|
Medical Identity Theft: What to Do if You
are a Victim (or are concerned about it)
It is in your best interest to find out about medical identity theft,
because fraudsters who use your identity for medical care or services
can introduce changes to your health record that can be difficult to undo.
These changes can range from small things that do not pose a risk to you
to substantial erroneous information that can pose a medical risk to you.
For this reason, to completely resolve medical identity theft, it may
also important to clean up your credit report, if necessary. But it is
just as important to clean up your health records, which may have been
altered to reflect diseases that you do not have, allergies that are not
yours, or a blood type that is wrong.
Discovering medical identity theft is not like discovering financial identity
theft. It can be harder to detect medical identity theft, and sometimes
you need to look in different places. For example, some people find out
about medical identity theft when a debt collector sends a letter or calls.
Others only find out after an insurance investigator alerts them to the
problem, after they notice errors in their health record,or after they
get an unexpected bill for a health service they did not receive.
Based on some of the cases of medical identity theft that have come to
light, here is some information specifically tailored to victims of medical
identity theft, and to those who would like to take preventive steps.
Each bullet point links to a more detailed explanation below:
(Note: These are general consumer tips -- for detailed information and
sample letters see our FAQ
for victims.)
Closely monitor any "Explanation of Benefits" sent by a public
or private health insurer
A number of victims discovered they had a problem by carefully reviewing
insurance statements. If anything appears wrong, raise questions with
the insurer or the provider involved. Do not assume that things are okay
just because you don't owe money.
The kinds of problems you may see can include:
- Being charged for services that you did not receive.
- Being charged for office visits you did not make.
- Being charged for medical equipment you did not receive.
Pro-actively request a listing of benefits from your health insurers
Once a year, proactively request a listing of benefits paid in your name
by your health insurer. It is important to do this pro-actively, without
waiting for the insurance company to send you a listing. If there are
payments you do not recognize, follow up with the insurer or provider
to learn more.
Sometimes fraudsters will change your billing address and phone number,
which means you may not be seeing all of your bills. Asking your insurer
pro-actively for information will help foil fraudsters who use this technique.
You have a right to a copy of your records from every health insurer and
nearly every health care provider under the health privacy rule issued
under the authority of the Health Insurance Portability and Accountability
Act (HIPAA). You also have a right to receive a notice of privacy practices
from insurers and providers. The notice of privacy practices will explain
any procedures and fees that are required for access requests.
Request a copy of current medical files from each health care provider
You can ask your health care providers to allow you to inspect or have
a copy of the health record that they maintain about you. A good tip is
to simply make the request each time you go to the doctor. It is helpful
to do this before you need to -- be proactive. It is sometimes much easier
to get a copy of your health record before there are problems than after
there are problems.
Even if you are not a victim of medical identity theft there are many
good reasons why you may want a copy of your health record. For example,
some people like to keep copies of their health records so they can maintain
a personal health record in one place. (For more information on this strategy,
see the web site of the American Health Information Management Association
at http://www.myphr.com/.)
But if you think that you may have been a victim of medical identity
theft, obtaining a copy of your record from your doctor, hospital, pharmacy,
or laboratory may be essential in finding out about the theft and recovering
from the crime. Obtaining your health records can be complicated and may
present some choices for you to make, but it is an essential step if you
are a victim of medical identity theft. Below is a quick guide to help.
(For a detailed guide, please see our
FAQ for victims, available
here.)
- While you generally have the right to inspect and have a copy of your
health record, a health care provider such as a hospital or your doctor
can charge you a fee for a copy. You may want to think about the costs
involved before you ask. Copies of X-rays, for instance, can be expensive.
- In some cases of medical identity theft, some health care providers
have been reluctant to show medical identity theft victims the health
records. If the provider decides that the information in your file is
not about you, then the provider may reject your request. This is a
difficult situation, but it is important to insist on your rights. Explain
why you believe that you have been a victim of medical identity theft
and politely ask for the assistance of the provider in figuring out
if this is the case. The provider may also have been a victim of the
same thief because the thief used services that he or she did not pay
for. You and your provider may have a joint interest in learning what
happened. Some hospitals have used a system The World Privacy Forum
calls a "Jane/John doe file extraction" to help victims while
still protecting the "trail" of the records. If your healthcare
provider is not giving you your records, it may potentially be helpful
to ask them to read about the file extraction process in our document
on best
practices for health care providers available
here.
