Budget-Crunched IRS Fell Behind on Protecting Social Security Numbers

As part of the governmentwide effort against identity theft, the Internal Revenue Service is working to minimize the use of Social Security numbers in routine forms and correspondence but is making limited progress, a watchdog found.

As of January 2015, the IRS estimated that it had removed or masked Social Security numbers in only 2 percent of letter types it sends out, 13 percent of forms and 48 percent of notices, the Treasury Inspector General for Tax Administration said in a July report released Wednesday.

“A person’s Social Security Number is the most valuable piece of personal data identity thieves can obtain.” said J. Russell George, Treasury inspector general for tax administration.  “The fact that the IRS does not have processes and procedures to accurately identify all correspondence that contain Social Security Numbers remains a concern.”

In 2014, the tax agency sent out 141 million notices and 37 million letters to taxpayers. To comply with the 1974 Privacy Act and the 2002 E-Government Act, the Office of Management and Budget in 2007 mandated that all agencies redact Social Security numbers.

The IRS’ original deadline for compliance was March 2009, but funding shortages forced the agency to concentrate on other priorities such as eliminating employees’ Social Security numbers from internal systems, TIGTA noted. In September 2011, the IRS suspended its efforts to reduce use of SSNs in forms, letters and notices due to the funding shortfall and the focus on internal systems, as well as deploying barcode scanners. It did not resume the elimination and reduction program until July 2013.

“Processes are needed to identify the universe of taxpayer correspondence with unnecessary SSNs and to ensure that SSNs are excluded when creating new correspondence,” auditors wrote, adding that it found some barcode scanners underused and not always available.

TIGTA recommended that IRS update and formalize its overall strategy to include specific time frames and describe how implementation of a proposed new digital communication project would affect the agency’s SSN elimination and reduction plans. It also recommended that new processes be developed to eliminate unnecessary use of Social Security numbers in correspondence and better track use of barcode scanners.

The IRS agreed with most recommendations, but disagreed with the suggestion that it lacked a reliable list detailing the scope of the challenge. The agency has already identified the most widely used letters, notices and forms, managers said, and “measuring the universe” of such forms within a diverse agency “is a more daunting and costly endeavor than it appears.”

(Image via zimmytws / Shutterstock.com)