Stop Thief! Protect Yourself Against Medical Identity Theft

By Jane Neff Rollins, MSPH

June 1, 2010

One week after having a spot on my forehead removed by a new dermatologist, I received a notice from his office stating that their medical records had been compromised, and recommended that I put a fraud alert on my credit reports at the three major credit bureaus. So far, it appears that no one has tried to use my information to establish a new medical identity.

What Is Medical Identity Theft?
Medical identity theft occurs when someone uses a person’s name and other data, such as insurance information, without that person’s knowledge or consent to obtain medical services, or uses the person’s identity to make false claims for medical services. If your medical identity is stolen, information about that person could be mixed in with your existing medical records, or new medical records using your identity could be created with a health care provider you’ve never seen.

How Common is Medical Identity Theft?
According to the World Privacy Forum, there were 4 million breaches of medical records in 2008. Estimates vary, but somewhere between 1/4 million and 1.5 million Americans have been victims of medical identity theft (Ponemon Institute survey 3/3/2010). Some people only realize their medial identity has been stolen when a debt collector or an insurance investigator contacts them. More than half of the individuals whose medical identity was stolen didn’t discover that they had been victimized until at least a year after the incident occurred. As a result, it can take many hours of your time and cost up to $20,000 to unravel the problem in order to clear your medial records and credit reports.

Medical identity theft doesn’t require a huge team of scamsters or the plot complexity of “Oceans Eleven.” A disgruntled medical office employee can slip a thumb drive — which can hold confidential information for thousands of patients–into his or her pocket. A doctor retiring from practice could discard paper records in a dumpster or sell them as scrap paper to a school teacher. These actions have been documented! Medical ID theft is such a high profit crime, that organized crime rings have become involved (WPF report P19/56).

Why You Should Care About Medical Identity Theft

The consequences of medical identity theft can be wide-raging and difficult to correct.

Medical ID thieves use your identity to get free medical treatment (including prescription drugs) based on your health insurance coverage.
You may get charged for office visits, services or medical equipment that you did not receive.
You could lose your insurance coverage (Forty-eight percent of respondents to a survey conducted by the Ponemon Institute experienced this).
Your insurance premiums could increase (32% of respondents to the Ponemon Institute survey experienced this).
Your insurer may pay the thief’s claim and apply the amount paid against your annual benefit allowance or lifetime cap.
The medical identity thief may have a medical condition you don’t have. That problem would then show up on your medical records.
- You could subsequently get care you don’t need or that could be harmful to you (the wrong blood, a medication to which you’re allergic).
- When you apply for life or other health insurance, your application could be denied because your records indicate a preexisting condition that you don’t have.
- If you have a diagnosis of a chronic disease or condition that the imposter doesn’t have, you may not get treatment appropriate to your health.
You might be passed over for a job, since some companies check medical records as part of the hiring process.

What Can You Do to Avoid Medical Identity Theft?

Never give your social security number when filling in paperwork at the start of a medical visit. If the staff complains, state your concern about ID theft and demand that they assign you an alternative identity number. Social Security numbers are only to be used for employer-employee interactions.
Request that your doctor not keep your personal information on his or her iPhone. There are so many medical apps available for the iPhone, and physicians may not be aware of the privacy implications if the device is lost.
When you call your doctor to schedule an appointment, ask the staff to confirm when you had your last visit, to ensure that no else has attempted to get medical services while masquerading as you.
When you obtain health care services that are billed to an insurer, carefully examine the Explanation of Benefits from your insurance company to make sure you actually received the services that are being billed.
Keep all paperwork pertaining to your medical care, particularly explanations of benefits and other insurance information, in an easily visible location (I use a green file folder).
Shred any documents relating to medical care that you are not going to file for reference. Do not recycle them for your kids to draw on.
Although there is a push to establish on line versions of all medical records, security issues have not been resolved satisfactorily. I recommend keeping copies of all your recent medical records in a brightly colored 3-ring binder, with a 1-page summary sheet in the front. Take this binder to each doctor’s appointment.
Sometimes fake clinics entice new patients with offers of “free” health care simply to obtain names and insurance information, and then submit fraudulent claims. Before accepting medical services or treatments that are advertised as free, investigate to ensure the offer is legitimate.
Sometimes fraudsters will change your billing address and phone number, which means you may not be seeing all of your medical bills. Avoid this problem by requesting a summary of all the benefits paid in your name during the previous year at the start of each new calendar year. Request it from your insurer’s Customer Service Dept

What To Do If You Are A Victim Of Medical Identity Theft

File a complaint with the Federal Trade Commission online at https://www.ftccomplaintassistant.gov (click on Complaint Assistant to start) or by phone at 1-877-ID-THEFT (438-4338).
Check Defend: Recover from Identity Theft at the FTC.
File a report with your local police,and send copies to the fraud division of your health insurer, your doctors, and the three credit reporting companies. Information on how to file a police report is at www.ftc.gov/idtheft/consumers/defend.html.
Request an accounting (or history) of disclosures. This accounting reveals what www.worldprivacyforum.org/medidtheft_consumertips.html; personal health information was disclosed, and when, why and to whom it was disclosed. The accounting can be important in tracking the information about you and where it went.
Check your personal credit history each year for medical liens that are posted to your report for services you do not receive.
Clean up your medical files, which may contain information about the ID thief that indicate medical conditions that you do not have.

Under the provisions of the Health Insurance Portability and Accountability Act, you have the right correct errors in your medical and billing records. Write to the provider, citing the information that seems inaccurate. Include copies (keep the originals) of any document that supports your statements. Send a request letter your health plan or health care providers. The letter should include your complete name and address, a summary of each item in your record that you dispute, the reasons you dispute the accuracy of the information. Request specifically that each error be deleted or corrected, as appropriate. Enclose a copy of your medical record with the inaccurate items highlighted or circled. Send your letter by certified mail, “return receipt requested,” so you can prove that the material was received. Keep copies of your dispute letter and enclosures.

About the Author
Jane Neff Rollins is an infectious disease epidemiologist who writes about health and trains working adults to navigate our challenging health care system. Her primary interests include patient empowerment, patient-doctor communication, and women’s health. Jane’s writing has appeared in the Los Angeles Times, the Los Angeles Jewish Journal, Reed magazine, and in medical journals and trade magazines. Jane also blogs for KPCC’s citizen sourced journalism community.