Does Medicare's Use of Social Security Numbers Enable Identity Theft?

Posted on 16 February 2012

Printer-friendly versionPrinter-friendly versionSend by emailSend by email

By Joel A. Harrison, PhD, MPH

Identity theft, a growing problem, is regularly in the news. We are warned to keep our Social Security numbers safe, to not carry our SSN cards with us. But recently, I joined the ranks of Medicare recipients and, to my surprise, found that my Medicare number is my SSN number--and we are instructed to carry it with us at all times.

I’ve done everything possible to minimize my exposure. I purchased a cross-cutter, better than a shredder, and use it for all papers with personal information. I purchased a sturdy lock mailbox. I keep no passwords or personal details on my computer, keep my firewall and virus programs up-to-date, and obtained a second credit card with a low maximum for online purchases. I never give out information on the phone and I placed a security freeze on all three credit reporting agencies. (Most precautions I have taken were based on recommendations of the Privacy Rights Clearinghouse at, a superb national organization locally based in San Diego.)

Recently, as a long-time Kaiser member, I opted to join Kaiser’s Senior Advantage.  I can now carry Kaiser’s member card and place my Medicare card in my Safe Deposit Box alongside my SSN card. To avoid the hassle and risk of lost mail, I also opted to have my Medicare Part B electronically drawn from my checking account. I ordered the form from Medicare, filled it out, including my SSN, birthdate, name, and address-- everything necessary for Identity Theft-- and noticed if held up to the light that one could read the contents. I placed it in a security envelope, drove to the nearest post office, and sent it certified mail to ensure it got to its destination.

After the above, I felt that I had done everything necessary to minimize exposure to Identity Theft when I received a “Notice of Medicare Premium Payment Due” with “This is not a Bill” in the upper right corner. And, yep, in two places was my Social Security Number (one at the top and one on the tear off section for those paying by mail).

Every month like clockwork I receive this notice. Given there are over 30 million recipients of Medicare in the U.S., this means that every year over 360 million such notices are mailed. And for those who choose to pay by mail, the number increases substantially. It doesn’t take a rocket scientist to figure out the odds that some will get in the wrong hands. Not yet a recipient of Social Security, I imagine once I opt to start receiving my SSN checks, I will begin receiving additional mailings with my SSN number on them.

I now feel helpless in the face of our own government increasing my risks. I phoned Senator Boxer and Feinstein’s offices, the offices of Congresswoman Susan Davis and Congressman Bob Filner and, hopefully, one or more of them will do something?   

I made the following suggestions:

1. All mailings from Medicare and SSN should contain only the last four digits of the Social Security number. When I contact various companies that I have accounts with, this is all they ask for. This is something so simple, so easy to arrange, that it seems incredible they haven’t thought of it already. Note. Any competent database program can link the name, address, and last four digits for any incoming payment statements.

2. Any forms that we must fill out that require the complete SSN number should have security return envelopes. I buy boxes of 100, only a few cents more per box than regular envelopes. The government purchases 100s of millions, so I’m sure they can negotiate a minimal increase in costs.

3. Finally, DEVELOP A SEPARATE NUMBER IDENTIFICATION SYSTEM FOR MEDICARE. With modern computer databases, Medicare’s computers can easily link any separate Medicare number to the Social Security number.

I understand that there are major problems that our representatives are dealing with; but putting over 30 million Americans at risk for identity theft isn’t a trivial matter and my suggestions, especially the first one, should require only minimal effort, a simple few lines of programming.

If you agree with me that the wide-spread use of our Social Security numbers in Medicare poses an unacceptable and easily corrected risk, I urge you to contact your member of Congress, Senator Boxer and Feinstein’s offices, and any and all local newspapers and magazines.


Joel A. Harrison, PhD, MPH, a native San Diegan, is a semi-retired epidemiologist.  He has worked in the areas of preventive medicine, infectious diseases, medical outcomes research, and evidence-based clinical practice guidelines. He is currently active in supporting the adoption of a single-payer health care system in the U.S. For more information on single-payer go to Physicians for a National Health Program’s website at This article originally appeared in East County Magazine.

