Released: May 09, 2006

Medical ID theft can kill you

Contact: World Privacy Forum

Medical identity theft, is a little studied crime that carries potent risk, according to a new report issued by the World Privacy Forum. Victims of this crime may suffer from a variety of harms, including the now well-recognized signs of financial identity theft. But medical identity theft may also bring further harms to its victims and can put the health and safety of victims at risk.

The World Privacy Forum is a non-profit public interest research and consumer education group. It focuses on a range of privacy matters, including financial, medical, employment, and Internet privacy issues. The World Privacy Forum was founded in 2003 and is based in San Diego, California. Pam Dixon, the executive director of the World Privacy Forum and the author of the report said: "I don't know why it has taken so long to look at the problems unique to medical identity theft, but this report is a first step in understanding this crime, which has its own mechanisms and harms that consumers need to be aware of."

Many victims of medical identity theft have false and erroneous information put in their medical files due to the activities of their imposters. One victim found wrong blood type information put in a file due to the activities of her imposter; another person had a debt collector call him for a surgery he never had.

Erroneous information in victim's medical files can lead to other difficulties later on, such as denial of insurance for diseases the victim may not have and incorrect medical treatment based on errors. False entries in health records can exist at hospitals, doctors' offices, pharmacies, and insurance companies and can be nearly impossible to correct.

Medical identity theft often leaves its victims without substantive recourse or clear pathways to follow for help. Recovery for victims of medical identity may be difficult or impossible because of the lack of enforceable rights, and because of the dispersed and often hidden nature of medical records.

Key findings in the report include:

• This crime is under-researched and under-documented.
• False entries in medical records are a hallmark of medical identity theft. Victims may have had their medical records altered without their permission, consent, and often knowledge. False entries can range from minor changes to substantial changes that can introduce potentially life-threatening medical errors.
• False entries made to medical files can be difficult for many victims to find unless they have been notified through some other "crime flag" such as a bill for services they did not receive, or a collections notice from a hospital.
• Victims do not have clear pathways for recourse and recovery. The Fair Credit Reporting Act allows for greater recourse for victims of financial identity theft than the HIPAA health privacy rule provides for victims of medical identity theft. For example, under HIPAA, victims do not have the legal right to demand correction of their medical information that was not created by the provider or insurer currently maintaining or using the information. This complexity and circularity can make it extremely difficult for a medical identity theft victim to erase false entries from a medical or insurance record.

Key recommendations in the report include:

• Individuals‚ rights to correct errors in their medical histories and files need to be expanded to allow them to remove false information from their files.
• Individuals should have the right to receive one free copy of their medical file.
• Individuals should have expanded rights to obtain an accounting of disclosures of health information.
• Studies are needed to determine what the incidence of medical identity theft is, how and where it is occurring, and how it can be detected and prevented.
• Notification of medical data breaches to consumers has the potential to save lives and protect health.
• All working prototypes for the National Health Information Network need comprehensive risk assessments focused on preventing medical identity theft while protecting patient privacy.

It is in your best interest to find out about medical identity theft, because fraudsters who are using your identity for medical care or services can introduce changes to your medical record that can be nearly impossible to undo. These changes can range from small things that do not pose a risk to you to substantial erroneous information that can pose a medical risk to you.

For this reason, to truly resolve medical identity theft, it is important to clean up your credit report if necessary. And it is just as important to clean up your medical files, which may have been altered to reflect diseases that you do not have.

Discovering medical identity theft is not like discovering financial identity theft: it can be harder to detect medical identity theft, and you sometimes need to look in different places. For example, some people find out about medical identity theft when a debt collector sends a letter or calls. But others only find out after an insurance investigator alerts them to the problem, or after they notice errors in their medical file, or after they get a strange bill for medical services they did not receive.

Based on some of the cases of medical identity theft that have come to light, World Privacy Forum offers these tips:

Closely monitor any "Explanation of Benefits" sent by an public or private health insurer.

A number of victims discovered they had a problem by carefully reviewing insurance statements. If anything appears wrong, raise questions with the insurer or the provider involved. Do not assume that things are okay just because you don't owe money.

The kinds of problems you may see can include:

• Being charged for services that you did not receive .
• Being charged for office visits you did not make.
• Being charged for medical equipment you did not receive.

Request an accounting of payments from your insurers

Once a year, pro-actively request a listing of benefits paid in your name by any health insurer that might have made payments on your behalf. It is important to do this pro-actively, without waiting for the insurance company to simply send you a listing. Sometimes fraudsters will change your billing address and phone number, which means you may not be seeing all of your bills. Asking your insurer pro-actively for this information will help foil fraudsters who use this technique.

Request an accounting of disclosures

Request annually (or more often if there is a specific cause for concern) an accounting of disclosures from health care providers and health insurers. "Accounting of disclosures" is a specific right under the federal health law, HIPAA. What the accounting will tell you is, generally, who has accessed your health records in certain circumstances. An accounting of disclosures should, if done correctly by the health care provider, reveal any data breaches that have occurred.

To request an accounting, follow the directions your health care provider gives you. You will need to make your request in writing.

Request a copy of current medical files from each health care provider.

Under HIPAA, you have the right to see your health care file. If you want a copy of your files, a health care provider does have the right to charge you a fee for this. In some cases of medical identity theft, health care providers have been reluctant to show medical identity theft victims their health records. If this happens to you, stand your ground and insist on your rights: your medical file is a crucial document for you to see.

If a healthcare provider, for example, a hospital, refuses to release medical files that are in your name, file an appeal under HIPAA at the hospital. Also file a complaint with the Office of Civil Rights at the federal Department of Health and Human Services if you are not satisfied. Consider seeking assistance from state health departments, fraud investigators, elected representatives, or lawyers if you believe that the denial of access may be covering medical identity theft.

Correct erroneous and false information in your file

If you discover your medical or insurance records contain erroneous information, work to amend those records. If you find information that is not about you or that bears no relationship to diseases you have, or if the information describes treatment that you did not receive, demand that the false information be removed entirely from the record.

Click here to download a PDF of the Full Report.