Doctor requiring Social Security number to make appointment

September 26, 2013 19:04 by Consumer Ed

Dear Consumer Ed:

My doctor's office is now requiring me to provide my Social Security Number in order to make an appointment.  I don't want to give out that information, and my insurance company told me all the office needs is my name, birth date and insurance policy number.  Is it legal for doctors' offices to require my Social Security Number? What are my rights?

Consumer Ed Says:

The Social Security Number (SSN) was created in 1936 for the purposes of tracking an individual's earnings and monitoring Social Security benefits paid to that individual.  Over time, the SSN has become a tool for identification and authentication in both the government and the private sector, since it is a fixed identifier that is unique to each person.  Because organizations within the private sector have increasingly used SSNs in business and record keeping systems, the availability and demand for the numbers by identity thieves has also grown.  In response to rising identity theft concerns, many insurers have discontinued the use of SSNs as policy holder identification numbers.  In today's world, where it seems like identity theft is continuously on the rise, people must be careful in freely giving out their SSN.  It is always best to be cautious and ask "why?"

So, are you legally required to provide your SSN to your medical provider?  The answer is no. There are certain organizations that do require it, such as the IRS (for tax returns and federal loans), employers (for wage and tax reporting purposes), banks (for certain monetary transactions), and states (for welfare benefits, government health care plans, such as Medicaid, etc.), just to name a few.  However, medical providers are not such organizations, and since you know your insurance provider uses insurance policy numbers instead of SSNs, you know the doctor's office isn't using it as a requirement of your insurer.  Therefore, you don't have to voluntarily provide your SSN.

However, there are no laws that make it illegal for a doctor's office to require your SSN to schedule an appointment.  They're permitted to use your number internally for identification verification or administrative purposes; one such purpose may be to aid in the bill collection process.  If the doctor has a patient's social security number, then it's easier to locate that patient and collect money owed; likewise, when a patient is deceased, having a social security number may make it easier for the medical provider to collect on unpaid bills.  Keep in mind that if you refuse to provide your SSN, the office can also refuse to schedule your appointment or provide services to you.

That being said, providing your SSN is completely voluntary, even when you are directly asked for it.  If you're asked for your SSN and are uncomfortable doing so, you should ask the following questions to help you determine whether to surrender your private information:  (1) Why do you need it?  (2) How will you use it?  (3) What law requires me to provide it? and (4) What are the consequences if I refuse?

Depending on the reason provided, see if a different type of information would serve the same purpose, and provide that information instead.  For example, if the office needs your SSN for identification purposes, offer your driver's license number; or if the office needs it in the unfortunate event that you die and they need to collect money for unpaid bills, then provide the name and contact information of a person that knows your SSN and can provide it in such event. You can also try explaining to the office personnel that providing your SSN puts you at risk for identity theft and you aren't comfortable giving it out.  None of this guarantees that they'll agree to accept an alternative to your SSN.  If they won't, and insist that you provide your SSN to schedule an appointment, then you might want to consider finding another office that won't ask for such private and sensitive information before you've even been seen.

If you enjoyed this post, make sure you subscribe to my RSS feed!

Rate This

Can a credit card issuer share my Social Security number?

June 7, 2013 00:12 by Consumer Ed

Dear Consumer Ed: 

I have a department store credit card issued through a retail bank. I recently received a privacy policy form in the mail.  Part of the policy states that the types of personal information they collect and share depend on the product or service I have with them, but the information collected and shared can include:

•    Social Security number and income

•    Account balances and payment history

•    Credit history and credit scores

They said you could phone and limit sharing – which I did immediately – but it may take up to 30 days from the date the notice was sent.  My question is this:  Do the department store/retail bank have the right to share my Social Security number with other people?  This seems like a huge security risk and invasion of my privacy.

Consumer Ed says: 

Although we have not disclosed the name of the particular department store or retail bank in this column, based on the information that you have provided to us it appears that the department store’s credit card is operated by the retail bank in question, so it is probably the bank’s privacy policy that you received in the mail.  The reason this matters is because the bank meets the definition of a “financial institution” under federal law.  As such, it is allowed to share your nonpublic personal information, e.g. your Social Security number, provided that it follows certain regulations required by the Federal Trade Commission (“FTC”).  Specifically, the bank can disclose nonpublic personal information about you to a nonaffiliated third party if it has done all of the following:

•    provided you initial notice;
•    sent you an opt-out notice;
•    given you a reasonable opportunity, before it disclosed the information to the nonaffiliated third party, to opt out of the disclosure; and
•    you do not opt out.