There are hundreds of medicare mills in florida that get these numbers, bill for months, than foldup and move on. It has been estimated that a third of medicare is fraud. Now you see why.

If the government runs in, you can be sure it is incompetently run.

I guess that's why Medicare has 3% overhead costs while private insurance has as much as 30%...due to administrative waste, executive salaries, and finding ways to deny care to those sickest. Medicare insures every senior in the country for a fraction of what it would cost if we left it to the private insurance industry death mill.

That's why every other major democratic country in the world has a single payer, non profit health care system...and why we spend twice as much as any other with far worse results - including 50 million uninsured and 45,000 that die every year...all because they can't afford it.

Health care is a human right and a basic human need...thank god for of the most successful programs in American history (outside of social security). If we didn't have it our country would be a hell hole for seniors and our deficits and debts, personal and governmental, would be exponentially worse.

So...nice corporate talking point devoid of reason, fact and compassion.

Jeffson, there are pluses and minuses to government run health care. One minus is that the current record keeping requirements are so onerous that my doctor spends more time on records than on patient care. I offered to pay him directly so that he could take his time, but he told me that is illegal. In any case, there must be a better way.
PS- if you would let me post under my email, you would have one less anonymous

Way to make another pointless comment...yes, there are minuses (no matter how proven superior around the world)...and getting rid of social security numbers is a good fix...

No one, especially those of us that work, again, on public policy, that disagrees with trying to fix parts of the fact, that's what we try and do...but are blocked by the right wing, corporate interests, and corporate democrats, time and time again.

So its more than a bit ironic to have all you people that troll this site complain about things while the very talking point providers you so often regurgitate are those PREVENTING those reforms.

Boggles the mind...

To anonymous:

The current estimates for Medicare fraud are much much lower than your "third." The estimates hover around $50 billion out of the over $500 billion spent by Medicare per year, thus, approximately 10%; but fraud is rampant throughout our health care system. In the past couple of years the FBI has beefed up its investigations of Medicare fraud that have led to a number of convictions; but more could be done. I suggest you read a book by Malcolm K. Sparrow, "License to Steal: Why Fraud Plagues America's Health Care System," Westview Press. The book documents the various ways that fraud is carried out and makes clear that private for-profit companies suffer as much and have not dealt with it any better than Medicare.

What your comment fails to understand is Medicare's role. Medicare covers seniors and people with long term disabilities, e.g. End-Stage Renal Disease. If Medicare did not exist the vast majority of these people would not be able to afford either insurance and/or health care. There are a few people who aren't eligible for Medicare. Check out how much one of the private health insurance companies would charge someone 65 or older per year, well in excess of $20,000 and then only for those without pre-existing conditions. Without Medicare we would consign most of these people to a reduced quality of life and a reduced life-expectancy. And that means most of us, at least those who live to 65 and older.

The working generation pays into Medicare which in turn covers seniors and the disabled (I subscribe to the old adage: "There but for the grace of God go I") and then when the current generation ages and some become disabled, the next generation does the same. This does not differ from public education. When I was in school, not only my parents; but other workers paid the taxes for my education, even those without children, and when I joined the workforce, though I chose not to have children, I paid for the next generations education.

Unless you are a multi-millionaire, Medicare will benefit you. And if we did away with Medicare, even multi-millionaires would face risk. Without Medicare, there would be fewer specialists since Medicare pays for specialty residencies, and many hospitals and doctors would go out of business.

You have done an excellent job in educating these guys...but alas, I assure you, facts are like anthrax to these folks...

Still, what I have realized is that the vast majority of readers that come to this site do so because they know and care about public policy, and may, for some reason, read some of these peoples comments...sadly. So it is helpful for experts to get the facts out...just in case our real readers get sidetracked by the disinformation that permeate this site's comment sections.

So thanks Joel...a good article (exposing an issue that should be corrected with Medicare) and comment.

I was reading from the following site that had various estimates.

