The Office of General Counsel issued the following opinion on December 30, 2004, representing the position of the New York State Insurance Department.
Re: Use of Health Insurer of Insureds Social Security Number
May a health insurer use the social security number of an insured as an identification number on forms utilized by the insurer for purposes of reimbursement?
Yes. Such usage does not violate Federal or State law.
The inquirer's health insurer regularly uses her social security number identification number on forms it utilizes for purposes of reimbursement. She expressed concern that such usage might result in identity theft.
While the Social Security Act limits the circumstances under which a state may require an individual to provide his or her social security number, pursuant to 42 U.S.C.A. § 405(c)(i)(West 1991), there is no such prohibition directed at private insurers in this regard.
It should be noted that when an applicant does furnish their social security number to the health insurer, the use of this information by the insurer is subject to the requirements of the Departments Privacy Regulation 173, N.Y. Comp. R. & Regs. tit 11 § 421.2 and 421.3 (2002). Pursuant to those sections, an insurer must implement a comprehensive written information security program that is designed to ensure the security and confidentiality of customer information; protect against any anticipated threats or hazards to the security or integrity of such information; and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.
In Sections 421.5-421.8 of Regulation 173 the Department provides examples of methods that insurers may use to implement the requirements contained in Sections 421.2 and 421.3 of the Regulation. Because there is no specific legislation prohibiting insurers use of social security numbers as identifiers, the Department cannot mandate that insurers refrain from their use. However, please be assured that the Department, in reviewing the policies and systems established by insurers to implement their information security program, will be cognizant of insurers protection of insureds social security numbers.
For further information you may contact Supervising Attorney Lawrence M. Fuchsberg at the New York City Office.