- If a healthcare provider refuses to release medical files that are
in your name, and you are getting nowhere in your requests, you should
be able to file an appeal of the denial. The provider’s "notice
of privacy practices" (or privacy policy) will explain the provider’s
appeal procedure. You are entitled to a copy of the provider’s
notice of privacy practices upon request and without cost.
- If you are not satisfied with how your request for access or for a
copy has been handled, you may file a complaint with the Office of Civil
Rights at the federal Department of Health and Human Services <http://www.hhs.gov/ocr/privacy/index.html>.You
may have greater rights under the laws in your state, and you may be
able to obtain assistance from your state health departments, fraud
investigators, elected representatives, or lawyers if you believe that
the denial of access may be covering medical identity theft.
Asking for a copy of all of your health records may provide more information
than you need and be expensive. If, for example, someone stole your identity
and had several surgeries, the file can be several hundred pages or more.
If you think that you are a victim of medical identity theft, ask for
the specific records that will provide the information that you need.
For example, if you receive a notice that a hospital treated you for diabetes,
ask for the records about that diagnosis for about a particular visit
that is questionable. If the information shows a problem, you can always
ask for more information.
File a police report
If you are a victim of medical identity theft, it is important to file
a police report. You may need this police report for health care providers
and insurance companies. Even if you do not have insurance, a police report
will be helpful in verifying that you are a victim. In some cases, victims
of medical identity theft can have financial impacts from the crime. For
example, victims can have substantial collections from hospitals and other
health care providers listed on their credit report. You will want a police
report on file for these situations. (See the heading Keep an Eye on Your
Credit Report in this tipsheet for how to deal with collections in your
record.) Also, in the crime of medical identity theft, some of the people
who commit the crime may seek drugs at various health care providers.
In these cases, a police report can be important to help you show that
there is a person impersonating you.
However, obtaining a police report in medical identity theft cases may
not be that simple, and police may be less aware of the crime of medical
identity theft. The records that show the crime may not be in a city or
state where you live, and police may be unwilling to fulfill your request
for a police report. Showing evidence of medical identity theft may be
hard to do.
Correct erroneous and false information in your file
Some victims of medical identity theft take the time to clean up their
financial records after the crime, but they may neglect to get their health
records corrected. It can take some time to get your health records corrected,
but this is critically important for all victims of medical identity theft
to do. No one wants inaccurate information in health care files impacting
their health care If you discover your health or insurance records contain
erroneous information, work to amend those records to remove the information
that is not yours. If you find information that is not about you or that
bears no relationship to diseases you have, or if the information describes
treatment that you did not receive, firmly request that the false information
be removed entirely from the record.
Amending a health record can be a challenging process. Here are some
general guidelines for amending your record:
- If you find errors in a doctor's office file, you may find that the
doctor will simply delete the errors or mark the erroneous information.
However, if you straighten out your doctor’s records about you,
it does not mean you are finished. The insurance company may have copies
of the same information, and these will need to be corrected, too. There
could be laboratory or pharmacy records too. It can take some effort
to track down all of the locations and record keepers that have the
erroneous information. You may have to make separate requests at each
record keeper.
- When one record keeper corrects a record, that record keeper has
an obligation under the HIPAA federal health privacy rule to inform
others to whom it disclosed the original information. You will normally
want to insist that each record keeper tell others about the correction.
Do not rely on representations that these correction notices have been
sent. Ask each of the other record keepers if the corrections were received
and entered properly in your record.
- In some cases of medical identity theft, the doctor -- or an imposter
posing as a doctor -- has altered the health records. In these cases,
you will have to work hard with your insurance company to get false
information removed.
- If you believe that you were a victim of medical identity theft, it
may be especially useful to file a police report and obtain a copy of
that report. Sending copies of a police report to insurers, providers,
and credit bureaus may be a step in cleaning up the problem. There is
no guarantee that a police report will cure all the problems, but it
should be useful.
- Doctors and hospitals are often reluctant to remove erroneous information
from a health record. Sometimes, action was taken based on erroneous
information, and the wrong information is needed to explain why that
action was taken. The reluctance to remove erroneous information entirely
when this has happened is understandable. The usual remedy is to keep
the erroneous information and indicate why it is wrong.
