Medical ID Theft Threatens Your Money and Your Life

by Eve B. Scheffenacker

Imagine opening your credit card bill and finding a long list of charges that you didn't make. You report them to your card issuer, cancel your card, put a fraud alert on your credit file, and dispute the errors. It can take several months or longer—plus angst. But, like most people hit by financial identity theft, you most likely can clear it up and move on.

But what if you get a hospital bill demanding payment for an operation you never had? What if, instead of your credit card number, someone has used your identity to receive costly medical care? You probably won't be able to resolve this problem with phone calls, or even in meetings where you display your scar-free body part. Not in a few months or a few years. Maybe not ever.

This is medical identity theft. The crime is not yet widespread. The World Privacy Forum, San Diego, estimates that medical ID theft has affected 250,000 Americans in recent years. It is, however, a crime whose victims bear enduring and maybe fatal consequences. It's also one from which we have too little legal protection and against which we have even less legal recourse.

What's the crime?

Medical ID theft occurs when one person uses someone else's name or health information to get medical care. The theft may be a one-off by an individual acting alone: The thief steals your insurance ID, driver's license, or Social Security number for his or her own use. Or, in many cases, the thieves are go-betweens engaged in wholesale theft. They're employees of health-care or insurance providers who earn a little extra by stealing the health information of dozens or hundreds of people and selling it to criminals.

Sellers can get about $50 for each record from thieves. The cost to the victims of those thefts is incalculable. The price tag for the stolen health care is the most obvious and causes the same havoc—or worse—as regular financial identity theft. Providers will take the loss once they have proof of the fraud. As we'll see later, the law doesn't make it easy for victims to get that proof. Meanwhile, your credit record may be permanently damaged.

There are dire medical consequences, too. After the ID theft, your medical records no longer are your own. Your name is on the files and the insurance claims, but only some of the information in them is yours. The rest belongs to the criminal who used your name and insurance information. That thief's information literally could kill you if it results in your getting improper medical treatment. Inaccurate claims and medical information also can cost you a job or make you ineligible for health or disability insurance. And it's almost impossible for you to remove it from your record.

Where do you go for help?

If someone steals your credit card, you have the Fair Credit Reporting Act on your side. It gives you the right to see your credit scores and reports, dispute frauds, correct inaccuracies, and more. This law can help you deal with financial aspects of medical ID theft—once you prove the charges are fraudulent. Unfortunately, you need to see your medical records to do that. No law will help you do that. Especially not the privacy rule of the Health Insurance Portability and Accountability Act (HIPAA). According to consumer and privacy advocates, HIPAA is little more than a dull double-edged sword when it comes to medical ID theft.

HIPAA was enacted, in part, to make sure that health-care and insurance providers protect your private health information from such abuse. But because of a loophole in the rule, once you prove that your record includes someone else's information, your right to see it and correct it ends. The law that should have protected you turns around and protects the thief.

Further, the federal government has done little to enforce the rule. With more than 20,000 complaints since 2003, Health and Human Services (HHS) has imposed no fines, prosecuted only two criminal cases, and conducted "a handful" of compliance audits. HHS prefers to work with offenders to correct shortcomings, not punish them. The collaborative approach has merit. But when people working in those organizations commit most of the ID theft and many hospitals lack even basic data security, it puts millions of consumers at risk.

What can you do?

• Protect your identity. You've heard it before: Don't give your Social Security number or driver's license to anyone without asking why. The same goes for your medical ID information. If your doctor or insurance carrier still uses your Social Security number as your ID, ask for a new number. Don't carry your Social Security card in your wallet unless you need it that day.

• Protect your mail. Deposit outgoing bills and other mail with sensitive ID information into a public mailbox—don't leave it sitting in your mailbox, inviting trouble. Cross-cut shred credit card offers, as well as any health-care or insurance papers you aren't keeping.

There are a few other steps you can take to protect your medical identity.

• Review your medical records and insurance claims once a year. Just because you haven't gotten a bill for fraudulent services doesn't mean you're in the clear. Ironically, if you find evidence of fraud, you may lose access to your file. But knowledge offers some protection.
  Your right to see and correct your file ends when it's known that it contains someone else's information.

  Question your health-care providers about their data security. Remember that most information is stolen by people who work for these organizations. Find out if your hospital or clinic does criminal background checks on employees who handle records. Do they encrypt electronic personal information? How do they confirm patients' identities? What HIPAA training do employees get, and how do they monitor compliance internally? If you don't like the answers, or can't get answers, consider going elsewhere.

  Lobby for change. Get the law working for you. Tell Congressional representatives that you want HIPAA enforced, and amended to protect victims of identity theft.

Published January 28, 2008