Social Security Number Reduction Overview
In May 2007, Office of Management and Budget (OMB) issued memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, requiring agencies to review their use of Social Security numbers (SSNs) in agency systems and programs to identify instances in which the collection or use of the number was unnecessary. Lastly, the memorandum required agencies to explore alternatives to using SSNs as personal identifiers for Federal employees and in Federal programs.
VA is committed to safeguarding Veterans' and employees' privacy by reducing or eliminating the use of SSNs in records. VA's SSN Reduction Initiative is an ongoing program, initiated by OMB Memorandum 07-16 and driven by other recent Federal legislation such as the Social Security Number Fraud Prevention Act of 2017 and the Consolidated Appropriations Act, 2018, (Sec. 240).
The Social Security Number Fraud Prevention Act of 2017 prohibits the inclusion of SSNs on any document sent by mail unless the head of the agency determines that the inclusion of the SSN is necessary. VA considers usage necessary or acceptable in instances when it is required by law, authorized by law, or fulfills a compelling business need.
While VA has policies in place to authorize this use, the law requires Federal agencies to issue updated regulations specifying the specific circumstances under which inclusion of an SSN on a document sent by mail is necessary. VA is on track to update the policies to meet this legislative requirement. Additionally, the SSN Fraud Prevention Act requires VA to submit a yearly report to Congress for five years after the passage of the Act (Sept. 2022). The report details the status of compliance with reduction efforts, and includes a list of documents containing SSN that are mailed by VA.
The Consolidated Appropriations Act of 2018, Sec. 240, mandates VA to discontinue using SSNs to identify individuals in all VA information systems. VA must discontinue use of SSNs for all Veterans submitting new claims for benefits to VA within five years of enactment and in all VA information systems for all other individuals within eight years. VA may use an SSN to identify an individual in a VA information system only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.
VA will address compliance with this legislation through a multi-year phased approach that includes system modifications, user and Veteran re-education and awareness campaigns.
Documenting and limiting the use of SSNs has become a priority of the Federal government to prevent the inappropriate disclosure or misuse of personally identifiable information (PII). The widespread collection and use of SSNs for government services exposes Veterans, employees and contractors within VA to privacy risks like identity theft. VA, in conjunction with all Federal agencies, must take steps to reduce and, where possible, eliminate the use of the SSN for uniquely identifying individuals in VA operations, programs and services.
Acceptable Uses for Social Security Numbers
SSN usage at VA is considered necessary or acceptable only in instances when it is required by law, authorized by law, or fulfills a compelling business need.
1. Required by Law
SSN usage is required by law in instances where a law explicitly states that the SSN must be collected or used to accomplish a specific function. Examples of SSN usage that are required by law are for the purposes of law enforcement or national security investigations, health care or financial institution functions, and employment eligibility among others.
2. Authorized by Law
SSN usage is authorized by law in instances where a law allows the SSN to be collected and/or used, but it does not require it. In these cases, the continued use of the SSN may be acceptable for a specified period of time, provided that plans are in place to reduce these uses.
3. Compelling Business Need
SSN usage is also considered acceptable when there is a Compelling Business Need, meaning a direct requirement so great as to necessitate the SSN to fulfill the duties of an individual employee, contractor or function of VA. If an instance of SSN usage is not required by law, authorized by law, or does not fulfill a Compelling Business Need, it is considered unnecessary, and VA policy directs that such usage be eliminated to reduce privacy risks.
Accomplishments to Date• Veteran SSNs no longer appear on VA prescription labels, bottles or mailing labels.
• Veteran SSNs were removed from health care authorization cards issued for the Civilian Health and Medical Program of Department of Veterans Affairs (CHAMPVA), the Spina Bifida Health Care Program (SB), and the Children of Women Vietnam Veterans Health Care Program (CWVV).
• Veteran SSNs were either removed from or truncated to the last four digits on most VHA correspondence.
• VBA replaced SSNs with DoD identification numbers on outreach letters sent to active duty and separated service members.
For further information, contact VA Privacy Service at 202.273.5070 or firstname.lastname@example.org.