CMS's Controls Over Assigning Medicare Beneficiary Identifiers and Mailing New Medicare Cards Were Generally Effective but Could Be Improved in Some Areas

From the beginning of the Medicare program, beneficiaries' Medicare cards displayed Social Security numbers (SSNs), which increased beneficiaries' vulnerability to identity theft. To meet the requirements of a 2015 Federal law, the Centers for Medicare & Medicaid Services (CMS) generated new randomized insurance numbers, called Medicare Beneficiary Identifiers (MBIs), to replace SSNs on Medicare cards; assigned the MBIs to beneficiaries; and mailed new Medicare cards. Because deficiencies in assigning MBIs and mailing new Medicare cards could have resulted in unintended consequences, such as claim processing errors and inappropriate release of personally identifiable information, we evaluated CMS's internal controls over implementation of the new MBIs.