Five years on, fraud continues with new Medicare ID

I wrote this 5 years ago:

Medicare: Identity Theft, Fraud and the Shoemaker’s Children Revisited

Recently, CMS announced that the Social Security Number will be removed from Medicare cards.  This is a welcome and long-needed step, and we need to understand what it will accomplish, and as importantly, what it won’t.

First, a little history. For years, Medicare card issuance was managed by the Social Security Administration. They knew when you turned 65, and they issued the cards. Since they also had a well-known identifier, the logical step was to make that the Medicare identification as well. 

That was fine for many years before the world went online and criminals could apply for credit cards from their living rooms using a purloined SSN. The creditor receiving the application would check the creditworthiness of the applicant on Equifax (another story) or one of its peers, and send the card out with limited diligence. 

With over 55 Million Americans on Medicare, and 250,000 more per month added to the program, that identifier was written to millions of Electronic Medical Records systems, and transmitted in a variety of paper and electronic means. Getting a hold of one or more, or thousands at a time through a hack turned out to be frightfully easy. removing Since SSN was, and still is, the key to the individual kingdom, removing it from circulation will help protect identities of Medicare beneficiaries. However there is always a “but…..”

This move will reduce the flow of stolen identities used to apply for credit cards, and mortgages and file tax returns in someone else’s name, among the many transactions where SSN is used. Its impact on Medicare fraud will be short-lived and has its limits. Do not be lulled by a false sense of security that this will address the $100 Billion Medicare fraud.

The greatest enabler of fraud is the absence of any verification that services were rendered where, when and to whom the claim stipulates. No other business would operate that way. While the change to another identifier will reduce identity theft outside of the healthcare system there is no change to the claim processing infrastructure accompanying the removal of SSN as the Medicare identifier. Healthcare claims will still be paid based on the edit checks in the processing systems. The only difference so far is that the claims payment systems will look for the new identifier in place of the SSN; everything else remains the same. And those identifiers will be on EMR systems and transmitted in various forms, on paper and electronically. Same as it ever was.

Medicare fraud isn’t committed by a person stealing an identity to get services, this probably accounts for less than 1% of Medicare fraud. The other 99% is from unscrupulous providers who bill Medicare for services they never rendered, received kickbacks for, or exaggerated the services they did or did not provide.

And they will have the same access to the new identities as they did previously to adjudicate those claims successfully. They just won’t be able to use them to buy furniture. 

As a reference point, look at Medicaid fraud. State Medicaid plans create a “case number” to identify the beneficiary, check eligibility, and process claims. Even without the SSN, Medicaid fraud is rampant for the same reasons as Medicare fraud and the claims process.

Reducing identity theft from our seniors is important and long needed. This change will help. Addressing $100 Billion in annual Medicare fraud is as important. Changing an ID number alone is not the answer.