SSN Reduction
Department of Veterans Affairs (VA) implemented its Social Security Reduction (SSN Reduction) initiative in 2007 at the request of the Office of Management and Budget (OMB) in an effort to reduce unnecessary collection and use of social security number (SSN) as the main identifier.
Some of the places SSNs have been removed from include Veteran Identification Cards, prescription labels, mailing labels, several forms, and most appointment letters.
Stomping Out the Unnecessary Collection and Use of SSNs
VA is committed to reducing the unnecessary collection and use of Veteran SSNs, whenever feasible, and is devoting considerable resources to do so.
Also note SSNs will continue to be used if required by law, such as computer matching of records between government agencies, as an attribute in support of unique identification, or as a backup identifier if issues arise over new primary identifier(s).
Currently, VA uses SSNs to identify Veterans and other beneficiaries to ensure the accurate delivery of VA benefits and services, and to identify employees for employment-related record keeping.
Each fall, VA submits its Department-level SSN Reduction Plan to OMB as an attachment to VA’s annual Federal Information Security Management Act of 2002 (FISMA) Report. The most recent plan can be accessed at the link below.
Eliminating Unnecessary Collection and Use of Social Security Numbers at the Department of Veterans Affairs – September 2014
Background
In 2007, OMB directed all Federal agencies to develop and implement a plan to eliminate the unnecessary use of SSNs. In addition, all Federal agencies were urged to explore alternatives to agency use of SSNs as personal identifiers for Federal employees and individuals participating in Federal programs. The OMB guidance was based largely on the findings and recommendations of the President’s Identity Theft Task Force. In response to this mandate, VA’s Office of Privacy and Records Management (OPRM) monitors the Department’s SSN reduction activities. VA's initial plan was submitted to OMB in September 2007 as part of VA's FY 2007 annual and Federal Information Security Management Act (FISMA) report. Since then, it has been updated and re-submitted annually to OMB.
SSNs – Highlights of SSN reduction activities to date include:
- Veteran Identification Cards issued since 2004 no longer display a Veteran's SSN. Instead, a Veteran’s SSN is contained within a barcode and magnetic strip.
- Veteran SSNs were removed from health care authorization cards issued for the Civilian Health and Medical Program of Department of Veterans Affairs (CHAMPVA), the Spina Bifida Health Care Program (SB), and the Children of Women Vietnam Veterans Health Care Program (CWVV).
- Veteran SSNs were either removed from or truncated to the last four digits on most VA correspondence. >
- Veteran SSNs no longer appears on VA prescription labels, bottles or mailing labels.
- VA Directive 6507, Reducing the Use of Social Security Numbers, was implemented in November, 2008. It outlines VA policy requirements to reduce and, where possible, eliminate the collection and use of the SSN as a primary identifier for uniquely identifying individuals in VA operations, programs, and services. It also requires each Administration and Staff Office to inventory its SSN collections and uses, and develop and implement its own SSN reduction plans.
- In 2010, the Veterans Health Administration (VHA) completed an inventory of its SSN collections and uses. VHA found more than 11,000 processes and over 25,000 instances. In 2011, VHA program offices and local facilities developed plans of action and milestones for reducing unnecessary SSN usage within VHA.
- Handbook 6507.1, Acceptable Uses of the SSN and the VA SSN Review Board, was signed in September, 2011. It provides specific guidance on acceptable uses of the SSN within VA. It also calls for the creation of a VA SSN Review Board, to oversee current and future uses of SSNs.
- In June 2010, the Department announced the creation of a VA Identification Management Policy. The goal was to create a Master Veteran Index (MVI) that would be the Department’s authoritative identity service. The MVI was created, and work continues to:
- Establish unique identities within VA for all persons of interest to VA (e.g., Veterans, beneficiaries, employees, contractors, and affiliates);
- Include the Department of Defense’s (DoD’s) Identification Number (formerly called the Electronic Data Interchange Personal Identifier, or EDIPI) as an identity trait for all individuals within the MVI. (As of June 1, 2011, this number replaced the SSN on all new and renewed DoD identification cards);
- Establish a correlation with external partners sharing information with VA, including DoD and the Nationwide Health Information Network;
- Manage updates to identity traits and share those with integrated systems; and
- Maintain the location of all client records (e.g., Veterans and beneficiaries) within VA.
- In 2011 and 2012, the MVI processed millions of correlations between VHA records and DoD records. This allows increased interoperability with DoD, reduces the need for separate legacy identity services, and improves the processes for matching DoD and VA records. Approximately one million records must still be correlated before the Departments achieve full synchronization.
- In 2012, VBA replaced SSNs with DoD identification numbers on outreach letters sent to active duty and recently separated service members (one of the few remaining pieces of correspondence that continued to use full SSN).
Employee SSNs – Highlights of VA SSN reduction activities to date include:
On April 28, 2011, new employee identification numbers were installed in VA’s human resources (HIR) system. VA HR offices will use the new numbers, instead of SSNs, for most internal HR-related activities. However, the SSN will continue to be the official Federal employee identifier and will remain on Office of Personnel and Management employee forms.
Strengthening Protections of Continued Internal Uses of the SSN – Examples include:
- VA installed a filter at all VA electronic mail gateways that scans all outgoing e-mails and MS Office attachments (MS Word, PowerPoint, Excel) for patterns resembling the SSN. If a pattern is recognized, the email is not sent.
- VA deployed Rights Management Service (RMS) nationwide for internal communications. RMS is encryption security for Microsoft Outlook email messages and files using Microsoft applications. RMS is persistent protection that stays with a message or attachment even after it is opened. RMS works in conjunction with Public Key Infrastructure (PKI).
- VA implemented Remote Enterprise Security Compliance Update Environment (RESCUE). RESCUE enforces VA remote access requirements by ensuring all client computers comply with VA policy prior to the granting of remote access.
Key SSN Reduction Activities for FY 2014
- The new Veteran Health Identification Card (VHIC) displays the Veteran’s Electronic Data Interchange Personal Identifier (EDIPI) on the front of the card. The EDIPI is also included in the bar code and magnetic stripe, and the SSN has been removed. The Integration Control Number (ICN) will remain in the barcode and magnetic stripe, to serve as the VA’s primary patient identifier. Meanwhile, VA is continuing to replace the old Veteran Identification Card (VIC) with the new VHIC for Veterans who need replacement.
- VA continues to develop and enhance the eBenefits Portal, a joint VA/DoD web portal that provides resources and self-service capabilities to Veterans. Registering for and using the eBenefits DS Logon allows the Veteran to access his or her personal information with a username and password through the secure web portal, eliminating the need to provide his or her SSN.
- The VA Privacy Service awarded a contract in FY 2014 for developing a VA SSN database inventory tool to collect and analyze SSN collections and uses for the Veterans Benefits Administration (VBA), the National Cemetery Administration (NCA), and other VA Program Offices.
- VA systems from NCA will have their records enumerated to the MVI, establishing unique identifiers for NCA’s Veterans, beneficiaries, and clients. Also, VA will begin working on how to implement the correlation of VBA records to the MVI.
- VHA will continue to assess alternatives to having a Veteran’s SSN display on the patient wristband.
- Medical Records Review Committees within VHA have been tasked with reviewing and where possible, eliminating the use of SSN on forms and templates for either initial use or revision.
- Within VHA facilities, paper forms scanned into the health record containing the full SSN, continue to be modified as deemed appropriate to only include the last four digits of the SSN as written in the current version of the VHA Handbook 1907.0,1 “Health Information Management and Health Records.”
General Contacts
For further information, contact the Privacy Service at 202.273.5070 or privacyservice@va.gov.
