Medical ID Theft Threatens Your Money and Your Life
Imagine opening your credit card bill and finding a long list of charges that you didn't make. You report them to your card issuer, cancel your card, put a fraud alert on your credit file, and dispute the errors. It can take several months or longer—plus angst. But, like most people hit by financial identity theft, you most likely can clear it up and move on.
But what if you get a hospital bill demanding payment for an operation you never had? What if, instead of your credit card number, someone has used your identity to receive costly medical care? You probably won't be able to resolve this problem with phone calls, or even in meetings where you display your scar-free body part. Not in a few months or a few years. Maybe not ever.
This is medical identity theft. The crime is not yet widespread. The World Privacy Forum, San Diego, estimates that medical ID theft has affected 250,000 Americans in recent years. It is, however, a crime whose victims bear enduring and maybe fatal consequences. It's also one from which we have too little legal protection and against which we have even less legal recourse.
What's the crime?
Medical ID theft occurs when one person uses someone else's name or health information to get medical care. The theft may be a one-off by an individual acting alone: The thief steals your insurance ID, driver's license, or Social Security number for his or her own use. Or, in many cases, the thieves are go-betweens engaged in wholesale theft. They're employees of health-care or insurance providers who earn a little extra by stealing the health information of dozens or hundreds of people and selling it to criminals.
Medical identity theft occurs when a thief uses someone else's name or health information to get medical care.
Sellers can get about $50 for each record from thieves. The cost to the victims of those thefts is incalculable. The price tag for the stolen health care is the most obvious and causes the same havoc—or worse—as regular financial identity theft. Providers will take the loss once they have proof of the fraud. As we'll see later, the law doesn't make it easy for victims to get that proof. Meanwhile, your credit record may be permanently damaged.
There are dire medical consequences, too. After the ID theft, your medical records no longer are your own. Your name is on the files and the insurance claims, but only some of the information in them is yours. The rest belongs to the criminal who used your name and insurance information. That thief's information literally could kill you if it results in your getting improper medical treatment. Inaccurate claims and medical information also can cost you a job or make you ineligible for health or disability insurance. And it's almost impossible for you to remove it from your record.
After your medical identity is stolen, your medical records are no longer your own.
Where do you go for help?
If someone steals your credit card, you have the Fair Credit Reporting Act on your side. It gives you the right to see your credit scores and reports, dispute frauds, correct inaccuracies, and more. This law can help you deal with financial aspects of medical ID theft—once you prove the charges are fraudulent. Unfortunately, you need to see your medical records to do that. No law will help you do that. Especially not the privacy rule of the Health Insurance Portability and Accountability Act (HIPAA). According to consumer and privacy advocates, HIPAA is little more than a dull double-edged sword when it comes to medical ID theft.
HIPAA was enacted, in part, to make sure that health-care and insurance providers protect your private health information from such abuse. But because of a loophole in the rule, once you prove that your record includes someone else's information, your right to see it and correct it ends. The law that should have protected you turns around and protects the thief.
Further, the federal government has done little to enforce the rule. With more than 20,000 complaints since 2003, Health and Human Services (HHS) has imposed no fines, prosecuted only two criminal cases, and conducted "a handful" of compliance audits. HHS prefers to work with offenders to correct shortcomings, not punish them. The collaborative approach has merit. But when people working in those organizations commit most of the ID theft and many hospitals lack even basic data security, it puts millions of consumers at risk.
Consumer advocates say HIPAA is a dull double-edged sword when it comes to medical identity theft.
What can you do?The common-sense defenses that help protect you against financial identity theft will help here.
There are a few other steps you can take to protect your medical identity.
Home & Family Finance® Resource Center