If the Doctor Asks for Your Social Security Number, Do This
Consumer Reports has no financial relationship with advertisers on this site.
You’re filling out forms at a doctor’s office, hospital, or other healthcare facility and come to a line asking for your Social Security number.
Should you write those nine digits down?
Generally, no, say privacy experts. “Having Social Security numbers at the doctor’s office is a data breach risk, and it’s one that’s increasing,” says Pam Dixon, executive director of the nonprofit World Privacy Forum.
If stolen, your SSN offers thieves easy access your personal health and financial information, and they could possibly steal your identity.
This makes SSNs much sought-after commodities on the black market. In fact, the 2018 Identity Fraud Study from Javelin Strategy & Research, found that for the first time, more SSNs than credit card numbers were stolen last year.
And sensitive information like Social Security numbers is taken in more than 70 percent of hospital data breaches, according to a recent study in the Annals of Internal Medicine.
Plus, for the most part—there are a few exceptions—healthcare providers don’t really need your SSN, though some may want it to track you down if billing issues arise.
“So, when my healthcare provider asks for my Social Security number, I leave the line blank and recommend other patients do so as well," says Dena B. Mendelsohn, senior policy counsel for Consumer Reports.
But what if a healthcare provider, doctor’s office receptionist, office manager, or hospital employee insists? Here’s our advice.
Know the Law
Generally, you're under no obligation to provide your SSN to healthcare providers (but they’re not obligated to take you as a patient either). Health insurers will likely ask for it, and you do have to offer it up if you’re entering a VA hospital.
And as of last April, the rollout of the new non-SSN Medicare ID cards was completed. Medicare IDs cards used to include Social Security numbers, but now have an 11-character Medicare Beneficiary Identifier (MBI), that’s a mix of letters and numbers.
If you use Medicare, you have to share your MBI with healthcare providers. According to Medicare, you need to protect the new card as you would a credit card, giving the number only "to doctors, pharmacists, other healthcare providers, your insurer, or people you trust to work with Medicare on your behalf." (And watch out for phone, mail, and internet scams that request your MBI.)
Note that until the end of 2019, healthcare providers can use either new Medicare IDs or the old ones to communicate with or seek payment from the Center for Medicare & Medicaid Services (CMS). After that, there are a few limited exceptions for use of the older Medicare cards.
How to Just Say No
If you're asked to provide your SSN—and simply leaving the space blank doesn’t get you a pass—politely push back.
You can also express your concern, noting that you’re hesitant to share your Social Security number because you’re worried about identity theft. And ask why the healthcare facility requires the number, suggests Eva Velasquez, president and CEO of the Identity Theft Resource Center (ITRC), a nonprofit group that helps fraud victims.
"When I encountered this problem and asked why they needed it, the receptionist said 'we don't need it, we just haven't changed the form,''' she says. "So some of it is just an organizational failure."
In some cases, your healthcare provider may say they need your Social Security number simply because they have a field in their computerized medical records that must be filled in. The solution? Ask them to use zeros.
If you’re told it’s so they can track you down in case of billing problems, offer an alternative, such as your cell phone. But Dixon cautions about sharing other information, like your driver’s license. “You want to keep as many of the numbers that define you out of circulation,” she says.
Quiz the staff on their security practices and repeat your concerns to the doctor if you still don't get satisfaction. "If your provider or their front desk staff insists on using your Social Security number, ask them why and how they will protect that information," says Mendelsohn.
You can't be sure your healthcare provider's security practices are sufficiently robust. Research published this year in JAMA Internal Medicine, which looked at the causes of 1,138 breaches of protected health information, found that 53 percent were “attributable to the healthcare entities’ own mistakes or neglect,” according to the authors.
Finally, consider moving on, "If the answer you get is not satisfactory, you may ask yourself whether this is the right provider for you," Mendelsohn says.
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2019, Consumer Reports, Inc.
