In this article:
Identity theft and fraud protection for your finances, personal info, and devices.
How Does Medical Identity Theft Occur? Can You Prevent It?
Perhaps you were billed for a prescription that wasn’t yours. Or you got a bill for a medical procedure you didn’t request. Or maybe you received a misdiagnosis for a surgery you didn’t have.
You probably assumed it was a slip-up from your healthcare provider. But what if you were a victim of medical identity theft and didn’t know it?
Medical identity theft is so pervasive that most victims don’t see it coming.
This was the case for Anndorie Cromar, a mother of four charged with giving birth to a baby affected by prenatal methamphetamine exposure [*]. But Cromar wasn’t pregnant, nor had she recently given birth.
Unbeknownst to her, an individual struggling with methamphetamine addiction broke into Cromar's car and stole her driver's license. The individual then used this at a hospital to receive medical benefits during childbirth.
Months of DNA testing, lawyers, and court appearances exonerated Cromar of any blame — but not without incurring her over $10,000 in medical bills.
To ensure you don’t become another victim of identity theft, here’s everything you need to know about medical identity theft and what information you could be leaving on the table that makes you vulnerable.
What Is Medical Identity Theft?
Medical identity theft is a form of identity theft that occurs when someone fraudulently uses your health insurance information to gain illegal access to medical care services.
These services may include drug prescriptions, doctor appointments, or health equipment. Criminals may also submit fraudulent claims to health insurance companies to receive payouts.
What’s in it for scammers?
At first, it’s possible to overlook the severity of these scams, believing they are no cause for alarm. However, a thief’s health information commingling with yours can ruin your credit, reputation, and, even worse — your life.
Let’s say there’s a data breach, and a fraudster gains access to sensitive data like your Protected Health Information (PHI).
On the Dark Web, your PHI is worth anywhere between $250 to $1,000. That’s 1,000 times the value of a stolen Social Security number (SSN), and over 200 times the value of stolen credit card information.
How Is Medical Identity Theft Different from Other Types of ID Thefts?
Unlike other forms of identity fraud, stolen health information is 20 to 50 times more valuable on the black market [*].
Why is your stolen health data so valuable? Let's say someone gains access to your health insurance information. They can go on claiming to be you for years and receive health benefits on your behalf without your knowledge.
Chances are, you won’t find out unless you’re in an emergency or receive unexpected reports from your health insurance provider. And by then, it may already be too late. The thief may have hit your health benefit limit or racked up thousands (or even millions) of dollars in debt.
Other types of identity theft are easier to spot. For example, if someone applies for a credit card in your name, chances are, you’ll immediately notice.
⛳️ Related: How To Know If Someone Is Using Your SSN →
How Does Medical Identity Theft Occur?
To carry out any medical identity theft, all the thief needs is your Personally Identifiable Information (PII).
A PII is a set of relevant information that anyone can use to identify you. Your PII includes:
- Full name
- Date of birth
- Contact information
- Social Security number (SSN)
- Driver’s license
- Passport information
- Medical records (health plan, insurance number)
- Financial records
Having this information in the wrong hands leads to one of three ways medical identity theft can occur:
1. Friendly fraud
This is when you willingly consent to a family member or friend’s use of your health information to commit healthcare fraud. In a report from Ponemon Institute, 23% of medical identity theft victims admit giving their family members and close friends consent to use their health credentials [*].
⛳️ Related: Help! A Family Member Opened a Credit Card In My Name →
2. Outsider fraud
This is when someone you don’t know, e.g., a hacker, uses your medical identity to commit health care fraud. For instance, 3.5 million patient records were exposed during the largest healthcare data breach of 2021, reported to the U.S. Department of Health and Human Services (HHS) [*].
3. Insider fraud
Not every medical identity theft case is carried out by hackers or close family members. Sometimes, the threat comes from within the system.
Insider fraud occurs when healthcare providers use your health data for fraudulent activities. In 2019, scammers submitted over $1.7 billion in Medicare claims. This alleged scheme featured medical professionals and telemedicine companies that received illegal kickbacks and bribes [*].
