Articles

ISPLA UPDATE: Social Security Death Master File Certification Access

Certification to be required for immediate access to current Death Master File under new Department of Commerce program: Hearing Scheduled March 4 

ISPLA previously commented on a bipartisan bill to thwart identity thieves exploiting public access to the Social Security Death Master File (DMF) to easily acquire the Social Security numbers of recently deceased persons, which they then use to file fraudulent tax returns.  The bill directed the Secretary of Commerce to restrict access to the DMF to certified persons that have a fraud prevention interest or other legitimate need for the information, and it establishes penalties for disclosure or misuse of the information

A provision of the Bipartisan Budget Act of 2013, signed into law by President Obama on December 26, 2013, will bring changes to the way in which users access the Social Security Administration’s Death Master File (DMF). The provision, “Restriction on Access to the Death Master File” (Section 203),   directs the Secretary of Commerce to establish a fee-based certification program for all persons desiring access to DMF data for any deceased individual within three years of death.  Section 203 is scheduled to take effect 90 days from the date of enactment of the Bipartisan Budget Act of 2013, in March 2014.

To be certified under Section 203(b)(2)(A), a person must certify that he or she has a legitimate fraud prevention interest or a legitimate business purpose pursuant to law, rule regulation or fiduciary duty.  Under Section 203(b)(2)(B), a person must also certify that he or she has systems, facilities and procedures in place to safeguard DMF data, and has experience in maintaining the confidentiality, security and appropriate use of such data, under requirements similar to those under section 6103(p)(4) of the Internal Revenue Code.   

Section 203 requires “periodic and unscheduled audits” of certified persons, and provides for the imposition of penalties on any certified person who discloses DMF data to a person who does not meet the requirements for certification, or to a person who uses the DMF data for any purpose other than described under Section 203(b)(2)(A) or further discloses the data to a person who does not meet the requirements for certification, as well as on any certified person who uses any DMF data for any purpose other than described under Section 203(b)(2)(A). Penalties are set at $1,000 per person per improper disclosure or use, up to a maximum for $250,000 per person in any calendar year. 

It is important to note that until a certification program has been established, user access to the DMF will continue without interruption under the existing process.  Once the certification program has been established, it is anticipated that non-certified users will be able to access DMF data limited to data for individuals whose date of death was three or more years earlier.

The U.S. Commerce Department’s National Technical Information Service (NTIS) is actively working with the Social Security Administration to draft proposed rules for the establishment of a certification program.  The proposed rules will be published in the Federal Register for public comment.  ISPLA will be working with the office of Commerce Secretary Penny Pritzker regarding the proposed rules. The devil will be in the details.

Bruce H. Hulme, CFE

ISPLA Director of Government Affairs

http://www.ispla.org/