The California Department of Social Services (CDSS) has issued guidance regarding AB 499 (2020) that requires mailings from state agencies, which includes counties operating state and federal programs on behalf of CDSS, to only include the last four digits of a Social Security Number in outgoing mail.
Effective January 1, 2023, with limited exceptions, state agencies must only include the last four digits of a Social Security Number in outgoing mail. Computer systems must make changes to implement this requirement. County processes must be revised to meet this requirement. Computer systems that must make changes to comply include, but are not limited to, CalSAWS and BenefitsCal, CMIPS, ACMS, EBT, Child Welfare Services/Case Management System, Child Welfare Services CARES, and County Expense Claim Reporting Information System.
If a system is unable to make necessary changes in a reasonable timeframe, the system must implement a workaround to redact or truncate all Social Security Numbers in outgoing mail.
Counties should report any mailings that violate this requirement to CDSS using the breach and incident process. (ACL 23-17, January 31, 2023.)