U.S. government's "serious" efforts on identity theft, hacking etc.?

There are frequent high profile conferences and meetings held by the government these days on issues that lead to identity theft, fraud, and cyber theft.  All of them are focused on the internet, computer hacking, and various types of technological chicanery.  What about the old style of looking into a consumer's pocket.

One incredible government practice, that seems simply blind, is that most Medicare card numbers today are a holder's social security number plus a dash and then a letter of the alphabet.  This card is given to any clerk who requires it in any doctor's office or any hospital.  It is entered into the system, sometimes copied, and given back, or maybe held until after service.  How easily this system can be exploited by those who know how, as the millions of medicare participants need to give it to any medical employee who requests it in order to insure benefits. Generally any co-payment can be made with a credit card.  Of course those thousands upon thousands of clerical and administrative workers are no doubt trained to be discreet and trust is nice, but it is not adequate.

When the files of Target, Home Depot, a financial institution, and whatever large business are broken into through computer fraud, then shoppers, customers, and clients are usually notified in a mailing that a breach has occurred, and while it may not be a danger, one should be aware and report anything inappropriate.  With a social security number, an address, and a credit card number, it is generally said that a skilled criminal in identity theft has just about all he or she needs.

And yet, this medicare card practice is current "government" practice.  Changing this and other protocols that are similar to it would seem to be a basic starting point to preventing identity theft and fraud, one that could have and should have been done years ago, no cyber-security experts required.