Consumer Tips: Medical Identity Theft- What to Do if You are a Victim (or are concerned about it)

 

It is in your best interest to find out about medical identity theft, because fraudsters who use your identity for medical care or services can introduce changes to your health record that can be difficult to undo. These changes can range from small things that do not pose a risk to you to substantial erroneous information that can pose a medical risk to you.

For this reason, to completely resolve medical identity theft, it may also important to clean up your credit report, if necessary. But it is just as important to clean up your health records, which may have been altered to reflect diseases that you do not have, allergies that are not yours, or a blood type that is wrong.

Discovering medical identity theft is not like discovering financial identity theft. It can be harder to detect medical identity theft, and sometimes you need to look in different places. For example, some people find out about medical identity theft when a debt collector sends a letter or calls. Others only find out after an insurance investigator alerts them to the problem, after they notice errors in their health record,or after they get an unexpected bill for a health service they did not receive.

Based on some of the cases of medical identity theft that have come to light, here is some information specifically tailored to victims of medical identity theft, and to those who would like to take preventive steps.

  • Closely monitor any “Explanation of Benefits” sent by an public or private health insurer
  • Pro-actively request a listing of benefits from your health insurers
  • Request a copy of current medical files from each health care provider
  • File a police report
  • Correct erroneous and false information in your file
  • Keep an eye on your credit report
  • Request an accounting of disclosures

(Note: These are general consumer tips — for detailed information and sample letters see our FAQ for victims.)

 

Closely monitor any “Explanation of Benefits” sent by a public or private health insurer

A number of victims discovered they had a problem by carefully reviewing insurance statements. If anything appears wrong, raise questions with the insurer or the provider involved. Do not assume that things are okay just because you don’t owe money.

The kinds of problems you may see can include:

  • Being charged for services that you did not receive.
  • Being charged for office visits you did not make.
  • Being charged for medical equipment you did not receive.

 

Pro-actively request a listing of benefits from your health insurers

Once a year, proactively request a listing of benefits paid in your name by your health insurer. It is important to do this pro-actively, without waiting for the insurance company to send you a listing. If there are payments you do not recognize, follow up with the insurer or provider to learn more.

Sometimes fraudsters will change your billing address and phone number, which means you may not be seeing all of your bills. Asking your insurer pro-actively for information will help foil fraudsters who use this technique.
You have a right to a copy of your records from every health insurer and nearly every health care provider under the health privacy rule issued under the authority of the Health Insurance Portability and Accountability Act (HIPAA). You also have a right to receive a notice of privacy practices from insurers and providers. The notice of privacy practices will explain any procedures and fees that are required for access requests.

 

Request a copy of current medical files from each health care provider

You can ask your health care providers to allow you to inspect or have a copy of the health record that they maintain about you. A good tip is to simply make the request each time you go to the doctor. It is helpful to do this before you need to — be proactive. It is sometimes much easier to get a copy of your health record before there are problems than after there are problems.
Even if you are not a victim of medical identity theft there are many good reasons why you may want a copy of your health record. For example, some people like to keep copies of their health records so they can maintain a personal health record in one place. (For more information on this strategy, see the web site of the American Health Information Management Association at http://www.myphr.com/.)

But if you think that you may have been a victim of medical identity theft, obtaining a copy of your record from your doctor, hospital, pharmacy, or laboratory may be essential in finding out about the theft and recovering from the crime. Obtaining your health records can be complicated and may present some choices for you to make, but it is an essential step if you are a victim of medical identity theft. Below is a quick guide to help. (For a detailed guide, please see our FAQ for victims.)

