Q. I read your recent article about a Navy veteran in Northern Virginia who was defrauded out of several million dollars, and the banks did nothing to stop it. Thanks for sharing that and for making us aware that this type of fraud is happening. It made me think of something I heard about that happened to a friend of mine – medical identity fraud.
My friend got a text from an emergency department of a hospital in DC informing her that her wait time to be seen was an hour. She found it odd, since she no longer lives in DC, hadn’t used that hospital system in years, and was feeling perfectly healthy with no need to make a medical appointment that day. Then she got a second text, similar to the first. Must be a wrong number or spam, she thought. When she got a call the next day from a hospital staffer to discuss the diagnostic results from her ER visit, she knew something was definitely wrong. It seemed that someone else got registered with her name. She couldn’t fathom how this had happened!
The name and date of birth the staffer had on record for her were correct, though her address was not. She now lives in Fredericksburg and has for the past fifteen years. The hospital said they’d correct the problem. They changed that address in their system, and the next week, she got a bill from the hospital in DC for more than $4,000 for the other person’s care!
My friend is savvy, since she is retired from health care herself. In her situation, it was unclear whether her problem was due to an administrative mix-up, such as another patient with the same name, or medical identity theft. But within a month of her initial call, the hospital removed the charges and assured her that her medical record had been disentangled from the other patient’s. I’m sure the outcome isn’t always as good though. What are some ways that medical identity theft can happen, and what can be done to stop it?
A. Medical identity theft happens when someone steals your personal information and uses it to receive medical care in your name. This type of fraud can be challenging for victims to spot, and it can take a long time and sometimes a lot of money to resolve it. Compared with other types of identity fraud, medical identity theft is rare. In 2022, for example, the Federal Trade Commission (FTC) received 27,821 reports of medical identity theft, while reports for identity theft related to new credit card accounts totaled more than 400,000.
Medical identity theft may affect just one person whose insurance card gets stolen or “borrowed” to pay for health care, or it may result from a data breach, as HCA Healthcare experienced. HCA Healthcare, a for-profit hospital company headquartered in Nashville, Tennessee, had a huge data breach it acknowledged this month, exposing the medical records of 11 million people. Such large-scale breaches are more likely to be used in financial fraud schemes than to get medical care, experts say.
How Does Medical Identity Theft Typically Happen?
When it comes to medical identity theft that is not caused by a data breach, criminals looking to steal your medical identity typically use several methods.
- They may obtain your personal information from old medical documents or your health insurance/Medicare card.
- They might employ phishing tactics — using calls, emails, or other messages that appear legitimate — to trick you into giving up your information. Sometimes, phishing messages include hyperlinks that, when clicked, can install malware on your device. Malware is a kind of software that collects private information such as your passwords or your Social Security number.
- Medical identity theft can also happen if someone loses a wallet with their insurance card in it, or when a piece of mail from their insurer goes astray.
- Medical identity theft doesn’t occur only among strangers. The victim sometimes knows the thief and may even be in on the “friendly fraud,” as it’s called. According to one study, nearly half of people who failed to report medical identity theft said it was because they knew the thief. Once the thief has sufficient details about you, they may be able to visit a doctor’s office, obtain a medical procedure, or make other attempts to use your health insurance benefits in your name.
Busy hospital emergency departments may make an attractive target for fraudsters. Procedures typically require patients to present insurance and photo identification information at check-in. If someone gets ahold of another person’s health insurance number and driver’s license or other ID, they may be able to use it to receive medical services in someone else’s name.
- If the imposter fails to pay for the medical services they’ve received, the hospital will likely come after the person whose medical identity was stolen for the bills, and that person may eventually face debt collectors and worse if they do not clear up the identity theft.
- The fallout from medical ID theft can show up on your credit reports and damage your credit scores.
- Medical ID theft can also create duplicate medical records in your name that can be difficult to distinguish from your legitimate records. Worse, during an emergency, this false information could prevent you from receiving the treatment you need, or cause your doctor to prescribe the wrong treatment.
Financial institutions have sophisticated algorithms to identify purchasing and other patterns that are out of the ordinary. In health care, something similar could be used to flag claims in which a provider is located more than 1,000 miles from where a patient lives, for example, or sees a patient for conditions that don’t jibe with their age or health status, but this does not yet exist.
