Social Security # on prescription card

[Guest JD698]

Any ideas on how to handle a union member who wants his prescription card ID number to be changed because his id number is currently his SS#. He wants us to change his ID # because he maintains it violates his privacy to have his SS# on the card.

My thought is that since he is the one w/ the card and it is only being distributed to him, that would not be any HIPAA violation and would not require any changes.

He mentioned a concern that whoever makes his card now has access to his SS #.

Please help!!!!!

[jeanine]

Whoever pays his claims has access to his social security number.

We occasionally have requests like this. Our system is set up so that there is no real alternative. If we gave someone a new number it would affect their entire claim paying history. Unless you are in a state that requires you to use an alternate ID number, I would just deny the request. The only alternative we are currently exploring is whether we can just use the last 4 digits on any printed materials--of course the entire number would still be in the system.

[Steve72]

HIPAA doesn't protect SSNs. California has a state law (probably preempted) which might prevent this use. There's currently not any Federal privacy law that would prevent this.

[GBurns]

HIPAA does not preempt many state privacy laws, since many are more restrictive and stringent. As the HHS says HIPAA is only a "floor". See the HHS HIPAA Q&A 89, 108, 163 etc.

Isn't there a Federal Law that says that SS#s should not be used for identification purposes?

Isn't the SS# PHI? and even if not isn't it Private Financial Information under other laws both federal and state?

[Steve72]

"HIPAA does not preempt many state privacy laws, since many are more restrictive and stringent. As the HHS says HIPAA is only a "floor". See the HHS HIPAA Q&A 89, 108, 163 etc."

The California SSN law, when applied to a prescription benefit plan, is preempted by ERISA, not HIPAA.

"Isn't there a Federal Law that says that SS#s should not be used for identification purposes?"

The only currently effective Federal law I am aware of that limits the use of SSNs limits only the U.S. Government's ability to collect SSNs. There's nothing that stops a private entity from using the SSN as an identifier. There are rumblings that such a law is forthcoming, however.

"Isn't the SS# PHI? and even if not isn't it Private Financial Information under other laws both federal and state? "

An SSN is not PHI because it is not health information. The SSN, attached to otherwise anonymized health information, would make the health information PHI. State laws, as mentioned above, likely do not apply to an ERISA health plan. GLBA (which I assume is the Federal privacy law to which you refer) applies only to banks and financial institutions.

Time for an editorial comment: U.S. privacy law is quite a hodgepodge. The attempt to make sector-specific laws, rather than an overarching protection such as that found in Europe has resulted in some unfortunate overlaps and even more unfortunate oversights.

[jeanine]

PHI may be used and disclosed for payment, treatment, and health care operations. We need to be able to identify individuals in order to pay or process claims for them. The only option is to assign them another number. We do not currently support the use of alternate enrollee ID numbers. HIPAA originally called for 10 standards including an individual identifier. That idea was scrapped because of opposition. Your SS# is your default national identifier. If he really doesn't want anyone using his SS#, he can pay for his claims and not use his coverage. I can understand that he might not want it printed on his pharmacy card, just like you can request that your SS# not be printed on your drivers license. The fact that it is not on your license does not mean that you are not registered with your state's DMV under that number. Same issue with the health plan.

[oriecat]

There was an interesting article in the Winter issue of the SSA/IRS Reporter that discussed some of these issues.

See "What Should You Do When Someone Wants Your Social Security Number?" on pages 4-5.

http://www.ssa.gov/employer/winter2002.pdf