Medical Identity Theft — Health Care Industry Needs Better Safeguards
Written by: Kristy Welsh
Last Updated: April 19, 2017
Medical identity theft has become more valuable to criminals than financial identity theft. With more and more of our medical information being digitized by health care providers, this information has become the target of computer and network hackers that break into these electronic records and steal these records. Found in these records are Social Security numbers, health insurance numbers, addresses, and patient names which can all be used to order goods and services (that are never delivered) and bill them to Medicare and Medicaid. These thieves can also corrupt medical records with erroneous information that can lead to incorrect diagnosis and treatment which impacts the entire health care system. Unfortunately, it is the fastest-growing crime in America.
What is Medical Identity Theft?
Medical identity theft is when another person utilizes your personal information to obtain prescription drugs, healthcare services, or even to collect money through fraudulent claims against your health insurance policy. Like other versions of identity theft, it can cause serious financial problems, not to mention an incredible hassle in your life which can go on for years. But in some ways, it's even worse. If an identity thief tampers with your medical records, your chart could have the wrong history and diagnoses. Imagine the wrong allergen or blood type information being listed, for instance, and as result medical ID theft can become a life or death situation.
Medical Identity Theft Statistics
According to the Fifth Annual Study on Medical Identity Theft released by the Medical Identity Theft Alliance in 2015, the number of patients affected by medical identity theft increased nearly 22 percent from 2014. Identity theft of health records has become big business and a growing problem. Experts revealed that 90 percent of healthcare organizations surveyed experienced a data breach and 30 percent of those had more than 5 incidences. Recent estimates of annual medical fraud in the U.S. range from $80 billion to $230 billion. Those numbers are staggering!
This same study goes on to say 29 percent of victims don't find out about the ID theft until a year later with 75 percent of victims finding it difficult to resolve the issues.
Difference Between Medical ID Theft and Financial ID Theft
Victims of financial identity theft typically have a more well-defined path to recovery than those whose medical identities are stolen. Unlike financial identity theft, there's no straightforward process for challenging false medical claims or correcting inaccurate medical records. If a thug steals your wallet and runs up your credit cards with expenditures, you should request that the three major credit bureaus provide you a free credit report, place a fraud alerts on your accounts, and work with your creditors to get inaccurate charges removed. Identity theft is often discovered early on the financial side because credit card issuers have sophisticated systems for detecting fraudulent use of credit cards, in addition to the fact that nearly all financial institutions use one or more of the three credit reporting agencies.
With medical identity theft, it's not that simple. Your medical records are likely to be interspersed among a number of different providers, and there's no merged or even single "medical records clearinghouse" that keeps them. Under HIPAA, the federal law that addresses medical privacy, you're entitled to a copy of these documents, though you may have to pay for it. If there's an error, you can add a correction to the record, but you can't have information deleted. And if you suspect you have been a victim of medical ID theft, healthcare providers may refuse to let you see your own record because once it's intermingled with another individual's record and ironically, that person's privacy must be protected.
How Does Medical Identity Theft Occur?
Uncovering medical identity theft can be a true challenge. Most people never find out that they've been a victim of medical identity theft until they get a notice of an unpaid bill for medical care they never received. By then, it's too late, the damage has been done. Here are just some of the ways that thieves take advantage of unsuspecting victims:
- Insider Fraud. Medical ID thieves bill your health plan for fake or inflated treatment claims. The crooks often are employees inside the healthcare system who know how the insurance billing system works.
- Obtain Free Treatment. Medical ID thieves who don't have their own health coverage often receive free medical treatment, courtesy of your policy. They assume your identity at a hospital or clinic, and your policy receives the bills.
- Obtain Addictive Drugs. Medical personnel with access to your data may use your identity to obtain prescription drugs to sell, or feed their own addictions. Dishonest pharmacists might bill your policy for narcotics, or nurses may call in prescriptions in a patient's name but pick it up themselves.
- Organized Theft Rings. They buy stolen patient information on the black market, and set up fake clinics to bill insurance companies for payment on nonexistent treatment, or obtains medical equipment that it then sells on the black market.
Medical Identity Theft Prevention
- Read the Explanation of Benefits, or EOB, statement that your insurance provider sends you after you've received covered treatment. Confirm that the provider, date of service, and the service provided is correct, and of course that it was you. Amazingly, many people don't review these and they are a key early detection sign.
- Request a complete list of payments made from your health insurance company on an annual basis and review it.
- Be Aware when you are at the doctor's office or pharmacy. Just like when you are using a credit card, pay attention to who's nearby when you're giving the staff your insurance card. Don't leave it sitting on the counter in plain view for others to see.
- Shred documents associated with your health insurance especially those containing your account number and personal information.
- Do a periodic check for discrepancies with the Medical Information Bureau (MIB). The MIB is analogous to a "credit bureau" but collects health-related personal information as opposed to financial, and has a comprehensive list of insurance companies that belong to it. Any time an individual applies for life or health insurance, this information is likely to be reported to the MIB.
- Get a current copy of your medical records in case they are tampered with in the future.
- Exercise your right for a free annual copy of your credit report. Most medical ID theft is first noted when the claim makes the transition to the billing department. If you have an unpaid medical bill on your credit report that you don't recognize, you've probably been victimized.
What to Do If You Are a Victim of Medical Identity Theft
- Call the authorities and file a police report. Be sure to send a copy of the report to your insurer, medical providers and all credit bureaus.
- Call your insurance company and report it. You will likely be put in contact with the fraud department, who should immediately disable your health insurance account, issue you a new card and account, and advise you through the process of dealing with any billing, collections or records issues that may have occurred.
- Request access to your medical records. If you suspect you're a victim of medical ID fraud, get a copy of your records from your doctor, hospital, pharmacy or laboratory. If you find errors in your medical files, have them corrected immediately.
- Contact the three major credit bureaus, your bank or financial institutions, and your credit card issuers. Inform them that your medical identity has been stolen. Place a fraud alert and credit freeze on your credit reports if you've been scammed.
- File a medical identify theft complaint. File with complaint with the Federal Trade Commission (FTC) or call the FTC's toll free hotline at (877) IDTHEFT.
- If you are refused access to your medical records, appeal. To appeal, follow the steps outlined in your medical provider's notice of privacy practices. If you still aren't satisfied, file a health-privacy complaint with the U.S. Department of Health and Human Services or call 1-800-368-1019.
There may serious consequences to medical ID theft; you could receive improper treatment because your medical records contain inaccurate information like the wrong blood type, test results that don't belong to you, treatment you never received, or diagnosis of an illness you don't have. If you've been a victim of medical identity theft, report it to your local police department and the Federal Trade Commission. You should place either a fraud alert or security freeze on your credit report to warn future businesses that you've been victimized. Finally, work with your insurance company and medical providers to clear your name of the charges.