Medicare officials are going to protect 50 million elderly and disabled enrollees from identity theft. Someday.

Unfortunately, middle-aged identity thieves will likely hit Medicare age themselves before the key change -- removing Social Security numbers from Medicare cards -- is completed. Legislation President Barack Obama signed April 16 gave Medicare officials four years to start issuing new cards with randomly generated health insurance claim numbers. And they have four years after that to reissue cards held by current enrollees. That's absurd.

Social Security numbers are like gold for identity thieves. That's why the Social Security Administration has long advised people not to carry their cards. The departments of Defense and Veterans Affairs have taken steps to remove Social Security numbers from their health insurance and identification cards, and private sector health insurers have also removed the numbers from their cards, according to the Government Accountability Office. But at Medicare, it's been the sort of slow stroll that gives bureaucracies a bad name.

Since 2004, the Government Accountability Office has urged federal agencies to stop using Social Security numbers as identifiers.

In 2007, the Office of Management and Budget directed all federal agencies to develop plans to reduce use of the numbers.

In 2008, Social Security's inspector general called for immediate action to remove the numbers from Medicare cards.

Maybe Medicare officials didn't get the memos.

Congress has finally given those repeated exhortations the power of law. The bill Obama signed overhauling the way Medicare pays doctors also prohibits displaying, coding or embedding Social Security numbers in Medicare cards. It's about time.

Now somebody needs to light a fire under Medicare officials.