Recent reports also show that insider threats were responsible for 39% of healthcare data breaches [*].
While few of the reasons for these attacks were grudges against employers, the majority were for financial identity theft.
⛳️ Related: Do You Really Need Identity Theft Protection? →
What Can Someone Do With Your Medical Identity?
If someone steals your medical identity and uses it to obtain medical care, this goes on your record. And if you’re a victim of medical identity theft, the thief can drag you into healthcare fraud schemes such as:
1. Obtain illicit drugs under false representation
Thieves might steal your medical information to impersonate you and obtain controlled prescribed substances on your behalf.
A common way they do this is by “doctor shopping.” Doctor shopping occurs when someone visits multiple doctors’ offices to obtain prescriptions for illicit drugs to treat an illness.
A good example is the case of Delores McClure. The Knox County woman would visit different doctors for prescriptions of controlled substances while using TennCare health insurance as payment [*].
2. Bill for made-up medical services
Healthcare providers may use your information to fraudulently bill insurance institutions for services they didn’t render.
For instance, a doctor may attend to 20 patients throughout the week but bill for 200 using other patients' data. This fraudulent act is one of four types of medical billing fraud that affects the government, patients, and private health institutions.
Types of medical billing fraud
- Upcoding is when a medical provider bills the insurer for a more expensive service than the one rendered to the patient.
- Unbundling is a health care fraud scheme involving medical providers submitting multiple bills for the same service.
- Phantom billing involves submitting bills for payment of procedures, services, equipment, or prescription drugs that patients never received. Healthcare providers caught in the act are liable to be prosecuted under the False Claims Act (FCA) [*].
- Double billing is when medical providers submit multiple claims for the same service involving the same patient.
3. Falsify medical insurance claims
Scammers can use your identity to make false insurance claims for medical services and equipment reimbursements.
Alexander Gulkarov and his group, for example, billed insurance companies over $30 million in fraudulent medical treatments. Between 2014 and 2021, this added up to over $100 million in healthcare fraud [*].
4. Alter medical records
For doctors to render the best medical care to you, they need your medical records to know your health history. This helps them prescribe the right drugs and treatments for you.
However, if someone compromises your medical data with fake records, you could lose access to certain healthcare benefits — and sometimes experience delays in receiving proper medical care.
5. File for fraudulent financial claims
One of the significant challenges to public health programs like Medicare and Medicaid is financial fraud. Every year, the government loses $60-90 billion to fraud [*].
The majority of the perpetrators of these acts are medical providers. They use patients' health information to submit misleading claims to gain financial benefits.
📌 Suspect fraud? File an identity theft report with the FTC at IdentityTheft.gov →
How Does Medical Identity Theft Affect You?
The harsh truth is that a stolen medical identity can cause serious damage — from delayed healthcare benefits to potential loss of life.
If medical identity theft costs the healthcare industry $30 billion a year, each victim spends an average of $13,500 on remediation [*].
Below are three ways medical identity theft affects you:
Inferior credit score
Bad debts are responsible for poor credit scores. And it takes approximately seven years before they leave your credit report [*].
In situations in which someone uses your identity to rack up insurmountable healthcare debts, you run the chance of destroying your credit. This can hold up healthcare benefits and harm other personal finances.
Health misdiagnosis
Inaccurate information in your medical records can cause doctors to misdiagnose or mistreat you.
Let’s say you’re allergic to chloroquine injections. However, the thief using your health information is not. This compromises your records and could put your life in danger.
Doctors might not know that your record is compromised and administer chloroquine injections to you. If this were to trigger your allergic reactions, it could lead to life-threatening complications — or even death.
False incrimination
Doing the time without the crime is common among victims of medical identity theft.
Say someone steals your identity and uses it to obtain painkillers at a questionable rate. Law enforcement can issue a warrant for your arrest on charges of illicit possession of a controlled substance.
⛳️ Related: Compare Identity Guard vs. LifeLock for Identity Theft Protection →
Medical Identity Fraud Prevention
Knowing the early signs of medical identity theft can prevent you from falling for these scams.