However, for a victim of medical identity theft, removal of information
may be essential. Suppose that a thief’s actions resulted in
your medical file being changed to reflect an appendectomy that you
never received, an incorrect blood type, or a diagnosis of psychosis
that does not apply to you. That wrong information in your file may
haunt you in the future, affect your future health treatment, make
it difficult to obtain health or life insurance in the future, or
have other serious consequences. Remind providers that if they fail
to clear up the problem, they may be at risk as well.
Explaining the problem clearly, carefully, and politely to insurers
and providers may help. When record keepers are reluctant to make
changes, a police report may be convincing. It may also be necessary
in some cases to seek legal help. A lawyer may be able to convince
a doctor or hospital to solve your problem when all else fails. There
may also be formal legal remedies available against record keepers
that created or maintain erroneous records that may result in harm
to medical identity theft victims.
Keep an eye on your credit report
Some victims of medical identity theft discover it by checking their
credit report. One frequently seen result for victims of medical identity
theft is to find a collection notice for a hospital, medical lab, or for
a variety of medical services on the report.
If the imposter used your name, Social Security Number, and insurance
information, it can be difficult to prove that the debt does not belong
to you. In a number of cases, victims have been able to prove their innocence
by comparing the false entries in the medical file with their regular
medical files. For example, the victim who was treated may be older or
younger than you, and may have different diseases, and so on.
In order to remove the debt collection action from your credit report,
file a police report and send the report to the collection agencies. Place
a dispute on the collection notice(s) right away. You can learn more about
your rights under the Fair Credit Billing Act at the web site of the Federal
Trade Commission at <http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre16.shtm>.
It is important to follow the proper procedures under that Act in order
to preserve your rights.
Request an accounting of disclosures
An accounting of disclosures is a right under HIPAA that few individuals
know about. It can be an important tool to help combat medical identity
theft.
An accounting of disclosures, sometimes called a history
of disclosures, is a record of the disclosures of personal health
information made by health care providers or insurers. This record shows
what information was disclosed, when it was disclosed, why it was disclosed,
and the recipient of the information. If erroneous information about you
was created, there is a good chance that it was circulated to others.
The accounting can be important in tracking the information about you
and where it went.
Under the HIPAA federal health privacy rule, you have a right to a copy
of the account of disclosures of your records made by health care providers
and insurers. Unfortunately, the federal rule does not require an accounting
when records are disclosed for treatment, payment, or many other purposes.
However, some institutions may maintain these records anyway, and they
may share it with you if you ask.
If you think that you are a victim of medical identity theft, request
annually (or more often if there is a specific cause for concern) an accounting
of disclosures from health care providers and health insurers. The record
keeper’s notice of privacy practices should explain the procedure
for making a request. The World Privacy Forum has sample letters and many
details on making these kinds of requests
in our FAQ for victims.
The HIPAA accounting rule is changing, and your right to obtain accounting
records may expand for records maintained electronically. Even if the
changed rule has not yet taken effect, a hospital that has electronic
records and more expansive accounting records might be willing to share
them if you explain that you need the records because you are a medical
identity theft victim.
Resources
- • If you suspect you have been the victim of Medicare fraud,
call 1-800-MEDICARE (1-800-633-4227). For Medicaid fraud, call 800-HHS-TIPS
(1-800-447-8477).
- The Blue Cross/Blue Shield has an excellent page of tips for preventing
fraud problems. < http://www.bcbs.com/report-healthcare-fraud/>
Blue Cross/ Blue Shield recommends that you should be cautious of
free medical exams, co-payment waivers, or advertisements stating
“covered by insurance.” They also recommend that you think
of your healthcare card as being as valuable as a credit card. "If
lost or stolen, a healthcare card could be used to gain access to
drugs and services that may permanently appear on your medical history."
- Many insurers have fraud hotlines. If you suspect medical identity
theft, call your insurer and ask for their fraud hotline number.
The World Privacy Forum has a detailed set of guidelines and sample letters
for victims that can be found here.
Authors: Pam Dixon, Robert Gellman.
Publishing history:
Updated April 20, 2012; March 18, 2008; June 5, 2006; Published May
8, 2006.
|
Other resources
|
