Unfortunately, identity theft is something that we all need to think about these days. Medical identity theft is defined by the Office of the Inspector General (OIG) as when someone steals personal information such as a name, a social security number, or a Medicare number and uses it to obtain medical care, purchase drugs, or submit fake claims to Medicare.

The Bureau of Justice Statistics reports that identity theft of the elderly increased to 2.6 million people in 2014.  Some of us are old enough to remember when it was common to see our social security numbers on our driver’s licenses. Now, that is an outdated practice. 

With the implementation of the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), the Centers for Medicare and Medicaid Services (CMS) are now required to remove the social security numbers from the cards of their beneficiaries. This initiative falls under the “Protecting the Integrity of Medicare” provision of the MACRA law. This is an important measure because individuals are advised by CMS to always carry their member cards with them. Having social security numbers on Medicare cards opens seniors up for identity theft if their wallet is lost or stolen. Along with prohibiting the use of social security numbers on Medicare cards, there is also language in MACRA for CMS to consider the use of smart cards. This serves to fight against medical identity theft for people with Medicare, and to help protect both essential Medicare funding (by reducing fraudulent claims) and private health care and financial information of the beneficiaries. This process is something that has been asked of CMS for more than a decade.

What will CMS use to replace the social security numbers? The new Medicare Beneficiary Identifier (MBI) will replace the old numbers. The new numbers will have 11 characters. The current Health Insurance Claim Number (HICN) can have up to 11 numbers but is usually the member’s social security number followed by a letter. The new MBI will not be based upon the member’s social security number. It will be a unique, randomly assigned identifier comprised of numbers and letters. The new MBI will have some consistent properties: 

  • The second, fifth, eighth, and ninth character will always be a letter.
  • The first, fourth, seventh, tenth, and eleventh character will always be a number.
  • The third and sixth will be a letter or a number.

As you can imagine, this entire process is a daunting task for CMS and for those of us whom CMS refers to as its business partners. First, CMS must assign these new MBIs to approximately 150 million individuals, including 57.7 million active and 90 million deceased or archived individuals. Next, CMS expects to start mailing out new cards to members in April 2018, with plans to replace all cards by April 2019. Lastly, CMS and those of us who use these numbers to bill and process claims need to update and modify our systems to accommodate the new numbers.

What does this mean to CMS and to us, its business partners? The good news is that there will be a 21-month transition period during which CMS plans to test its systems. CMS will not be testing fee-for-service claims processing because providers will be able to use either the HICN or MBI during the transition period and CMS believes providers can use the live claims processing to make adjustments as needed. This transition period will begin no sooner than April 2018 and extend through December 2019. After January 2020, HICNs will not be accepted and MBIs must be used with a few exceptions. Please refer to www.cms.gov/medicare/ssnri for further information. One other piece of good news is that providers, including audiologists, will be able to sign up to look up an individual’s MBI through a secure tool.

What should we do now? Audiologists should prepare by working with office software and billing vendors to make sure software systems will be able to handle the transition, including testing the systems to be sure they work correctly with the new identifiers. We should also verify that our patients’ addresses match the addresses that Medicare has on record. If a discrepancy is found, ask patients or a representative to contact Social Security to update the address. Other tips and resources can be found on the Academy’s website by searching keywords “New Medicare Cards” and/or by looking under the Reimbursement section of the website. Another resource is www.cms.gov/medicare/ssnri/providers/providers.html. As we get closer to April 2018, remind all of your Medicare patients to bring their new Medicare cards to their appointments. 

Diagram indicating Social Security Removal Initiative (SSNRI)

What will happen during the transition period? Once we enter April 2018, your office software must be able to accept and use the MBI. During the transition period of April 2018 through December 2019, either the old HICN or the new MBI may be used to submit claims. Starting October 2018, if the HICN is submitted on a claim then CMS will enter BOTH the HICN and the MBI on the remittance advice form. 

CMS says that it is committed to making sure that this change to more secure identifiers is successful. With the joint preparation by CMS and our office systems, it should go well. The Academy will do its best to assist its members during this transition. We also encourage you to sign up for the Medicare Learning Network newsletter to receive updates and current information from CMS.