While some things are beyond your control (like hackers breaching your healthcare provider’s systems), playing your part to protect your identity will go a long way.
Here are three of the most important preventive steps to keep your identity safe:
1. Safeguard Your Medical Records
- Don't overshare your health information
- Ask why certain medical information is needed
- Get a copy of your medical records
- Thoroughly review your medical statements
Don’t overshare your health information
While it’s great when you get your health insurance coverage renewed, don’t take pictures (of any health-related information) and post on Facebook, Twitter, or any of your social media accounts.
Health data such as your Medicare number, Explanation of Benefits (EOB)/Medicare Summary Notice (MSN), SSN, and health insurance card are highly sensitive PII. Only reveal them to your trusted healthcare providers and no one else — not even your close family members and friends.
Ask why certain medical information is needed
Sometimes, your healthcare providers require you to fill out health-related forms. If you don’t understand why they need specific personal information about you, ask them why.
Get a copy of your medical records
Don’t keep a physical copy. Instead, request a digital copy from your healthcare providers. Then, should an identity thief tamper with your records in the future, you’ll have proof that the altered records are not yours — but, rather, pertain to someone claiming to be you.
Thoroughly review your medical statements
Medical billing fraud is successful because most patients don’t review medical statements. Once you receive statements such as your EOB, check the services that your healthcare provider is billing you for. And consider these questions:
- Did you request this service?
- Have they double-billed you?
- Are the dates and times of the services correct?
- Do these prescriptions belong to you?
- Did they overcharge you?
Contact your health insurance or healthcare provider if you find anything amiss about the statement.
2. Recognize Early Signs of Medical Identity Theft
- Beware emails asking for your medical data
- Beware of phishing / scam phone calls
- Beware of fake medicare phone calls
Emails seeking medical data
You might receive scam emails requesting that you provide medical data in exchange for a reward. The scammers might promise free health screenings, a new Medicare card, discounts on your next doctor appointment, gift cards, etc. These are fraudulent, and you shouldn’t respond.
Phishing phone calls
If you get a phone call from someone requesting your health insurance information, be on guard. Scammers often have little knowledge about you (e.g., they may know your name, address, and phone number but nothing more detailed).
So, on the call, don’t reveal any sensitive information. Instead, tell them you’ll come to their office in person to clarify things.
Fake Medicare calls
Thieves could call you claiming to be Medicare representatives wanting to verify your insurance data. Know that no Medicare staff will call or reach out to you unless you’ve contacted them first.
3. Monitor Your Credit (And Review Your Credit Report)
Reviewing your credit report is the easiest way to know if someone is tampering with your medical identity. If fraudsters receive medical care using your identity, it goes on your credit report.
So, if you notice someone racking up unpaid medical bills in your name, file a police report, and reach out to any of the three credit bureaus (Experian, TransUnion, or Equifax).
You can also file a medical identity theft complaint with the Federal Trade Commission (FTC) at https://reportfraud.ftc.gov/.
Protect Yourself From Medical Identity Theft
Imagine rushing to the ER because of heart complications, only to get hit with a notice of overdue medical bills. But you pay all your bills. So how could this happen?
Situations like these are what victims of medical identity theft encounter — but this doesn’t have to be you.
Make it a habit to check your MSNs and credit statements carefully. The earlier you notice errors, the faster you’ll be able to stop possible fraud. If you have shared your SSN and other details with a stranger and suspect you are a victim of medical identity fraud, report it right away.
Call the Centers for Medicare & Medicaid Services (CMS) hotline:
- 1-800-MEDICARE (1-800-633-4227) or TTY 1-877-486-2048
And the Office of the Inspector General (OIG) hotline:
- Phone: 1-800-HHS-TIPS (1-800-447-8477) or TTY 1-800-377-4950
- Fax: 1-800-223-8164
- Online: Forms.oig.hhs.gov/hotlineoperations/index.asp
- Mail: U.S. Department of Health & Human Services, Office of Inspector General, ATTN: OIG Hotline Operations, P.O. Box 23489, Washington, DC 20026