  • While you generally have the right to inspect and have a copy of your health record, a health care provider such as a hospital or your doctor can charge you a fee for a copy. You may want to think about the costs involved before you ask. Copies of X-rays, for instance, can be expensive.
  • In some cases of medical identity theft, some health care providers have been reluctant to show medical identity theft victims the health records. If the provider decides that the information in your file is not about you, then the provider may reject your request. This is a difficult situation, but it is important to insist on your rights. Explain why you believe that you have been a victim of medical identity theft and politely ask for the assistance of the provider in figuring out if this is the case. The provider may also have been a victim of the same thief because the thief used services that he or she did not pay for. You and your provider may have a joint interest in learning what happened. Some hospitals have used a system The World Privacy Forum calls a “Jane/John doe file extraction” to help victims while still protecting the “trail” of the records. If your healthcare provider is not giving you your records, it may potentially be helpful to ask them to read about the file extraction process in our document on best practices for health care providers.
  • If a healthcare provider refuses to release medical files that are in your name, and you are getting nowhere in your requests, you should be able to file an appeal of the denial. The provider’s “notice of privacy practices” (or privacy policy) will explain the provider’s appeal procedure. You are entitled to a copy of the provider’s notice of privacy practices upon request and without cost.
  • If you are not satisfied with how your request for access or for a copy has been handled, you may file a complaint with the Office of Civil Rights at the federal Department of Health and Human Services <http://www.hhs.gov/ocr/privacy/index.html>.You may have greater rights under the laws in your state, and you may be able to obtain assistance from your state health departments, fraud investigators, elected representatives, or lawyers if you believe that the denial of access may be covering medical identity theft.

Asking for a copy of all of your health records may provide more information than you need and be expensive. If, for example, someone stole your identity and had several surgeries, the file can be several hundred pages or more. If you think that you are a victim of medical identity theft, ask for the specific records that will provide the information that you need. For example, if you receive a notice that a hospital treated you for diabetes, ask for the records about that diagnosis for about a particular visit that is questionable. If the information shows a problem, you can always ask for more information.

 

File a police report

If you are a victim of medical identity theft, it is important to file a police report. You may need this police report for health care providers and insurance companies. Even if you do not have insurance, a police report will be helpful in verifying that you are a victim. In some cases, victims of medical identity theft can have financial impacts from the crime. For example, victims can have substantial collections from hospitals and other health care providers listed on their credit report. You will want a police report on file for these situations. (See the heading Keep an Eye on Your Credit Report in this tipsheet for how to deal with collections in your record.) Also, in the crime of medical identity theft, some of the people who commit the crime may seek drugs at various health care providers. In these cases, a police report can be important to help you show that there is a person impersonating you.
However, obtaining a police report in medical identity theft cases may not be that simple, and police may be less aware of the crime of medical identity theft. The records that show the crime may not be in a city or state where you live, and police may be unwilling to fulfill your request for a police report. Showing evidence of medical identity theft may be hard to do.

 

Correct erroneous and false information in your file

Some victims of medical identity theft take the time to clean up their financial records after the crime, but they may neglect to get their health records corrected. It can take some time to get your health records corrected, but this is critically important for all victims of medical identity theft to do. No one wants inaccurate information in health care files impacting their health care If you discover your health or insurance records contain erroneous information, work to amend those records to remove the information that is not yours. If you find information that is not about you or that bears no relationship to diseases you have, or if the information describes treatment that you did not receive, firmly request that the false information be removed entirely from the record.

Amending a health record can be a challenging process. Here are some general guidelines for amending your record:

  • If you find errors in a doctor’s office file, you may find that the doctor will simply delete the errors or mark the erroneous information. However, if you straighten out your doctor’s records about you, it does not mean you are finished. The insurance company may have copies of the same information, and these will need to be corrected, too. There could be laboratory or pharmacy records too. It can take some effort to track down all of the locations and record keepers that have the erroneous information. You may have to make separate requests at each record keeper.
  • When one record keeper corrects a record, that record keeper has an obligation under the HIPAA federal health privacy rule to inform others to whom it disclosed the original information. You will normally want to insist that each record keeper tell others about the correction. Do not rely on representations that these correction notices have been sent. Ask each of the other record keepers if the corrections were received and entered properly in your record.
  • In some cases of medical identity theft, the doctor — or an imposter posing as a doctor — has altered the health records. In these cases, you will have to work hard with your insurance company to get false information removed.
  • If you believe that you were a victim of medical identity theft, it may be especially useful to file a police report and obtain a copy of that report. Sending copies of a police report to insurers, providers, and credit bureaus may be a step in cleaning up the problem. There is no guarantee that a police report will cure all the problems, but it should be useful.
  • Doctors and hospitals are often reluctant to remove erroneous information from a health record. Sometimes, action was taken based on erroneous information, and the wrong information is needed to explain why that action was taken. The reluctance to remove erroneous information entirely when this has happened is understandable. The usual remedy is to keep the erroneous information and indicate why it is wrong. However, for a victim of medical identity theft, removal of information may be essential. Suppose that a thief’s actions resulted in your medical file being changed to reflect an appendectomy that you never received, an incorrect blood type, or a diagnosis of psychosis that does not apply to you. That wrong information in your file may haunt you in the future, affect your future health treatment, make it difficult to obtain health or life insurance in the future, or have other serious consequences. Remind providers that if they fail to clear up the problem, they may be at risk as well.
    Explaining the problem clearly, carefully, and politely to insurers and providers may help. When record keepers are reluctant to make changes, a police report may be convincing. It may also be necessary in some cases to seek legal help. A lawyer may be able to convince a doctor or hospital to solve your problem when all else fails. There may also be formal legal remedies available against record keepers that created or maintain erroneous records that may result in harm to medical identity theft victims.

