Initially, the SSN within the response should be checked to ensure its
validity, as it is possible that the regular expression has matched a
similar number with no relation to a real SSN.

If the response does contain a valid SSN, then all efforts should be
taken to remove or further protect this information. This can be 
achieved by removing the SSN altogether or by masking the number
so that only the last few digits are present within the response
(eg. _**********123_).