Overview

OMB Memorandum M–17–12 provides guidance on preparing for and responding to a Breach of Personally Identifiable Information, requiring agencies to review their use of Social Security numbers in agency systems and programs to identify instances in which the collection or use of the number was unnecessary. Lastly, the memorandum required agencies to explore alternatives to using Social Security numbers as personal identifiers for Federal employees and in Federal programs.

VA is committed to safeguarding Veterans’ and employees’ privacy by reducing or eliminating the use of Social Security numbers in records. VA’s Social Security Number Reduction Initiative is an ongoing program, initiated by Office of Management and Budget Memorandum 07-16 and driven by other recent Federal legislation such as the Social Security Number Fraud Prevention Act of 2017 and the Consolidated Appropriations Act, 2024, P.L. 118-42, Division A, Title II (Sec. 237).

New Privacy Act Regulation Amendments

VA is amending its regulations implementing the Privacy Act. These revisions clarify and update the language of procedural requirements pertaining to the inclusion of Social Security numbers on documents that VA sends by mail.

Federal Register – Social Security Number Fraud Prevention Act of 2017 Implementation

The Social Security Number Fraud Prevention Act of 2017 prohibits the inclusion of Social Security numbers on any document sent by mail unless the head of the agency determines that the inclusion of the Social Security number is necessary per Final Rule (RIN-2900-AR19).

    Effective September 30, 2024, in accordance with the Consolidated Appropriations Act of 2024, the Department of Veterans Affairs may only collect and use a Social Security account number to identify an individual in an information system of the Department of Veterans Affairs if, and only if, the use of such number is necessary to:

    1. obtain or provide information the Secretary requires from an information system that is not under the jurisdiction of the Secretary; or

    2. comply with a law, regulation, or court order; or

    3. perform anti-fraud activities; or

    4. identify a specific individual where no adequate substitute is available.

    This law, Consolidated Appropriations Act, 2024 supersedes (replaces) Section 237 of division J of Public Law 117-328 (Consolidated Appropriations Act, 2023). VA must discontinue use of Social Security numbers for all Veterans submitting new claims for benefits to VA not later than March 23, 2023 and in all VA information systems for all other individuals not later than March 23, 2026.

    VA will address compliance with this legislation through a multi-year phased approach that includes system modifications, user and Veteran re-education and awareness campaigns.

    Documenting and limiting the use of Social Security numbers has become a priority of the Federal government to prevent the inappropriate disclosure or misuse of Personally Identifiable Information. The widespread collection and use of Social Security numbers for government services exposes Veterans, employees and contractors within VA to privacy risks like identity theft. VA, in conjunction with all Federal agencies, must take steps to reduce and, where possible, eliminate the use of the Social Security number for uniquely identifying individuals in VA operations, programs and services.

    Acceptable Uses for Social Security Numbers

    Social Security number usage will continue per AUTHORITY: 38 U.S.C. 5101 of VA regulation Regulatory Identification Number (RIN-2900-AR19) regarding documents that are pre-populated with the Veterans full Social Security number per the Social Security Number Fraud Prevention Act of 2017 law. The documents listed below will continue to be mailed and pre-populated with full Social Security number.

    Accomplishments to Date

      • VA is actively reducing the use of Social Security Numbers (SSNs) to protect Veteran data and identity. Key accomplishments are:

      • VA removed SSN from physical media, including Veteran prescription labels, bottles, and mailing labels.
      • VA adopted the Integration Control Number (ICN) as the alternative identifier to SSN, providing a more secure way to identify Veterans and other individuals.
      • VA reduced risk to Veterans’ private data when communicating via mail by replacing SSNs on outreach letters sent to active duty and separated service members, and by removing or truncating Veteran SSNs on most VHA correspondence.
      • VA removed Veteran SSN from health care authorization cards issued for the Civilian Health and Medical Program of Department of Veterans Affairs.
      • The eBenefits Portal eliminated use of SSN by providing a way for Veterans to access their information with a username and password.