Additionally, any entity (whether it is a financial institution or not) that receives your personal information from the bank may be restricted in its reuse and re-disclosure of your personal information.  

Based on your question, it sounds like you’re also concerned about the security risks involved with the sharing of personal information.  You should know that the FTC has established a regulation requiring financial institutions to “develop, implement, and maintain a comprehensive information security program” in order to “insure the security and confidentiality of customer information.”  You can learn more by visiting the FTC’s webpage about the Gramm-Leach-Bliley Act at  If you have any additional concerns and need legal advice, you should consult a lawyer.

If you enjoyed this post, make sure you subscribe to my RSS feed!

Rate This

How do I know if a website is secure?

August 24, 2012 20:10 by Consumer Ed

Dear Consumer Ed:  

When I started shopping online and banking online, I was told that if I saw a closed padlock symbol on the screen that the site was safe for me to use because it is encrypted. Is that still true with all the stories I read about online hacking?

Consumer Ed says: 

Because online fraud cases have increased substantially from year to year, anytime a web page asks you for sensitive information, you do need to be able to identify whether the page is secure.  The padlock symbol is one of several ways of knowing if a page is secure. 

Here are a few tips to help you determine whether a page is safe. First, while all web page addresses (URLs) begin with the letters “http”, the address displayed over a secure connection should begin with “https”—note the “s” at the end.  This indicates that the data you enter is encrypted for security, meaning it is scrambled before being sent to the remote site and then decrypted so it can be used.  The same process occurs when the remote site has to send information back to you.  That way, if an unauthorized person intercepts the data, it is unreadable. 

The home page of a site will probably just have a regular “http” URL, such as  But if you go to a page within the site that asks you to enter your email address, account number, password, credit card information or other sensitive information, the URL should change to one that has “https” at the beginning.  If it doesn’t, do not enter your information.

Second, when you are on a secure site, your web browser will usually show a “padlock” icon somewhere on the edge of the browser window (but NOT in the web page display area).  For example, Microsoft Internet Explorer displays the lock icon near the right end of the address bar.  The lock icon is not just a picture:  you can click on it to see details of a site’s security.  This is important to know because some fraudulent web sites are built with a bar at the bottom of the web page to imitate the lock icon of your browser.  Before you can know that the lock icon is genuine, you should test its functionality by clicking on it to see whether it actually takes you to the company’s security policies. 

Third, if you arrive at a website from a link in an email message, verify that the website is legitimate before you provide any information to the site – even if you received the email from someone you trust.  Phishing websites can sometimes send email messages that mimic, or spoof, legitimate email addresses.  Phishing is an email scam in which the sender tricks the recipient into revealing personal or confidential information, which the scammer then uses for illicit purposes, such as to commit identity theft or to make unauthorized financial charges.

A good example of this type of scam is a phony Bank of America email that has been circulating recently.  The subject of the email says: “Bank of America Alert: Your Online Statement Is Ready”.  The message appears to be legitimate (especially if you actually are a Bank of America customer), however it is actually a bogus email intended to get you to divulge your banking credentials.  If you ever receive any email messages from an institution with which you have an account, it is always safest to go directly to their main website in order to access your account. 

If you are suspicious about an email, you can determine whether a website link is legitimate by first placing your mouse pointer over the link WITHOUT ACTUALLY CLICKING ON IT. This allows you to notice what web address is displayed in the little window that comes up.  If it displays anything other than the legitimate web address of the financial institution, then it is probably bogus. In the Bank of America email mentioned, there is a link that says “View your statement online today.”  However, when you place you pointer over that link the address that is revealed is very clearly NOT a Bank of America address.

If you are visiting a retail website, check the site for a phone number or street address.  If the site only provides an email address, send a message to the address to request additional contact information. Do not provide personal information to a website that has no contact information.

All this aside, if you are still reluctant to put your financial information out there, you can almost always contact the company via telephone to place your order.

If you enjoyed this post, make sure you subscribe to my RSS feed!

Rate This