SSN Justification

Attachment B
The Need for Medicare Beneficiary Identifier and/or
Social Security Numbers

The Centers for Medicare & Medicaid Services (CMS) seeks to collect various data
elements from the applicable reporting entities for purposes of implementing the
mandatory Medicare Secondary Payer (MSP) reporting requirements of Section 111 of
the Medicare Medicaid and SCHIP Extension Act of 2007 (P.L. 110-173). The reporting
of the Medicare Beneficiary Identifier (Mbi), formerly the Medicare Health Insurance
Claim Numbers or, if unavailable, Social Security Numbers (SSNs) in rarer
circumstances may be identified, is critical for accurate coordination of benefits.
The Medicare program uses the Mbi to identify Medicare beneficiaries receiving health care
services and to otherwise meet its administrative responsibilities to pay for health care and
operate the Medicare program. Pursuant to 42 U.S.C. 1395y(b), Medicare is the secondary
payer to GHP coverage under certain defined circumstances; and to liability insurance
(including self-insurance), no-fault insurance, and workers’ compensation (collectively
referred to as “NGHP” coverage).
Medicare uses an individual’s Mbi to ensure that Medicare makes payment in the proper
payer order and/or takes the necessary recovery actions. Absent the Mbi, CMS would not
be able to systematically link the reported data to a particular Medicare beneficiary. While
the Mbi is the CMS required data element, if an insurer is unable to obtain an Mbi we
request that they provide an SSN. Although the SSN is not a required data element, itis
only used as the basis for identifying a Medicare beneficiary in lieu of the Mbi. CMS will
use the SSN to retrieve the Mbi from the CMS system. It should be noted that obtaining and
the retention of the SSN by the RRE is no more of a burden than and insurer obtaining and
retaining the Mbi. For the NGHP insurer it would be less of a burden for them to initially
obtain the SSN from the beneficiary and keep this information on file until they provide the
SSN to CMS. When the RRE sends an SSN to CMS then Mbi is then returned to the RRE
for retention and future use. Once an Mbi is sent to the RRE it is expected that the RRE will
no longer utilize the SSN.
Effective January 5, 2015, in the case where a NGHP RRE cannot obtain an individual’s
Mbi, or full SSN, the NGHP RRE may provide the last 5 digits of the individual’s SSN,
first initial, surname, date of birth, and gender. NGHP RREs may continue to submit the
Mbi or full SSN as before without making any changes to the field and file formats.
We understand that some individuals may be hesitant about providing their M b i’ s or
SSNs. CMS recognizes that the collection and use of individual M b i or SSNs is
limited by an evolving body of federal and state law and regulation. When an Mbi or
SSN is to be used for personal health information, management of the Mbi/SSN (e.g.,
1

who can collect it, for what reason and with what other entities or persons will it be
shared) is directed by regulations required by the federal Health Insurance Portability and
Accountability Act (HIPAA). These regulations are referred to as the HIPAA privacy
rules. These rules are quite strict, and after they were fully implemented in 2004, measures
to protect personal health information became stronger. Collection of Mbi’s and SSNs
for the purposes of coordinating benefits with Medicare is a required, legitimate and
necessary use of the Mbi/SSN under Federal law.
We also note that there are some state laws that restrict when SSNs can be collected and
how SSNs can be used. These state initiatives do not preempt the MSP statutory or
regulatory provisions or the “permitted use” provisions of the HIPAA privacy rules. These
referenced federal laws allow for the collection and use of the SSNs to help
providers and insurers manage their operations. Some states now restrict how SSNs may
be displayed, such as prohibiting a health plan from including an SSN on an individual’s
plan ID card. Such state laws are permissible, to the extent they augment but do not
conflict with or constrain the will requirements of federal laws or regulations.

2