The Medicare HIC number, formally the Health Insurance Claim Number (HICN), was the identifier printed on every Medicare card for roughly half a century. It was built from the beneficiary’s Social Security number plus a one- or two-character suffix, and it was replaced starting in April 2018 by a randomly generated 11-character code called the Medicare Beneficiary Identifier (MBI). Every current Medicare transaction runs on the MBI, though the old HICN still appears in a handful of narrow situations.
What the HIC Number Was
The HICN combined a nine-digit Social Security number in positions one through nine with a trailing letter or letter-number suffix that identified how the cardholder qualified for Medicare. If you qualified on your own work record, your HICN was your Social Security number followed by the letter A. A spouse’s card carried a different suffix, a widow’s card another, and so on through categories for children, disabled widows, and surviving divorced spouses.
One quirk mattered: because the suffix reflected a family relationship, the nine digits on a card sometimes belonged to a spouse or parent rather than to the person holding it. Someone claiming benefits on a husband’s or father’s work record was walking around with that relative’s Social Security number on their Medicare card.
That structure was the whole problem. Anyone who saw a Medicare card instantly had a full Social Security number. A lost wallet, a stolen piece of mail, or a snapshot of the card was enough to open the door to identity theft. The system was serviceable when Medicare launched in 1965, but by the 2010s the exposure was untenable, with roughly 60 million beneficiaries carrying the equivalent of a Social Security card in their wallets.
Why Congress Retired the HICN
Section 501 of the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) directed the Secretary of Health and Human Services to “establish cost-effective procedures to ensure that a Social Security account number (or derivative thereof) is not displayed, coded, or embedded on the Medicare card.” The law also required that whatever replaced the HICN not be identifiable as a Social Security number or as anything derived from one.
Congress gave CMS a four-year runway to design the new identifier, print and mail replacement cards, and shut down the old system. Unlike a compromised credit card number, a Social Security number cannot be reissued after fraud, which is why the fix could not simply be tighter card security.
What Replaced It: The Medicare Beneficiary Identifier
The MBI is an 11-character code that mixes numbers and uppercase letters in a fixed pattern. None of it is derived from your Social Security number, date of birth, or any other personal information. Each position follows a specific rule:
- Position 1 is always a number from 1 through 9 (never zero).
- Positions 2, 5, 8, and 9 are always letters.
- Positions 4, 7, 10, and 11 are always numbers from 0 through 9.
- Positions 3 and 6 can be either a letter or a number.
Six letters are excluded from the MBI entirely to prevent confusion with similar-looking numbers or letters: S, L, O, I, B, and Z. The pattern lets a provider or billing office catch an obviously invalid MBI at a glance before a claim goes out.
CMS mailed new cards showing the MBI to every active beneficiary between April 2018 and April 2019. The current card no longer shows any Social Security information.
How To Find Your MBI
Your MBI is printed on the front of your current red, white, and blue Medicare card. If your card is lost, stolen, or damaged, you have a few options:
- Log in to your account at Medicare.gov to view and print an official copy immediately.
- Call 1-800-MEDICARE (1-800-633-4227) to request a replacement by mail.
- Contact Social Security at 1-800-772-1213 to order one through your Social Security account.
A replacement requested by phone or through Social Security typically arrives within about 30 days. If a provider needs your MBI while you don’t have the card on hand, their office can pull it through their Medicare Administrative Contractor’s secure lookup tool using your name, date of birth, and Social Security number. If you’d rather not hand your Social Security number to a front desk, log in to Medicare.gov yourself and read the MBI to them.
When the Old HIC Number Still Comes Up
The MBI became the required identifier for all Medicare transactions on January 1, 2020. The HICN still surfaces in a few narrow situations:
- Appeals filed by beneficiaries or providers can use either the HICN or the MBI.
- Audit-related submissions accept either identifier.
- The Drug Data Processing, Risk Adjustment Processing, and Encounter Data systems accept the HICN indefinitely for all records.
- Claim status queries for services with dates before January 1, 2020, accept either number. Later dates of service require the MBI.
- Inpatient hospital, home health, and certain other span-date claims that started on or before December 31, 2019, can still be submitted with the HICN even if filed later.
Old medical records also still contain HICNs, since providers keep records for years. If you request copies of care from before 2020, expect to see your old number on them.
Protecting Your Medicare Number From Scams
Getting rid of the Social Security link closed the worst hole in the old system, but scammers adapted. The most common pitch is a phone call from someone claiming to be “from Medicare” who says you need to activate, renew, or upgrade your card and asks for your Medicare number, Social Security number, or bank information to process a fee. This is always a scam. Medicare does not charge for a card and will not call you out of the blue to ask for personal information.
Another version tells you to mail your old card back. Medicare does not want your old card. If you still have one showing your HICN, destroy it yourself.
A few ground rules will block most Medicare fraud attempts:
- Treat your Medicare number like a credit card number. Share it only with your doctors, your plan, or organizations you contacted first that work with Medicare.
- Read every Medicare Summary Notice you receive and check that the dates, providers, and services match care you actually got.
- Never accept gifts or cash in exchange for your Medicare information or for agreeing to receive medical services.
- Hang up on unsolicited callers claiming to represent Medicare. If you think the call might be real, hang up and call 1-800-MEDICARE yourself.
If you believe someone has used your Medicare number fraudulently, report it to the HHS Office of Inspector General at 1-800-HHS-TIPS (1-800-447-8477) or through the online complaint form at oig.hhs.gov.