Medical Identity Theft Guide: Spot and Fix Misuse of Your Health Insurance

When someone uses your health insurance or Medicare number, the damage is not only financial: their diagnoses, prescriptions and treatments can end up in your medical record. Medical identity theft is when someone uses your name, Social Security number, or health insurance or Medicare number to get medical care, prescriptions or devices, or to file insurance claims in your name. It shows up as bills for care you never had, a surprise "benefit limit reached" letter or medical debt on your credit report. This guide explains, in plain English, the warning signs, how to read an Explanation of Benefits (EOB), how to get and correct your records using your rights under the US HIPAA Privacy Rule, who to report to, and how to prevent it. It is written for patients, carers and the people who help them, and focuses on the US system, where the specific legal rights described here apply.

Key takeaways

• Your EOB is your early warning. Check every Explanation of Benefits or Medicare statement against the appointments and prescriptions you actually had; an unfamiliar provider or date is the most common first sign.
• You have a legal right to your records. Under HIPAA (45 CFR 164.524) providers and health plans must act on a request for your medical and billing records within 30 days, with one 30-day extension, and cannot refuse because you owe them money.
• You can demand corrections in writing. Under 45 CFR 164.526 a provider or plan must act on an amendment request within 60 days, with one 30-day extension, and if it refuses you can file a statement of disagreement that stays with your record.
• Report to the right places. File at IdentityTheft.gov for a recovery plan, tell your insurer's fraud unit, dispute medical debts with the credit bureaus, and for Medicare call 1-800-MEDICARE or report to the HHS Office of Inspector General.
• Prevention is mostly about paper and phone calls. Guard insurance cards and EOBs, shred old paperwork and never give your Medicare or insurance number to an unexpected caller.

What it is

The FTC describes medical identity theft as someone using your personal information to get medical care, buy prescriptions or devices, or submit insurance claims in your name. It differs from other identity theft because the thief's health information can be mixed with yours, which the FTC warns can affect your care, your insurance benefits and your credit.

For the general identity theft recovery process, which this page builds on, see the Identity Theft Recovery Guide.

How it works

How details are stolen

• Lost or stolen cards and paperwork: insurance and Medicare cards, prescription labels, bills and EOBs in bins or post.
• Scam calls and messages: callers posing as Medicare, an insurer or a "free" equipment or testing offer ask for your number. Medicare states it will never call to sell you anything or visit your home.
• Data breaches: healthcare organisations hold large volumes of personal and insurance data. The Change Healthcare breach, where health and personal data was copied before ransomware ran, affected 192.7 million people according to UnitedHealth Group's final estimate.
• People close to you: anyone with access to your cards or post can misuse them.

Warning signs

The FTC lists four signs: a bill or EOB for services you did not receive or medicines you do not take; a debt collector contacting you about medical debt you do not owe; medical collection notices on your credit report that you do not recognise; and your health plan telling you that you have reached your benefit limit. Other prompts to check include a refused claim for a condition you do not have, or a pharmacy saying a prescription was already filled.

Reading your Explanation of Benefits

An EOB is the statement your health plan sends after it processes a claim. It is not a bill. The FTC notes it lists the provider, the date, the services, the cost, what the plan paid and what you owe. Check each line:

Medicare suggests comparing your Medicare statements with your calendar and setting up a secure Medicare.gov account, so you can see Original Medicare claims once processed rather than waiting for paper statements.

Getting your records: your HIPAA right of access

HHS explains that you have the right to inspect, review and get copies of your medical and billing records from health plans and providers covered by HIPAA. The rule is in 45 CFR 164.524:

• Deadline: the provider or plan must act within 30 days of receiving your request, and may extend once by up to 30 days if it tells you in writing why and when it will act.
• Fees: only a reasonable, cost-based fee for copying labour, supplies and postage; HHS says you cannot be charged for searching for or retrieving records.
• Unpaid bills: HHS states a provider cannot refuse copies because you have not paid for services, which matters when the bills are the thief's.
• Who to ask: the FTC advises requesting copies from every doctor, clinic, hospital, pharmacy, lab and health plan the thief may have used. If a provider refuses, appeal to the contact in its Notice of Privacy Practices, the patient representative or the ombudsman.

You can also ask for an accounting of disclosures under 45 CFR 164.528, covering up to six years, with the first request in any 12 months free. It excludes disclosures for treatment, payment and health care operations, so it will not list the thief's visits, but it can reveal records sent elsewhere.