“The majority of victims find out when they’re trying to move on with their lives, if bills have gone to collections,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a nonprofit that provides free assistance to victims of identity theft. Someone may apply for a mortgage, for example, and learn their credit is ruined due to unpaid medical bills for care they didn’t receive.
“It’s a double whammy. Unlike other forms of identity fraud, medical identity thieves may steal not only their victims’ personal data — Social Security number, date of birth, address — but also information about their medical records and care, potentially putting their health at risk. Sometimes people can’t get their prescriptions, if their records are mixed with someone else’s,” Velasquez says. “Maybe you won’t be able to get treatment that you need. There are serious implications.”
Signs of Medical Identity Theft
Medical identity theft can be difficult to spot right away. You may be a victim of identity theft if you have:
- Received a bill or other paperwork related to an unfamiliar medical procedure;
- Been contacted by a collections agency regarding unknown medical debt;
- Noticed strange medical debt collections on your credit reports;
- Been denied coverage by your health insurance company due to a medical condition you don’t recognize;
- Received an explanation of benefits (EOB) from your insurer or a Medicare Summary Notice includes office visits you didn’t make or treatment you didn’t receive; and/or
- Been told by your health insurance company that you’ve met your benefit limit well before you anticipated.
If you believe you’ve been a victim of identity theft based on these warning signs, seek help. You can file a complaint with the FTC online at IdentityTheft.gov or by phone at 877-438-4338.
Ways to Better Protect Yourself Against Medical Identity Theft
Consumers should generally monitor the notices and bills they receive from insurers and providers and contact them immediately about anything suspicious. Here are some ways you can help protect your medical information:
- Keep your medical information safe and confidential. This includes billing statements, documents from your insurance company, prescriptions, health insurance forms, and your health insurance card. Don’t give out your health insurance information to anyone unnecessarily, even family and friends.
- Destroy medical documents you don’t need. Shred any documents containing personal information before you throw them away. If you can’t use a shredder, black out sensitive information.
- Review any communications from medical providers and insurers. Look for notices, billing documents, and explanations of benefits. If you see anything you don’t recognize, such as an unfamiliar procedure or cost, contact your insurer and your providers.
- Check your medical records. Contact your health care providers to review your medical records, especially if you’ve noticed any suspicious activity elsewhere. If someone has used your name, contact every provider who may have been involved and ask for a copy of your medical records, then report any errors to your medical providers.
Report any discrepancies to the relevant provider in writing.
- Review your credit reports and scores. Regularly review your credit reports for any indication of medical debt in collections or other suspicious activity. Similarly, it’s wise to monitor your credit scores for unexpected changes.
- Notify your health plan’s fraud department and send a copy of the FTC identity theft report. Go to the FTC’s identity theft site to learn about next steps and file an identity theft report, if appropriate. File free fraud alerts with the three major credit reporting agencies and get free credit reports from them. Consider filing a police report. If your health plan offers free credit or identity theft monitoring following a breach, take advantage of it. The FTC’s fact sheet on medical ID theft includes a checklist of steps for obtaining and correcting your medical records in case of fraud.
- Suspect Medicare Fraud? Contact the Department of Health and Human Services Office of the Inspector (HHS OIG) General Fraud Hotline. Online: oig.hhs.gov/fraud/hotline, Phone: 1-800-447-8477 (1-800-HHS-TIPS) HHS OIG also offers a brochure and helpful PSA Videos about medical identity theft:
- If your issue is not resolved by your healthcare provider, report the questionable charges to 1-800-MEDICARE or contact your local Senior Medicare Patrol for assistance: 1-877-808-2468 or SMPResource.org
Planning to Protect Loved Ones
As we note in all of our articles about scams, protecting seniors is very important, which is why we continually share information about current scams and how you can protect yourself. It is also very important to plan for your future and to help plan for the future of your loved ones. If you or your loved ones have not done Incapacity Planning, Estate Planning, or Long-Term Care Planning, or if you have a loved one who is nearing the need for long-term care or already receiving long-term care, please contact us to make an appointment:
Northern Virginia Elder Law: 703-691-1888
Fredericksburg Elder Law: 540-479-1435
Rockville Elder Law: 301-519-8041
Annapolis Elder Law: 410-216-0703
About Evan H Farr, CELA, CAP
