However, this research focused, in general, on how and why  governments use SSNs, and did not examine in detail, the extent to which  SSNs are exposed to the general public and potentially available for  misuse. The number  and type of records in which SSNs are displayed varies greatly for both  states and counties, but they are most often found in court records and  local property records. Agencies in 41 states as well as the  District of Columbia reported holding at least one type of public record  that shows the SSN. 1.) Under the Law, SSNs Are Generally Not Available to the Public in Federal Executive Records, but They Can Be Viewed in Some Federal Court Records

While the federal government compiles a wide range of information on  individuals that often includes SSNs, the Privacy Act of 1974 may prohibit  their disclosure, along with other personal information, without the  consent of the individual. Social Security numbers are sometimes found in these records. Identity Verification Is the Most Common Use of SSNs in Public Records

State and local government respondents to our survey reported frequently  using SSNs in public records to verify identities or to meet state legal  requirements, but some agencies said they had no need for them. However, some state and local  offices reported that they had no specific use for the SSNs in certain  records, although they were often contained in documents submitted to  their offices. Courts also reported routinely collecting SSNs for Social Security  claims cases. Additionally, quite a few offices maintain public records  that contain SSNs for which they have no use. Public Documents with SSNs Are Stored in a Multiplicity of Formats, but Hard Copy Is Still the Most Widely Available Form of Public Access

Storage methods and forms of public access to records with SSNs vary  somewhat among the different levels of government, but hard copy is the  most common form of access for the public, and some agencies have  begun to reduce SSN exposure. Few state agencies make them  available on the Internet. In counties, however, we estimate that offices in  as many as 15 to 28 percent—several hundred—do so. In its  report, the committee that developed the policy noted that there should be  “consistent, nationwide policies in federal courts in order to ensure that  similar privacy protections and access presumptions apply regardless of  which federal court is the custodian of a particular case file.”

	Millions of Federal Health Insurance and Identity Cards Display the SSN

Although they are not displayed in public records en masse, we found that  millions of SSNs are still subject to exposure on individual identity cards  issued under federal auspices. Although some agencies are taking action  to address this display of the SSN, we found that, currently, an estimated  42 million Medicare cards display entire nine-digit SSNs, as do some  Department of Defense insurance cards and approximately 8 million  identification cards, as well as 7 million Department of Veterans Affairs  (VA) beneficiary cards. Three of four federal agencies have begun taking action to remove SSNs  from such health insurance or identification cards issued under their  auspices. Indeed, a variety of government agencies and oversight bodies  appear to be taking steps to eliminate the open display of SSNs, but there  is no uniform practice or policy at the federal, state, or local level to  protect them. While we did  not examine the phenomenon of SSN display on identification cards  across all federal programs, it is clear that the lack of a broad, uniform  policy allows for inconsistent, but persistent exposure. Additional queries  dovetailed with questions asked at the state and local levels: public access  to the agencies’ public records that contain SSNs, availability of these  records on the Internet, privacy and protecting records about individuals  and other issues unique to the agency. The  questionnaire include such items as accessibility of records displaying  SSNs to the public; reasons for collecting or using SSNs in the record;  formats for storing records with SSNs; plans for changing those formats;  methods by which the public can access or view records with SSNs,  including Internet usage and changes the office has made in the past   2 years in the way records with SSNs are displayed to the public.
Why GAO Did This Study

While the use of Social Security numbers (SSN) can be very beneficial to the public sector, SSNs are also a key piece of information used for committing identity crimes. The widespread use of SSNs by both the public and private sectors and their display in public records have raised concern over how SSNs might be misused and how they should be protected. In light of this concern, GAO was asked to examine (1) the extent to which SSNs are visible in records made available to the public, (2) the reasons for which governments collect SSNs in records that display them to the public, and (3) the formats in which these records are stored and ways that the public gains access to them. As well as looking at public records, GAO also examined the practices of several federal agencies regarding the display of entire nine-digit SSNs on health insurance and other identification cards issued under their authority.

What GAO Found

Social Security numbers appear in any number of records exposed to public view almost everywhere in the nation, primarily at the state and local levels of government. State agencies in 41 states and the District of Columbia reported visible SSNs in at least one type of record and a few states have them in as many as 10 or more different records. SSNs are most often to be found in state and local court records and in local property ownership records, but they are also scattered throughout a variety of other government records. In general, federal agency display of SSNs in public records is prohibited under the Privacy Act of 1974. While the act does not apply to the federal courts, they have taken action in recent years to prevent public access. With regard to the SSNs maintained in public records, various state and local officials commonly reported needing them for identity verification. A few, however, said they had no use for the SSN, but that documents submitted to their offices often contained them. States also commonly reported using the SSN to facilitate the matching of information from one record to another. The federal courts largely collect SSNs when required by law to do so; however, due to privacy concerns, SSNs are not in documents that are available electronically to the public. Public records with SSNs are stored in a multiplicity of formats, but public access to them is most often limited to the inspection of individual paper copies on site or via mail by request. Few state agencies make records with SSNs available on the Internet; however, 15 to 28 percent of the nation's 3,141 counties do place them on the Internet and this could affect millions of people. Overall, GAO found that the risk of exposure for SSNs in public records at the state and local levels is highly variable and difficult for any one individual to anticipate or prevent. Another form of SSN exposure results from a government practice that does not involve public records per se. GAO found that SSNs are displayed on cards issued to millions of individuals under the authority of federal agencies for identity purposes and health benefits. This involves approximately 42 million Medicare cards, 8 million Department of Defense identification cards, as well as some insurance cards, and 7 million Veterans Affairs identification cards, which display the full nine-digit SSN. While some of these agencies are taking steps to remove the SSNs, there is no governmentwide federal policy that prohibits their display. Although we did not examine this phenomenon across all federal programs, it is clear that the lack of a broad, uniform policy allows for unnecessary exposure of personal Social Security numbers.