 

Keep an eye on your credit report

Some victims of medical identity theft discover it by checking their credit report. One frequently seen result for victims of medical identity theft is to find a collection notice for a hospital, medical lab, or for a variety of medical services on the report.
If the imposter used your name, Social Security Number, and insurance information, it can be difficult to prove that the debt does not belong to you. In a number of cases, victims have been able to prove their innocence by comparing the false entries in the medical file with their regular medical files. For example, the victim who was treated may be older or younger than you, and may have different diseases, and so on.
In order to remove the debt collection action from your credit report, file a police report and send the report to the collection agencies. Place a dispute on the collection notice(s) right away. You can learn more about your rights under the Fair Credit Billing Act at the web site of the Federal Trade Commission at <http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre16.shtm>. It is important to follow the proper procedures under that Act in order to preserve your rights.

 

Request an accounting of disclosures

An accounting of disclosures is a right under HIPAA that few individuals know about. It can be an important tool to help combat medical identity theft.

An accounting of disclosures, sometimes called a history of disclosures, is a record of the disclosures of personal health information made by health care providers or insurers. This record shows what information was disclosed, when it was disclosed, why it was disclosed, and the recipient of the information. If erroneous information about you was created, there is a good chance that it was circulated to others. The accounting can be important in tracking the information about you and where it went.

Under the HIPAA federal health privacy rule, you have a right to a copy of the account of disclosures of your records made by health care providers and insurers. Unfortunately, the federal rule does not require an accounting when records are disclosed for treatment, payment, or many other purposes. However, some institutions may maintain these records anyway, and they may share it with you if you ask.

If you think that you are a victim of medical identity theft, request annually (or more often if there is a specific cause for concern) an accounting of disclosures from health care providers and health insurers. The record keeper’s notice of privacy practices should explain the procedure for making a request. The World Privacy Forum has sample letters and many details on making these kinds of requests in our FAQ for victims.

The HIPAA accounting rule is changing, and your right to obtain accounting records may expand for records maintained electronically. Even if the changed rule has not yet taken effect, a hospital that has electronic records and more expansive accounting records might be willing to share them if you explain that you need the records because you are a medical identity theft victim.

 

Resources

  • If you suspect you have been the victim of Medicare fraud, call 1-800-MEDICARE (1-800-633-4227). For Medicaid fraud, call 800-HHS-TIPS (1-800-447-8477).
  • You can also file a medical identity theft complaint at the FTC, and take advantage of their excellent resources on resolving the financial aspects of medical identity theft. < http://www.ftc.gov/bcp/edu/microsites/idtheft/>. By phone: call the FTC Identity Theft Toll-Free Hotline at 1-877-IDTHEFT (438-4338).
  • The Blue Cross/Blue Shield has an excellent page of tips for preventing fraud problems. < http://www.bcbs.com/report-healthcare-fraud/> Blue Cross/ Blue Shield recommends that you should be cautious of free medical exams, co-payment waivers, or advertisements stating “covered by insurance.” They also recommend that you think of your healthcare card as being as valuable as a credit card. “If lost or stolen, a healthcare card could be used to gain access to drugs and services that may permanently appear on your medical history.”
  • Many insurers have fraud hotlines. If you suspect medical identity theft, call your insurer and ask for their fraud hotline number.

 

 

The World Privacy Forum has a detailed set of guidelines and sample letters for victims that can be found here.

Authors: Pam Dixon, Robert Gellman.

Publishing history:

Updated April 20, 2012; March 18, 2008; June 5, 2006; Published May 8, 2006.