Many physicians ask patients to provide their Social Security numbers (SSNs), but more patients are resisting providing this information. Is this something physicians should quit requiring?

Posted in Risk Management on Tuesday, July 31, 2018

You can expect to see this happen more frequently in your practice as patients become more aware of the risk of identity theft. Unfortunately, SSNs have become prized targets of identity thieves.

Widely publicized thefts of laptops and other electronic data storage devices have resulted in the unauthorized release of millions of personal health and financial records. The countless articles on the topic almost always warn about the need to safeguard SSNs and challenge the need to provide it—even in healthcare settings. 

The vast majority of private healthcare insurers have stopped using SSNs as a member’s identification number. Some insurers ceased this practice as a direct result of state legislation prohibiting the practice. Others stopped because they recognized both the risks and the additional efforts required to safeguard SSNs—particularly since HIPAA was enacted. Medicare and most state Medicaid programs still use the SSN as the patient identifier, but even those programs are under pressure to discontinue the practice.

Many states have enacted legislation that minimizes or restricts the collection, use, storage and retention of Social Security numbers. Some specifically address and mandate privacy protection efforts for collecting and storing SSNs electronically. Others speak to release requirements (e.g., only the last four digits of an SSN). It’s important to consult a practice attorney to determine your state’s requirements for SSNs, and to review your practice policies and protocols to ensure compliance.

For these reasons, it’s advisable to consider changing your system to accept a patient identifier other than the SSN for your record management. In most cases, the SSN shouldn’t be necessary for your recordkeeping and claims processing. If an SSN is needed, for example, to coordinate covered benefits for a patient and spouse, a request can be made to the patient at that time.

Be aware that it is only a matter of time before the practice of using SSNs as patient identifiers is universally prohibited. In the meantime, expect to continue to be challenged by patients in this area.

As a policyholder, if you have questions about the potential risks of using SSNs in your practice, please contact us.