The Defense Department will not meet its end-of-the-year deadline for removing Social Security numbers from military ID cards as they are issued or renewed, the Pentagon has confirmed.
It is not clear how much progress, if any, has been made toward meeting that goal or any aspect of a sweeping identity theft protection plan the DOD established last year. It came at the direction of the White House, which in 2007 required all federal agencies to begin eliminating the use of Social Security numbers when possible to help prevent fraud. There are approximately 12 million military ID cards in circulation, although not all have social security numbers, according to the Pentagon.
Military officials have refused repeated requests from Stars and Stripes for interviews regarding the matter since October and provided the following statement Wednesday: “The Department of Defense is committed to removal of the Social Security number on [the] Common Access Card (CAC). Further information regarding this effort will be provided as it becomes available.”
Despite an Oct. 16 statement from the Pentagon saying the goal was on track to be met, spokeswoman Maj. April Cunningham on Tuesday said the military would not meet its self-imposed December 2009 deadline for phasing out Social Security numbers on ID cards.
Eliminating the sensitive numbers from ID cards was supposed to be the easiest part of the DOD Social Security Number Reduction Plan, Mary Dixon, director of Defense Manpower Data Center, told Stars and Stripes in 2008. The more challenging aspect, she said, would be overhauling the military’s record-keeping procedures and computer information systems for pay, benefits and health care.
In the Oct. 16 statement, the Pentagon said that every DOD agency was “working to adjust their business processes … to determine where they require the use of the SSN and they can make use of some other alternative.”
But at least one major DOD agency, Tricare, is not.
Despite a memo outlining the Social Security Number Reduction Plan on the military health care system’s Web site, Tricare currently has no plans to modify business processes to reduce the use of Social Security numbers, Tricare spokesman Austin Camacho said in an e-mail to Stars and Stripes last month.
It was unclear Thursday to what extent other DOD agencies were involved in revamping operations to reduce the use of Social Security numbers.
The Department of Veterans Affairs, which does not fall under the auspices of the DOD, already has removed Social Security numbers from the ID cards of 3 million of its 5.1 million patients, said Gail Belles, director of health care security requirement services.
It also has removed the numbers from mail-order prescription medicine bottles and most printed patient documents, Belles said.
Even before the 2007 White House mandate, the VA already had begun a massive overhaul to improve data security after two high-profile breaches in 2006, when unencrypted laptop computers containing the records of millions of patients were stolen.
The VA in January will begin surveying its offices and 1,200-plus treatment facilities and building a database to determine where Social Security numbers can be eliminated from use. Officials are aiming to replace the Social Security number with another number unique to each individual patient for day-to-day operations, Belles said.
Still, Social Security numbers will always be part of patients’ records as a means of authenticating their identity when necessary, she said.
Like the DOD, the VA expects challenges in revamping most of its day-to-day functions that now center on Social Security numbers.
“It’s the real challenge because the SSN is so widely used, and it’s embedded in all our process in the health care environment,” Belles said. “It was not an issue years ago. Now we just have to do that comprehensive look and change our practices and culture.”