By now, most people know about the perils of identity theft, where someone steals your personal or financial account information and makes fraudulent charges or opens bogus accounts in your name. ID theft can take a serious toll on your credit and take months or years to fix, even if you spot it quickly.
Lately, a not-so-new twist has been getting a lot of attention -- medical identity theft. That's where someone gains access to your health insurance or Medicare account information and uses it to submit phony insurance claims, obtain prescription drugs or medical devices (often for black-market resale), or get medical treatment in your name.
Besides its high cost (an estimated 1.8 million victims paid more than $12 billion in related expenses in 2013, according to the Medical Identity Fraud Alliance), medical ID theft can have deadly consequences as well: Suppose someone poses as you and gets an appendectomy; if you later entered the hospital with abdominal pain, your medical file would show that your appendix was already removed and you could be tragically misdiagnosed.
Here are a few tips for avoiding medical ID fraud and steps you can take if it happens to you:
First, it's important to understand what medical ID thieves are looking for and how they access your information. Your medical files are often full of information they crave: account numbers for Social Security, health insurance, Medicare or Medicaid, contact information, email address, etc. Some doctor's offices even keep your credit card number on file (bad idea). All it takes is one stolen employee laptop or an intercepted piece of mail or email to leave you vulnerable.
Sophisticated thieves will also hack computer networks of insurance companies, pharmacies, medical equipment suppliers or anyone else who might have access to your medical records. And unfortunately, the black market for stolen information is so tempting that employees have been known to steal data. Plus, think about all the news stories of corrupt doctors and clinics defrauding Medicare for millions of dollars.
- Provider bills or insurance Explanation of Benefits (EOB) forms that reference medical services you didn't receive. (Verify all dates, providers and treatments for accuracy and look for duplicate billing.)
- Calls from debt collectors about unfamiliar bills.
- Medical collection notices on your credit report.
- Never reveal personal or account information during unsolicited calls. If in doubt, hang up and call your doctor's office or insurance company directly. The same goes for emails.
- Be suspicious if someone offers you free medical equipment or services and then requests your Medicare number.
- Never let people borrow your Medicare or insurance card to obtain services for themselves. Not only is this illegal, but it could be disastrous if your medical histories become intermingled (think about differing allergies, blood types, etc.)
- Regularly check your credit reports for unpaid bills for unfamiliar medical services or equipment. This could indicate someone has opened a new insurance policy using your identity and is running up charges. (You can order one free report per credit bureau each year at www.annualcreditreport.com.)
- Safely store paper and electronic copies of medical records and shred unneeded forms.
- Don't post detailed medical information on social media sites.
If you suspect or know that your information has been compromised, ask for copies of your medical records from each doctor, clinic, hospital, pharmacy, lab or health plan where a thief may have used your information. Although you're legally entitled to see these records, you may have to pay a fee. If a provider denies your request, file a complaint with the Department of Health and Human Services' Office for Civil Rights.
Ask your health plan and each medical provider for a copy of their Accounting of Disclosures, which lists everyone who got copies of your medical records. By law, you're entitled to one free copy per provider, per year.
Next, write to your insurer and medical providers by certified mail to explain which information is inaccurate, along with copies of documents that support your position. Ask them to correct or delete each error and to inform everyone they may have sent records to (labs, other doctors, hospitals, etc.) Keep copies of all correspondence and logs of all phone calls or other related activities.
- File a police report and keep a copy as proof of the crime.
- Contact the fraud units at the three major credit bureaus: Equifax, Experian and TransUnion. You may want to place a fraud alert or freeze on your accounts.
- Notify the Federal Trade Commission, whose Identity Theft site contains information on fraud alerts, credit freezes, how to work with police and much more.
- File a complaint with the government-sponsored Internet Crime Complaint Center, which forwards cybercrime complaints to appropriate law-enforcement and regulatory agencies.
- Contact the IRS' Identity Protection Unit.
- Report Medicare- or Medicaid-related crimes to the Office of Inspector General's Fraud Hotline.
Bottom line: Medical identity theft is serious business. Make sure you're taking every precaution to protect your medical records.
This article is intended to provide general information and should not be considered legal, tax or financial advice. It's always a good idea to consult a legal, tax or financial advisor for specific information on how certain laws apply to you and about your individual financial situation.