IRS still reliant on Social Security numbers to identify taxpayers

The Internal Revenue Service has not eliminated Social Security numbers from the majority of computer systems and documents because they still associate correspondence and documents with taxpayer accounts, according to a report from the Treasury Department Inspector General for Tax Administration that was released on Thursday.

During fiscal 2009, the IRS mailed 201 million notices to taxpayers, most of which contained their SSNs, according to the report. In addition, more than 500 computer systems, 6,000 internal and external forms, and 20 categories of individual taxpayer notices could contain the numbers.

"Since the IRS submitted its first release of the SSN [elimination and reduction] plan to the Department of the Treasury in the first quarter of fiscal 2008, it has redacted or truncated taxpayers' Social Security numbers from only a small number of systems, notices and forms," the inspector general stated. The agency has removed Social Security numbers from a document used for transferring taxpayer files among its offices, and from notices and letters that are sent out concerning economic stimulus payments. The IRS also removed numbers from the command code used to verify taxpayer identities in its Integrated Data Retrieval System.

On May 22, 2007, the Office of Management and Budget issued a memo requiring agencies to create a plan to eliminate the unnecessary collection and use of SSNs within 18 months.

The IRS first focused on reducing the number of internal forms that use SSNs, because it has more latitude to change the presentation of the data on a form if it does not leave the agency, according to the report. If it leaves the IRS, then consideration must be given to changes the receiving organization has to make, officials told the inspector general.

In systems and taxpayer correspondence, processes must be analyzed and revised before reducing or eliminating taxpayer SSNs. "This is because Social Security numbers are used to associate correspondence and documents with taxpayer accounts," the inspector general reported. "In addition, before revising forms and notices, the IRS must first analyze the various options for eliminating or reducing the Social Security numbers."

The agency began analyzing costs to update various systems in February 2009. Initial results of the analysis were submitted to the inspector general in November 2009, but not included in the report. Deborah Wolf, director of privacy information protection and data security at the IRS, noted in a written response to the report that the agency recently approved funding for a new initiative to replace the SSNs on notices with 2-D bar codes, which will allow it to encode taxpayer data. A preliminary timeline for the project will be established by Oct. 1.

IRS officials also agreed with recommendations from the inspector general to maintain better documentation of its progress to reduce reliance on SSNs, update milestones to ensure timely progress, and validate data received from business units on progress made.