"Insiders have the access and sometimes you see people who are hired to then sell the data to either a crime ring or ID theft ring or to an individual who wants the information," says Pam Dixon, executive director of World Privacy Forum.

Fraudsters can rake in substantially more money with medical ID theft than other forms of ID fraud.

"They do it because it is such a lucrative crime to commit," Dixon says.

They can, however, take steps to protect sensitive information from sticky-pawed individuals who would use it to commit fraud. Bankrate's story on protecting your personal information offers preventive tips.

Your Social Security number isn't the only thing you have to worry about; your insurance number is also very valuable.

"People don't really need a Social Security number to commit medical ID theft," says Pam Dixon, executive director of World Privacy Forum.

"Protect your insurance number," Dixon says. "Keep it out of your mailbox and if you have roommates, don't share it with them."

It happens on university campuses a lot, she says. "Something interesting we've found is that some people have the attitude that 'We don't like insurance companies and don't care if they have to pay extra because someone is using my insurance information.'"

"People need to understand that it is a real health problem, it's not just a money thing. The core harm is changes to your health care files," says Dixon.

An important precautionary step to take: Get your health records every time you visit the doctor or every time you take your kids to the doctor.

"Right when you're there, file a request for your health care files. It usually takes between 30 and 60 days to get the files, and they will mail them or give them to you on a disk," says Dixon.

"It might cost between $1 and $20, depending on how much they charge, but just get a baseline copy of those records," she says.

Though it won't prevent medical ID theft, it makes the recovery process significantly easier to have documented proof of your identity in the form of your health care files.

"Some people have actually found out about it when they go into the hospital to get a surgery," says Pam Dixon, executive director of World Privacy Forum.

The World Privacy Forum often hears from victims that have experienced varying degrees of catastrophe as a result of the crime.

"Either they've been arrested by the police, or have lost their kids from Social Services collecting their children. Or people who contact us have gotten a massive collection notice and they were never at the hospital. They'll say, 'I have a notice for a collection of $20,000 for a hospital visit that I never had,'" Dixon says.

"Other people we hear from call us when they get a notice that their lifetime insurance cap has been met and they smell a rat," she says.

A lot of the time, though, people never find out about it. Dixon estimates that there are millions of people walking around that don't even know that their medical files have been compromised.

Pam Dixon, executive director of World Privacy Forum, says the ability to correct your records can vary dramatically from one hospital to another. "You can go to a hospital in one state and be treated one way and then you go to another hospital in another state and be treated in an entirely different way," she says.

As with financial identity theft, filing a police report marks the first step in recovering from the crime. It will signal your seriousness about correcting the fraud and possibly save yourself from legal trouble down the road in case your doppelganger engaged in other illegal shenanigans.

One victim lost her wallet and filed a police report, says Dixon. Later the thief impersonated her to obtain a large amount of pain medication.

"This woman created a lot of legal problems for the victim, and had she not filed a police report, she would have been in a lot of trouble," Dixon says.

Dixon usually hears the same complaints from victims of medical ID theft. The first is that the hospital would not give them their medical files.

Victims should obtain a copy of the Health Insurance Portability and Accountability Act, or HIPAA, to learn their rights under the law. Every hospital and insurer must publish a copy of practices and privacy rules in compliance with HIPAA and must make them available at request.

The frequently asked questions section of the World Privacy Forum Web site details the rights of patients when it comes to their medical records as well as the limitations.

A second complaint Dixon often hears: Getting fraudulent information deleted from medical files is nearly impossible.

"Under HIPAA you have no legal right to demand a complete deletion of anything from your medical file. Even if it's not yours or was entered fraudulently, it doesn't matter: You don't have that legal right," she says.

Records may be amended and notations added, but that isn't always sufficient, she says.

The third most common complaint she hears involves collections. Without the hospital or service provider on your side, collections offices won't give up going after victims.

"The recovery process can take a very long time -- six months to a year. Even as long as two years or never. Because some hospitals won't work with you. Some will and some won't," says Dixon.