What Is Medical Identity Theft?

How Can Medical Identity Theft Occur?

The first step in medical identity theft is stealing your personal information. The thieves might get your name, address, Social Security number and health insurance information from different sources, including:

• Data breaches: There are hundreds of data breaches that include medical records every year, and these breaches have exposed millions of people's information. The U.S. Department of Health and Human Services (HHS) maintains a list of reported breaches from the previous 24 months.
• Physical theft: The thieves might go through your mail or trash and steal something with information on it, such as your health insurance card, prescriptions, billing statements or an explanation of benefits form.
• Phishing: A criminal might send you an email or text, or call you, and try to trick you into sharing your information. They might pretend to be conducting a survey or claim they work for a health care provider or government agency and need your information to confirm an appointment or secure your account. Or they may try to trick you into clicking a link and downloading malware, which can infect your device and steal your information.
• Scams: There are also various medical-related scams. The scammers will ask for your information and promise free medical care, devices or other benefits—like groceries or transportation.

Medical identity theft can also happen when:

• Medical providers commit fraud: Employees might steal or use patients' information to submit fraudulent claims to insurance companies and government agencies.
• Someone buys your information: The identity thieves might sell your information instead of using it to commit fraud.
• People share insurance information: Some people willingly share their health insurance information with a friend or family member who needs medical care. Even if their intentions are virtuous, it's still fraud and it could lead to problems.

No matter how it happens, medical identity theft and fraud can have severe repercussions. It can take a lot of time and effort to prove you were the victim of fraud and fix your medical records. Depending on what happened, you may also need to correct your credit reports, or even your criminal record.

Incorrect medical and insurance records can also lead to life-threatening mistakes and delays. A doctor may give (or withhold) medications or treatments based on a medical record that contains incorrect information. Your insurance company could also deny necessary treatments or medications due to the fraudulently filed claims.

Learn more >> How Does Identity Theft Happen?

6 Signs of Medical Identity Theft

You might be at risk or a victim of medical identity theft if you receive or notice one of the following:

1. Data breach notifications: A company might tell you that your information was exposed in a data breach. Although this doesn't mean someone has used your information, you should be on alert if you know the breach compromised your information.
2. Unexpected medical notifications: You might get a letter, text, email or call about an upcoming appointment or prescription. Additionally, you might receive a bill or explanation of benefits (EOBs) for an appointment or purchase.
3. Unusual bills or collection accounts: You might receive a bill for a service you didn't receive or get a call from a provider or debt collector about the bill. You also might find there's a medical collection account in your credit reports.
4. Errors in your medical records: You can review your medical records and look for errors, such as a procedure you didn't receive or test results for a test you never took.
5. Changes in your personal information: You might notice there's a change in your personal information, such as your address, when you log in to your health portal, health insurance account or go to a doctor appointment.
6. Surprising health insurance charges: Look for signs that someone used your health insurance, such as changes in how much remains for your annual deductible.

How to Prevent Medical Identity Theft

Here are a few steps you can take to help protect yourself from medical identity theft. Some are specific to preventing medical identity theft; others can also help reduce the risk of other forms of identity theft.

• Secure your online accounts. Create a unique and secure password for all your accounts, or use a passkey, and enable multifactor authentication to minimize the fallout of a data breach.
• Keep your information private. Never share your personal information, including health plan information, over the phone or by email unless you initiated the conversation. Be extra cautious about sharing your information with people and companies that promise to give you free products or services.
• Contact your insurance company. Tell your insurance company if you think your information was stolen or exposed in a data breach
• Monitor your accounts and reports. Regularly review your health insurance account and medical records for errors. You can also monitor your credit for signs of identity theft, such as new hard inquiries (an indication that someone applied for credit), new accounts and collection accounts.
• Retain old medical records. Keep copies of old medical records and other documents because you may need them to correct your record if you're the victim of medical identity theft.
• Destroy items that have your personal information. Shred or safely dispose of health records, EOBs, old insurance cards, prescription pill bottles and anything else that has your personal and medical information.
• Keep devices updated and clean. Install the latest updates on your devices and regularly run an antivirus scan to check for malware.

What to Do if You're a Victim of Medical Identity Theft

Even with precautions in place, a data breach or dishonest employee could lead to medical identity theft and fraud. If you know or suspect you've been the victim of medical identity theft or fraud:

• Submit a report to the Federal Trade Commission (FTC) on IdentityTheft.gov. The FTC can create a recovery plan and give you an FTC Identity Theft Report, which you may need when correcting your medical records. If you create an account, the FTC can auto-fill forms and track your progress online. You might also want to file a crime report with your local law enforcement.
• Request copies of your EOBs, medical records and accounting of disclosures. Review the EOB statements and medical records closely for errors. The accounting of disclosures will tell you what the provider sent and who they sent information to, which can help you figure out who to contact when you need to fix errors.
• Dispute the errors and correct your medical records. Contact your health insurance company and health care providers to fix your medical records. You may need to send copies of documents that support your claims and wait for the companies to investigate before they update your records. If they don't make changes, you can add a statement of disagreement to your records.
• Secure your credit reports. You have the right to add a fraud alert or security freeze to your credit reports, which can help keep fraudsters from using your information to open new credit accounts, such as a medical credit card.

If you're struggling to correct medical record errors on your own, you can call or chat with a representative from the nonprofit Identity Theft Resource Center, which offers free victim assistance services.

Learn more >> How to Report Identity Theft

Watch for Other Signs of Identity Fraud

You can also look for ways to monitor other databases for signs of identity fraud, including your credit reports, financial accounts and public records. Experian offers free credit reporting monitoring with real-time alerts. A paid premium membership offers monitoring of additional databases and benefits, such as access to fraud resolution specialists and up to $1 million in identity theft insurance.