Use of Social Security Numbers in PASRR

PTAC recommends that states not use Social Security Numbers (SSNs), but instead use other unique identifiers.

However, we note that as Medicaid agencies link completion of PASRR tasks to NF payments, there is often a press by the Medicaid agency itself for PASRR to capture SSNs. This is especially the case when the Medicaid agency’s NF payment authorization system is set up to verify NF services delivered through the use of SSNs These states tend to require PASRR programs to gather SSNs. Because this is the only justified use of SSNs, we recommend that states limit access to social security numbers to a data push to Medicaid MMIS systems, to either approve or deny NF payments. We recommend that states use other identifiers whenever possible.

When SSNs are used, we recommend the state collect, for PASRR purposes, only the last 4 or 5 digits of the number. If the state requires the collection of the whole PASRR number, we recommend that access to the SSN be restricted to the Medicaid agency. In addition, the system should be designed so that the person entering the SSN sees only the last 4 digits.