A few previous discussion threads on this topic, and we see that mjb is consistent in his opinion that such state statutes are pre-empted by ERISA. (My opinion on that is irrelevant.) What is relevant is the strong trend on the part of employers/plan sponsors to make sure they are not part of the "identity theft problem", and many are voluntarily finding ways to "mask" the social security number. This is a good thing, and should be encouraged.