of 1974 also restricts federal agencies in collecting
and disclosing personal information, which includes SSNs. The act requires
federal agencies that collect information from individuals to inform the
individuals of the agencies' authority for requesting the information,
whether providing the information is optional or mandatory, and how the
agencies plan to use the information. The act, which also prohibits federal
agencies from disclosing information without individuals' consent, does not
apply to other levels of government or to private businesses.

Except as discussed above, federal law does not regulate the use of SSNs.
Thus, nonfederal agencies and legitimate businesses use SSNs in ways not
covered by federal law, which I will now discuss.

Governments and Businesses Use SSNs Extensively

State Agencies

All states that have personal income tax use SSNs to administer their
programs, according to an official at an organization representing state tax
administrators. States use SSNs as primary identifiers in their programs and
for auditing purposes. Tax administrators from Maryland and Virginia told us
that their states require individuals to provide their SSNs on state tax
returns and that those who do not risk being considered nonfilers if tax
administrators cannot otherwise identify them. In order to monitor taxpayer
income reporting, states rely on SSNs to match data with IRS and state tax
agencies. In addition, tax administrators said they use SSNs to
cross-reference owners' or officers' business income tax returns with their
personal income tax returns so that an audit of one triggers an audit of the
other. They also use SSNs to identify residents who received income or tax
credits in other states. Finally, when they assess liens against a taxpayer,
tax administrators may also use SSNs to gather information from credit
bureaus and information brokers about a taxpayer's assets.

State driver licensing agencies are more likely to use SSNs to exchange data
with other organizations than to support internal activities. Information
from the American Association of Motor Vehicle Administration (AAMVA) and
other sources suggests that many states request, but may not require,
applicants for noncommercial driver licenses to provide their SSNs. Most
state driver licensing agencies that request SSNs include SSNs in driver
records as a secondary identifier and devise their own license numbers. To
monitor drivers' compliance with state laws, state officials said they use
SSNs during the licensing process to search national databases maintained by
AAMVA. This allows states to identify driver licenses an applicant may hold
in other states and to determine whether the applicant has had a license
suspended or revoked in another state. Licensing officials told us that
courts and law enforcement agencies may request driver records by SSN when
they do not know the driver's license number. In the past, some states have
sold personal information collected from drivers and automobile owners,
including SSNs, to individuals and businesses. However, the federal Drivers'
Privacy Protection Act now prohibits states from disclosing this personal
information for purposes such as surveys, marketing, and solicitation
without the express consent of the individual.

Having discussed how state governments use SSNs, I would like now to focus
on how private businesses use these numbers. Specifically, I will discuss
use of SSNs by health care service organizations, financial services
businesses, and businesses that sell information.

Health Care Services Organizations

Officials representing hospitals, a health maintenance organization (HMO),
and a health insurance trade association told us that their organizations
always ask for an SSN, but they do not deny services if a patient refuses to
provide the number.

Officials from a hospital and an HMO told us that although they ask patients
for their SSNs, they assign patients other identifying numbers, which they
use internally as the primary identifiers for patient medical records. If a
patient either forgets or does not know the patient number he or she was
assigned then the hospital or HMO uses SSNs as a backup to identify records.
These officials also told us that hospitals and HMOs use SSNs to track
patients' medical care across multiple providers because doing so helps
establish a patient's medical history and avoid duplicate tests. Similarly,
health care providers use SSNs to integrate patients' records when providers
merge, a trend that is growing.

We also spoke with a representative from a health insurance trade
association to understand how insurers use SSNs. He told us that some health
insurers use the SSN or a variation of the number as the customer's
insurance number. We were told that the BlueCross BlueShield health
insurance plans and the Medicare program frequently use this method. This
representative also said that insurers and providers frequently match
records among themselves, using SSNs to determine whether individuals have
other insurance. This allows insurers to coordinate payment of insurance
benefits.

Officials in the health care industry expect their use of SSNs to increase.
Because health care services are generally delivered through a coordinated
system that includes health care providers and insurers, it is important for
health care providers to be able to accurately identify information about
patients. However, health care providers may also use SSNs to gather
information that is not directly relevant to a patient's health care. For
example, one hospital official said that her hospital plans to use SSNs
during the admission process to obtain on-line verification of patients'
addresses.