Estimates for health care fraud and abuse that
do not include “waste”:

 $125 to $175 billion, according to the Thomson
Reuters report.15
 $75 to $250 billion a year, according to the
FBI, based on the assumption that fraudulent
billings to public and private health care programs
are 3 to 10 percent of total health care
 $60 billion a year, according to the National
Health Care Anti-Fraud Association, an organization
of about 100 private insurers and public
 $32.7 billion or 10 percent (including a federal
share of $18.6 billion) of state Medicaid claims
paid in 2007 were improper, according to the
Estimates for Medicare/Medicaid fraud:
 $100 billion annually in Medicare and Medicaid
fraud, according to the Center for Health Transformation

So, the estimates go from a low of about 10% to a high of 35% (from the FBI). In any case, we do not exactly know how much fraud is in Medicare. But, most estimates have it well over 20% and many have it at 30% or more.

By the way, just maybe this is why private insurance companies have so much overhead. I read one article from an FBI agent about medical fraud and when asked was it a problem with private insurance companies he said, "No, why would you mess with private insurance companies when Medicare is so easy to scam?"

To anonymous:

First, I should have responded to your rant about fraud by pointing out that fraud and identity theft are two separate issues. It would be nice if people who comment on OpEds actually took the time to carefully read them and then comment appropriately rather than using the occasion to vent their own issues and beliefs.

As for the estimates, again you should read carefully. Except for the Thompson Reuters which doesn't give any specifics, all the others include either private insurance and/or Medicaid. Alone, my estimate of Medicare fraud is well within the ballpark.

Again, read Sparrow's book where he documents fraud perpetrated both on Medicare and private insurance before just assuming that private insurance administrative costs are higher because they are better at catching fraud. Not the case; but live in your fantasy world where facts are the enemy of rigid ideological truths.

Private for-profit insurance pays out dividends to stockholders, bloated salaries and bonuses to CEOs and others, commissions to independent insurance salespersons. Private companies each have their own actuaries, issue group and individual policies with different premiums, deductibles, and co-pays. They have to negotiate with individual doctors, doctors groups, hospitals, pharmaceutical companies, etc. They have to administer accounts receivable and pay out claims. Doctors offices and hospitals have to have staff for negotiating with all the different companies, keep straight which patients has which deductibles and co-pays, bill the various companies, etc. And, of course, argue with the companies over denied or delayed claims. In addition, since different policies, even within companies, often have different panels of doctors, it makes for a cacophony of chaos.

When I was a kid my family doctor had one or two specialists in each specialty who he knew personally and referred patients to. Patients could, of course, go elsewhere; but it gave a continuity to care. Nowadays, doctors have to often refer to specialists and hospitals within a health care plan.

None of the above prevents or catches health care fraud. In fact, it makes it easier because of so many nodes in the process that fraud can take advantage of. What is also interesting is that most modern industrialized countries with universal health care have lower rates of fraud. Another fact ignored is when legislators, for instance, in California have tried to clamp down on fraud, the very people committing the frauds use lobbying power to stop or water down new regulations.

I would love to see even more FBI agents dealing with fraud and even more serious penalties and jail time; but whether fraud is 10% or higher the fact still remains that without Medicare almost all Americans except the extremely wealthy would have to look forward to reduced quality of life and shortened life-expectancy due to lack of health care. The private sector simply would not offer insurance at prices affordable for most given the much higher rates of pre-existing conditions, something that simply comes with aging.

This is all a breath of fresh air for me here Joel...keep bringing in the sunlight my friend.

It definitely is!
First, before I get into the sarcasm that Jeffson enjoys so much, run, don't walk, to your PC and file to get your free credit reports. Then do two things. On Experian or Equifax or Transunion file a fraud alert, and then (probably via phone) create a "Consumer Statement" on your credit report to the effect that before any merchant, bank, etc grants credit in your name they should contact you by phone AND email. Of course, you will need to provide your number and email. The Fraud Alert and Consumer Statement are your main weapons in this fight. Second, after you review your credit reports, call the reporting agencies and ask them to clean up your files. Third, when asked for your birthdate (online), lie, unless that would be a felony.
I'll follow up with some horror stories, and some sarcasm about Congress, the FTC, and the Courts not giving a darn about you with respect to identity theft, and it being our fault for electing the people that we do.
Best wishes, Erik

Do a google search on Karen Lodrick to find an SFGATE.COM article on what she went through because Wells Fargo sent her an unsolicited offer. The date of the article is June 15, 2007.
By the way, Wells Fargo's Senior VP in San Francisco just sent (1/31/12) a letter to home equity customers inviting them to "make the most of your home equity account." Enclosed were three blank checks for the account! I'm trying to get his phone to call and explain why his action wasn't in the customers' best interest. I've got more stories - if you want them, ask Jeffson to ask me.

