The Internal Revenue Service is apparently in no hurry to remove social security numbers from its correspondence with the public, despite a May 2007 Office of Management and Budget directive telling agencies to establish a plan within 120 days to eliminate the unnecessary use of social security numbers.

In an audit dated August 13, the Treasury Inspector General  for Tax Administration says the IRS has a plan, but has yet to draft detailed implementation and compliance management milestones. In February 2010, the Federal Trade Commission reported that identity theft--which often requires a purloining a social security number to be successful--was the number one consumer compliant during calendar year 2009. During fiscal 2009, the IRS mailed 201 million notices to taxpayers, most of which contained social security numbers.

The office dedicated to eliminating social security numbers from IRS documents and internal systems consists of four employees, the report states. They have than 500 different computer systems and more than 6,000 types of internal and external forms to analyze, according to the report.

Even with the small number of systems and documents for which the IRS says it has successfully expunged social security numbers, the IRS cannot document that it has truly done so, the TIGTA audit finds. For example, the IRS claimed victory when one major application system that previously required a social security number for employee logon began instead accepting a standard employee identification number. But, as of April 15, 2010, employees could still sign in to the system using their social security numbers.

How many of IRS systems and forms constitute a necessary use of social security numbers the report does not state.

However, the IRS is working on a plan to replace social security numbers on IRS public notices with barcodes, wrote Deborah Wolf, IRS director for privacy information protection and data security, in the agency's official response to the audit.

For more:
- download the TIGTA report, 2010-40-098 (.pdf)
- download the 2007 OMB memo directing agencies to eliminate the unnecessary use of social security, M-07-16 (.pdf)

Related Articles:
Modernized e-File lacked informed oversight, says TIGTA
IRS IT investments fall short on Clinger-Cohen requirement, says IG report
Pentagon removes SSNs from military ID cards