Financial Services Businesses

Businesses such as insurance companies, collection agencies, and credit
grantors use SSNs to request information about customers from credit
bureaus. Banks and credit card companies in particular want information on
customers' histories of repaying debts and whether customers have filed for
bankruptcy or have monetary judgments against them, such as tax liens.
Officials representing credit grantors said most banks and credit card
companies ask applicants to provide their SSNs, and these credit grantors
may choose to deny services to individuals who refuse. These officials said
that their organizations generally do not use SSNs as internal identifiers
but instead assign an account number as a customer's primary identifier.

Businesses That Sell Personal Information

Brokers buy and sell information from and to a variety of public and
nonpublic sources. Examples of the information they buy include public
records of bankruptcy, tax liens, civil judgments, real estate ownership,
driving histories, voter registration, and professional licenses. The
information broker's purchase may include SSNs. Some brokers sell
information only to businesses that establish accounts with them; others
sell it to anyone. Law firms, law enforcement agencies, research
organizations, and individuals are among those who use brokers' services.
For example, lawyers, debt collectors, and private investigators may request
information about an individual's bank accounts and real estate holdings for
use in divorce or other civil proceedings; automobile insurers may want
information about whether insurance applicants have been involved in
accidents or have been issued traffic citations; employers may want
background checks on new hires; pension plan administrators may want
information to locate pension beneficiaries; and individuals may ask for
information to help locate their birth parents.

To meet the needs of the parties to whom they sell information, information
brokers have databases that can be searched by identifiers that may include
SSNs; brokers may also include SSNs along with the other information they
provide to customers. When possible, information brokers retrieve data by
SSN because it is more likely than other identifiers to produce records for
a specific individual.

Business and State Officials Believe Federal Laws Restricting Uses of SSNs
Would Have a Negative Effect on Their Activities and Programs

Because of privacy concerns raised by the disclosure of personal
information, some businesses and states have voluntarily restricted their
disclosure of such information, including SSNs. In December 1997, 14 of the
self-identified industry leaders of those businesses that sell personal
information voluntarily agreed to make the SSNs they obtain from nonpublic
sources available only to a limited range of customers. They identified such
customers as those having appropriate uses for this information, such as law
enforcement. Although these brokers agreed to limit their disclosure of SSNs
obtained from nonpublic sources, it should be noted that most of the SSNs
they acquire come from public sources, according to an official from an
information brokerage company. As part of their agreement regarding
disclosure of SSNs, the 14 organizations also agreed to annual compliance
reviews by independent contractors. If an organization fails to comply with
the agreement, the Federal Trade Commission can cite the organization for
unfair and deceptive business practices. The agreement became effective on
December 31, 1998. Recent reports indicate that the first round of
compliance reviews is complete and all of the companies have generally
complied with the agreement.

In addition to the voluntary efforts of businesses, some states are
discontinuing practices that result in routine disclosure of SSNs. For
example, since July 1, 1997, Georgia no longer automatically prints SSNs on
licenses but rather assigns its own numbers for driver licenses and uses the
SSN as a license number only if requested by the license holder to do so.
Ohio, which before July 29, 1998, routinely printed SSNs along with
state-assigned numbers on driver licenses, now allows drivers the option of
not having SSNs printed on their licenses. Also, AAMVA officials believe
most states in which driver records are public now exclude SSNs when
responding to requests for driver records.

Finally, SSA has stated that the expanded use and misuse of SSNs poses an
administrative burden for the agency. According to agency officials,
widespread use of SSNs as identifiers requires SSA to meet more requests for
SSN verification from employers and government agencies. In addition, the
disclosure of SSNs increases those instances in which the agency must issue
individuals new SSNs when theirs are being misused by another party.

Concluding Observations

Mr. Chairman, this concludes my prepared statement. At this time, I will be
happy to answer any questions you or other Members of the Subcommittee may
have.

GAO Contact and Staff Acknowledgments

(207100)

        Orders by Internet

For information on how to access GAO reports on the Internet, send an e-mail
message with "info" in the body to:

[email protected]

or visit GAO's World Wide Web home page at:

http://www.gao.gov

        Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected]

1-800-424-5454 (automated answering system)
  
*** End of document. ***