A woman we’ll call “Jane” found herself listed as the mother of a baby whose drug-addicted birth mother abandoned the child at the hospital and stole Jane’s health insurance information. The ensuing nightmare scenario — in which Jane was threatened with the removal of her real children from her home and faced financial and legal hardships — is an extreme example of the danger of medical identity theft.
Experts say it’s a growing problem amid data breaches hitting companies such as health insurance giant Anthem.
“Medical identity theft carries financial implications similar to other types of identity theft which can ruin your credit — but it has even more devastating consequences,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center in San Diego.
“If someone uses your health insurance to get services, you can end up getting improper care because the thief’s medical information becomes mixed with yours,” she explains. “If the thief uses your insurance to get access to prescription drugs, you can end up with a flag in the system that could trigger regulators or even law enforcement to track you down.”
How it works
What is medical identity theft? According to Becky Frost, consumer education manager for Experian’s Protect My ID program, it occurs when someone uses your personal information — such as your name, Social Security number or health insurance ID — to get medical care, submit claims or buy drugs or expensive medical equipment.
For example, medical supplies, such as electronic wheelchairs, might be purchased fraudulently through an insurance claim and then sold on the black market at a profit, says Ann Patterson, senior vice president and program director for the Medical Identity Fraud Alliance in Washington, D.C.
A survey sponsored by the alliance found that medical identity theft victimized approximately 1.84 million Americans in 2013, 19 percent more than in 2012.
An average cost of $22K per victim
“One of the surprising things about medical identity theft is that not only is it a hassle that can take more than a year to resolve, but it also costs an average of $22,346 per victim,” says Frost. “Sadly, most victims end up paying the cost themselves rather than to continue to fight it out.”
“The more insidious danger of medical identity theft is when someone sells your insurance information so others can get medical care,” says Steve Weisman, an identity theft expert and lecturer at Bentley University in Waltham, Massachusetts. “It’s hard to track down because of (federal) privacy rules, and yet the risk of something like receiving the wrong blood transfusion can be high.”
Also, you could be turned down for life insurance, disability insurance or long-term care insurance if medical identity theft results in false negative information in your health records, he says.
Medical ID theft vs. financial ID theft
The threat of medical identity theft has increased, in part, because of breaches, including the massive attack on Anthem Inc., one of the nation’s largest health insurance companies. Hackers stole information on a reported 80 million Anthem customers and employees.
“Until recently, there wasn’t a lot of data to steal from medical records because digitization is relatively new,” says Patterson.
The Anthem breach did not appear to involve credit card or medical information — only names, birthdays, Social Security numbers, income and other personal data, the company said.
Medical facilities and insurance companies often don’t have systems in place to alert you to unusual activity, unlike banks and other financial institutions, says Frost.
“Someone can have surgery done on your insurance policy, but the company won’t call or verify the claim in advance,” she says.
Also, while a bank or credit card will usually refund your money or remove suspicious charges while an incident is investigated, you might immediately find yourself on the hook for a fraudulent medical bill.
ID thieves are often insiders or relatives
Medical identity thieves often are insiders working at health care facilities, Frost says, and they try to profit from the information they steal.
But most of the time, the culprit is someone close to the victim. In the survey sponsored by the Medical Identity Fraud Alliance, nearly 6 in 10 people whose medical identities had been stolen said they either knowingly shared their insurance information with someone they knew, or a family member took their insurance information without their consent.
Victims of medical identity theft are often poor or elderly with federal health insurance, Patterson says.
“Both Medicare and Medicaid use individuals’ Social Security numbers for identification, which makes them more vulnerable to fraud,” says Patterson. “Even in cases where people are using other types of insurance or no insurance at all, they often think they need to provide their Social Security number to get services even if it’s not required.”
Elderly woman billed for a vasectomy
Velasquez says that one of the Identity Theft Resource Center’s call centers once fielded a complaint from a Florida woman in her 90s who received a Medicare statement for a vasectomy in California.
The most shocking part is that no one checked on the age, the sex or the location of the patient before approving that claim, says Velasquez.
Patterson says insurance companies, including Medicare, use the “pay-and-chase” model, settling claims first and then later attempting to recoup fraud losses.
“The problem is, this gives medical identity thieves the ability to commit fraud multiple times before anyone even notices,” she says.
How to protect yourself
While it can be tough to protect yourself against a data breach, Weisman says you should safeguard your Social Security number and medical insurance card and ask medical providers how they use your personal information.
You should treat medical bills, prescription drug labels and insurance statements as you would any other sensitive information — and shred them, says Patterson.
“The best way to find out if you’ve had your medical identity stolen is to read your Explanation of Benefits (EOB) statement from your insurance company,” which will accompany each claim, she adds. “If the claim is unfamiliar, call your insurance company immediately.”
Frost says to guard against fraud by monitoring all medical billing statements and returning any calls from medical billing offices.
“You should periodically check the accuracy of your medical records for things like your blood type, medical conditions and procedures,” she says. “You can request to have your medical records corrected if you find false information.”
And Velasquez has this advice: Sign up for online accounts with your insurance company, prescription drug provider and medical providers, even if you don’t intend to use them. That will prevent someone else from signing up under your name.
Keeping watch over your medical information, credit report, financial statements and insurance statements may not prevent all cases of medical identity theft, but the vigilance can help you notice fraud faster and move quickly to correct it.