Medical identity theft is one of the most dangerous and least understood forms of identity fraud. It occurs when someone uses your personal information -- your name, Social Security number, health insurance account number, or Medicare number -- to obtain medical care, fill prescriptions, file insurance claims, or purchase medical devices in your name. Unlike financial identity theft, which can usually be reversed, medical identity theft can corrupt your health records with someone else's diagnoses, blood type, and allergies. In an emergency, that false information could lead to a misdiagnosis, the wrong medication, or even a fatal treatment error.
Why Medical Identity Theft Is So Dangerous
When a thief receives medical treatment using your identity, their health information gets merged into your medical file. This creates a set of risks that go far beyond financial loss:
- Wrong blood type on file: If the thief has a different blood type and it replaces yours in the system, a blood transfusion based on the incorrect type can cause a hemolytic reaction, which can be fatal
- Incorrect allergy information: Doctors may avoid medications you actually need based on the thief's allergies, or administer something you are allergic to because your real allergies are no longer reflected in the record
- Misdiagnosis: Research shows that 10% of medical identity theft victims experienced a misdiagnosis as a direct result of corrupted records
- Treatment delays: 11% of victims experienced delays in treatment due to fraud-related errors in their files
- Insurance exhaustion: The thief may use up your insurance benefits, leaving you without coverage when you need it
- Financial damage: You may receive bills for procedures you never had, and unpaid medical debt from fraudulent services can be sent to collections and damage your credit
Medical Identity Theft Can Be Life-Threatening
Unlike credit card fraud, where the worst outcome is financial loss, medical identity theft can directly endanger your health. False information in your medical record -- wrong blood type, incorrect allergies, phantom diagnoses -- can lead to dangerous treatment decisions in an emergency when doctors do not have time to verify your history. This is why detecting and correcting medical identity theft quickly is critical.
How to Detect Medical Identity Theft
Medical identity theft often goes undetected for months or even years because most people do not review their medical records and insurance statements as carefully as their bank statements. Here are the warning signs to watch for:
Review Your Explanation of Benefits (EOB)
Your health insurer sends an Explanation of Benefits statement after claims are processed. This document details the healthcare services billed, the dates and locations of treatment, and what your insurance paid. Read every EOB carefully. If you see charges for services you did not receive, dates when you did not visit a provider, or facilities you have never been to, that is a strong indicator of medical identity theft.
Watch for Unexpected Bills and Collection Notices
Collection letters for unfamiliar doctor visits or medical procedures are the most common way victims first discover medical identity theft. If you receive a bill from a healthcare provider you have never visited, do not ignore it or assume it is a mistake. Investigate immediately.
Check Your Credit Reports
Medical debt that has been sent to collections will appear on your credit report. Review your reports from all three bureaus (Equifax, Experian, and TransUnion) for any unfamiliar medical debts.
Request Your Medical Records
Under HIPAA, you have the right to access your medical records from any provider. Request copies periodically and review them for treatments, diagnoses, or prescriptions that are not yours.
Monitor Insurance Claims
If your insurance company notifies you that you have reached your benefit limit but you have not used those services, or if a legitimate claim is denied because records show you already received that treatment, someone may be using your insurance.
Steps to Recover from Medical Identity Theft
If you discover that your medical identity has been stolen, take the following steps as quickly as possible:
Step 1: Contact Your Health Insurer
Call the fraud department of your health insurance company immediately. Report the fraudulent claims and request a complete claims history for your account. Ask them to flag your account for fraud and to reverse any fraudulent charges. Keep records of every conversation, including dates, names of representatives, and reference numbers.
Step 2: Request Your Medical Records from Every Provider Involved
Contact each healthcare provider where fraudulent services were billed. Under HIPAA, you have the right to request your medical records. Review them thoroughly and identify every entry that does not belong to you. Ask each provider to correct the records, and request written confirmation that the corrections have been made.
Step 3: File a Report with the FTC
Visit IdentityTheft.gov to file an official report with the Federal Trade Commission. The site will walk you through a series of questions and generate a personalized recovery plan based on your situation. Your FTC report serves as official documentation of the crime, which you will need for disputes with insurers and providers.
Step 4: File a Police Report
File a report with your local police department. While law enforcement may not be able to investigate every case, the police report serves as crucial documentation. You will need it when disputing fraudulent charges and correcting your records with insurers and healthcare providers.
Step 5: Place a Fraud Alert or Credit Freeze
Contact all three credit bureaus to place a fraud alert on your credit file, which requires creditors to verify your identity before opening new accounts. For stronger protection, consider a credit freeze, which prevents anyone from opening new credit accounts in your name entirely.
Step 6: Request an Accounting of Disclosures
Under HIPAA, you can request an "accounting of disclosures" from each healthcare provider and your insurer. This document shows everyone who has accessed your medical records and every entity your health information has been shared with. It can help you identify the full scope of the fraud.
Step 7: Correct Your Medical Records
This is the most important and most difficult step. Work with each provider to have the thief's information removed from your file. Providers may be reluctant to delete records due to liability concerns, but you have the right under HIPAA to request amendments to your medical record. If a provider refuses, they must provide a written explanation, and you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
Keep Detailed Records of Everything
Medical identity theft recovery can take months or years. Maintain a dedicated file with copies of every report you file, every letter you send, every corrected record you receive, and notes from every phone call (including the date, time, and name of the person you spoke with). This documentation is essential if you need to escalate disputes or if the fraud resurfaces later.
How to Protect Yourself Going Forward
Once you have addressed the immediate damage, take steps to reduce your risk of future medical identity theft:
- Guard your insurance card like a credit card: Do not carry it unless you have a medical appointment, and never share your insurance information over the phone unless you initiated the call
- Review every EOB statement: Make it a habit to check your Explanation of Benefits every time one arrives, not just when something seems wrong
- Shred medical documents: Dispose of old insurance cards, EOB statements, prescription labels, and any paperwork containing your health insurance numbers through a cross-cut shredder
- Be cautious of "free" health services: Scammers sometimes offer free health screenings, checkups, or medical equipment in exchange for your insurance information, which they then use to file fraudulent claims
- Remove your personal data from data brokers: Your name, address, date of birth, and other identifying information available on people-search sites can be combined with stolen insurance numbers to commit medical identity theft. PrivacyOn automates the removal of your personal information from over 100 data broker sites, reducing the data available to criminals who target health insurance accounts
- Monitor the dark web for your information: Stolen health insurance credentials are frequently sold on dark web marketplaces. PrivacyOn includes dark web monitoring that alerts you if your insurance information or other personal data appears in underground markets, giving you the chance to act before the data is used
Report Medicare Fraud Separately
If you are a Medicare beneficiary, also contact the HHS Office of Inspector General at 1-800-HHS-TIPS (1-800-447-8477) or online at oig.hhs.gov. Medicare fraud is a federal crime investigated separately, and you should review your Medicare Summary Notices for services you did not receive.
Do Not Wait to Act
Medical identity theft threatens both your finances and your physical safety. Corrupted medical records can follow you for years and create real dangers in emergencies. If you notice any warning signs -- unexpected bills, unfamiliar EOB entries, insurance claims you did not file -- investigate immediately and follow the recovery steps above. The sooner you act, the easier recovery will be.