CALIFORNIA SENATE BILL 168 USE OF SOCIAL SECURITY NUMBER

WellPoint, Inc. previously sent notification to our physicians, hospitals, and other health care professionals informing them of the California Senate Bill 168 and the importance of protecting our member's from identity theft.

WellPoint, Inc. would like to remind you of the upcoming compliance dates and the changes they will entail for our members with a California address.

The California Law SB 168 regulates the usage and disclosure of individual Social Security Numbers (SSNs). It is intended to provide additional protection against identity theft by limiting the use of an individual's Social Security Number.

The intent of the law is to protect California residents. Consequently, all persons or entities that communicate with individuals by U.S. mail, or via the Internet, and use or disclose an individual's Social Security Number may need to comply with the law by the relevant effective dates for its California population.

This bill applies to California residents and non-California entities with members that reside in California. It does not apply to individuals that travel to California, but live outside of California. It also does not apply to federal, state, and local government entities.

The California Law SB 168 provides separate effective dates for health care entities to allow time for testing and implementation of the changes that are required under the law. These dates are staggered between January 1, 2003 through July 1, 2005 for different lines of existing and new business.

Restrictions
SB 168 prohibits persons or entities from engaging in the following activities:
  1. Publicly posting or displaying in any manner an individual's Social Security Number
  2. Printing an individual's Social Security Number on any card required for the individual to access products or services provided by the person or entity (the ID card requirement)
  3. Requiring an individual to transmit his or her Social Security Number over the Internet, unless the connection is secure or the Social Security Number is encrypted
  4. Requiring an individual to use his or her Social Security Number to access a Web site unless a password, unique personal identification number, or other authentication device is also required
  5. Printing an individual's Social Security Number on any materials that are mailed to the individual, unless state or federal law requires the inclusion of the Social Security Number on the document to be mailed; however, applications and forms sent by mail may include Social Security Numbers.
Blue Cross of California's Compliance Approach for January 1, 2003
  • For existing Individual policyholders with a California address, WellPoint, Inc. will be will be masking the SSN on Explanation of Benefits (EOB), written communications, and premium bills sent to the member. The masking replaces the first four digits of the members' SSNs with an "X". For example, if the member's SSN is 123-45-6789, the masked number will be XXX-X5-6789.
  • Bill stuffers were sent to Individual members with a California address in September, October, and November 2002. The stuffer advised members that their SSNs will be masked on written communications sent to them, including their Explanation of Benefits (EOB) forms and premium notices.
Future Effective Dates
January 1, 2004 - New Individual Policies
  • For new individual policyholders that are issued on or after January 1, 2004, the health care entity must comply with all of the prohibitions, including the ID card requirement, on or before January 1, 2004 (on issuance of the policy).
  • For new employer groups that are issued on or after January 1, 2004, the health care entity must comply with all of the prohibitions in SB 168, including the ID card requirement, on or before January 1, 2004 (on issuance of the policy).
July 1, 2004 to July 1, 2005 - Employer Group in Existence prior to January 1, 2004
  • For employer groups that are in existence prior to January 1, 2004, the health care entity must comply with all of the prohibitions in SB 168, including the ID card requirement, on or before the group's renewal date, between July 1, 2004 and July 1, 2005.
Blue Cross of California's Compliance Approach for January 1, 2004

New individual identifiers will be assigned to replace existing Social Security Numbers that are used today as the member's identification number.

Health Care Provider Compliance

Since health care providers are unable to determine whether policies are existing or new, and have no knowledge of group renewal dates, they are encouraged to discontinue all SSN disclosures on or before January 1, 2003, to ensure compliance.

Additional Information

This document is being provided for informational purposes and should not be considered legal advice, or relied on as such. All external entities should review the statute in order to gain a full understanding of, and to ensure compliance with, the law.

Additional information and guidance will be provided, as it becomes available.

The portion of SB 168 that relates to health care entities will be codified at Cal. Civil Code § 1798.85. The Official California Legislative Information homepage (which provides access to legislative and statutory information) can be accessed at: http://www.leginfo.ca.gov/ .

content