I guess I'll skip the remarks about why are Boxer and Feinstein and all the rest still in office, and how everyone gets the government some people deserve, and focus on the narrow matter of the FTC and their rule making. If you read the Fair and Accurate Credit Transactions Act you'll find that Credit Reporting agencies can accept erroneous information, put it in your file, and suffer at most a slap on the wrist. Never mind the damage that can do to you. But, if you look at someone's file, and you are not authorized, woe unto you. So, how do the Credit Reporting Agencies get off so lightly? Congress, bought by industry. Congress is not on your side, mainly because you don't descend on Congress with a few hundred of your friends. The FTC is not on your side, because you and almost everyone else are silent when it comes time to comment on their rules.
By the way, I just tried to find a current copy of the CFR on FACTA. Had to call the FTC and have someone walk me through their web site. Took 30 minutes. Try

To anonymous:

My OpEd dealt with Identity Theft and called for some simple changes such as using only the last four digits of ones Social Security Number, nothing more, nothing less. And if you had actually read and understood my OpEd you would have noticed I mentioned getting a Security Freeze put on all three credit reporting agencies. Do that and it protects you against most fraudulent usages. However, protecting ones SSN is always a worthwhile exercise.

I really think the webmaster for this site should ban your comments as they are tiresome. Either actually comment on what someone writes or find some other venue to waste your time and that of others!

As for Boxer and Feinstein, the truth is that due to the enormous amounts of money it takes to get elected the majority of elected politicians regardless of their intentions sooner or later succumb to the influences of money from lobbyist and their ilk. Though you don't give the impression you really spend much time studying issues, besides Sparrow's book on medical fraud, try reading Thomas Frank's book "The Wrecking Crew" about the growth of lobbyist and influence on government. Most members of Congress spend more time pursuing money for their next campaign than actually legislating.

There is so much wrong with our polity that it's hard to come up with any steps that would change things. One step that would at least allow for the possibility of other actions is a Constitutional Amendment repealing the artifical court creation of Corporate Personhood which ended with Citizens United where the Supreme Court accorded Bill of Rights protections for living breathing people to Corporations allowing them to use unlimited funding to influence elections. No other democracy in the world gives such rights and protections to corporations. Corporations are artificial entities created by laws written by living breathing people, not creations of human procreation. One website with extensive information on Corporate Personhood and a suggested Amendment is

Thank you for sharing this great and necessary information. Now I know I am not just paranoid as I have taken the same precautions and everyone thinks I am overdoing it. In addition, I am having difficulty applying for jobs because my credit is intentionally frozen. So when you write to your public officials PLEASE ask them to stop employers from checking our credit unless we are doing the books or accepting money so those of us who are smart enough to do what you have done will not suffer the consequences. FYI did you know that you can ask the social security folks for a NEW SOCIAL SECURITY NUMBER? This is my next step in my efforts to stay safe. thanks again for helping to bring these issues to light!

AB 22 (Mendoza) was legislation that passed that will stop employers from checking your credit report unless it's somehow relevant to the job you're applying for. If you find employers are still doing this after Jan 1 2012, it is illegal! The last thing job seekers need is employers checking their credit (especially those who have been out of work for awhile and may not have great credit).

Thanks for this post. I've sent letters to my representatives about this, and your post provides more ammunition for calling their offices and making a pest of myself. I was a victim of identity theft a number of years ago -- fortunately by an unsophisticated thief, so the damage wasn't extensive -- because my HMO also used SSNs. The HMO changed my number on request, and subsequently adopted different numbers for everyone. I think Medicare will change the number on request, but it can't be done online . . .