Correcting your records: the HIPAA right to amend

Write to each provider and plan holding wrong information, enclose a copy of the incorrect record, explain which entries are not yours and send it by a trackable method, as the FTC suggests. Under 45 CFR 164.526:

1. The provider or plan must act within 60 days, with one extension of up to 30 days if it explains the delay in writing.
2. If it accepts, it must amend the record and make reasonable efforts to notify people you name and others it knows hold the information and may rely on it, including its business associates.
3. It may deny if, for example, it did not create the information or believes the record is accurate and complete. A denial must be in writing, give the reason and explain how to complain.
4. If denied, you can file a written statement of disagreement. The provider must attach your request, the denial, your statement and any rebuttal to the record and include your statement in future disclosures.
5. If a provider did not create the entry, ask the one that did, which the denial rules point you towards.

The rights and deadlines above come from the federal regulation; some states add their own rules, and HHS notes its guidance applies consistent with the 2020 Ciox Health v. Azar court order on third-party copies.

Reporting and recovery

Freezing your credit stops new credit accounts but not medical misuse of an insurance number. See the Credit Freezes and Fraud Alerts Guide if your Social Security number was also exposed.

Why it matters

Most identity theft costs money and time. Medical identity theft can also cost you safe care. If a thief's diagnoses, allergies or prescriptions sit in your record, a clinician may act on them, and the FTC warns that mixed records can affect your care and benefits. False claims can use up annual or lifetime benefit limits, and unpaid bills can damage your credit. Unlike a bank card, an insurance or Medicare number is not changed automatically after misuse, and medical records are spread across many providers, so repair takes persistence. Catching misuse early, through regular EOB checks, keeps the clean-up to a few letters rather than months of disputes.

Common misconceptions

• "An EOB is just junk mail." It is the one document that shows what was billed in your name. Read it every time.
• "A credit freeze protects me." It blocks new credit, not someone using your insurance card at a clinic.
• "The provider will fix my record once I tell them." Make the request in writing under HIPAA's amendment right; a phone call does not start the 60-day clock.
• "They can refuse my records until the bill is paid." HHS says a provider cannot refuse copies because you have not paid.
• "Medicare will call me if there is a problem." Medicare says it will not call to sell anything or visit your home; treat such calls as scams and call 1-800-MEDICARE yourself.
• "Only my finances are at risk after a healthcare breach." Insurance and Medicare numbers in breached data can be used for care and claims, so watch your EOBs after any breach notice.

Related concepts

• Identity theft recovery: the general process. See the Identity Theft Recovery Guide.
• HIPAA breach notification: what organisations must tell you after a breach. See the HIPAA Breach Notification Rule Guide.
• Health data outside HIPAA: apps and services HIPAA does not cover. See the Health Data Privacy Beyond HIPAA Guide (My Health My Data).
• Children's identities: misuse of a child's details, including for benefits. See the Child Identity Theft Guide.
• Scam calls: phone and voice scams that harvest details. See the Callback Phishing (TOAD) Guide.

Practitioner checklist

• Read every EOB and Medicare statement against your calendar and prescriptions.
• Set up online access to your health plan or Medicare.gov claims to spot misuse sooner.
• Store insurance and Medicare cards safely; shred EOBs, bills and prescription labels.
• Never give your insurance or Medicare number to an unexpected caller; call back on a number you trust.
• If misuse is suspected, request records from every provider, pharmacy and plan involved under 45 CFR 164.524.
• Send written amendment requests under 45 CFR 164.526 and file a statement of disagreement if refused.
• Report to your plan's fraud unit, IdentityTheft.gov and, for Medicare, 1-800-MEDICARE or oig.hhs.gov.
• Check your credit reports for medical collections and dispute any that are not yours.

Standards and references

• Cornell LII: 45 CFR 164.524 Access of individuals to protected health information
• Cornell LII: 45 CFR 164.526 Amendment of protected health information
• Cornell LII: 45 CFR 164.528 Accounting of disclosures of protected health information
• US Department of Health and Human Services: Your Medical Records
• Federal Trade Commission: What To Know About Medical Identity Theft
• Medicare.gov: Reporting Medicare fraud and abuse
• Federal Trade Commission: IdentityTheft.gov

Related NHI Mgmt Group resources: Identity Theft Recovery Guide · HIPAA Breach Notification Rule Guide · Credit Freezes and Fraud Alerts Guide · Child Identity Theft Guide. This guide summarises patient rights under the HIPAA Privacy Rule and is not legal advice.