Contact: World Privacy Forum
Medical identity theft, is a little studied crime that carries potent risk, according to a new report
issued by the World Privacy Forum. Victims of this crime may suffer from a variety of harms, including
the now well-recognized signs of financial identity theft. But medical identity theft may also bring
further harms to its victims and can put the health and safety of victims at risk.
The World Privacy Forum is a non-profit public interest research and consumer education group. It
focuses on a range of privacy matters, including financial, medical, employment, and Internet privacy
issues. The World Privacy Forum was founded in 2003 and is based in San Diego, California. Pam Dixon,
the executive director of the World Privacy Forum and the author of the report said: "I don't know why
it has taken so long to look at the problems unique to medical identity theft, but this report is a
first step in understanding this crime, which has its own mechanisms and harms that consumers need to
be aware of."
Many victims of medical identity theft have false and erroneous information put in their medical files
due to the activities of their imposters. One victim found wrong blood type information put in a file
due to the activities of her imposter; another person had a debt collector call him for a surgery he
never had.
Erroneous information in victim's medical files can lead to other difficulties later on, such as
denial of insurance for diseases the victim may not have and incorrect medical treatment based on
errors. False entries in health records can exist at hospitals, doctors' offices, pharmacies, and
insurance companies and can be nearly impossible to correct.
Medical identity theft often leaves its victims without substantive recourse or clear pathways to
follow for help. Recovery for victims of medical identity may be difficult or impossible because of
the lack of enforceable rights, and because of the dispersed and often hidden nature of medical
records.
Key findings in the report include:
- This crime is under-researched and under-documented.
- False entries in medical records are a hallmark of medical identity theft. Victims may have had
their medical records altered without their permission, consent, and often knowledge. False entries
can range from minor changes to substantial changes that can introduce potentially life-threatening
medical errors.
- False entries made to medical files can be difficult for many victims to find unless they have
been notified through some other "crime flag" such as a bill for services they did not receive, or a
collections notice from a hospital.
- Victims do not have clear pathways for recourse and recovery. The Fair Credit Reporting Act allows
for greater recourse for victims of financial identity theft than the HIPAA health privacy rule
provides for victims of medical identity theft. For example, under HIPAA, victims do not have the
legal right to demand correction of their medical information that was not created by the provider or
insurer currently maintaining or using the information. This complexity and circularity can make it
extremely difficult for a medical identity theft victim to erase false entries from a medical or
insurance record.
Key recommendations in the report include:
- Individuals, rights to correct errors in their medical histories and files need to be expanded to
allow them to remove false information from their files.
- Individuals should have the right to receive one free copy of their medical file.
- Individuals should have expanded rights to obtain an accounting of disclosures of health
information.
- Studies are needed to determine what the incidence of medical identity theft is, how and where it
is occurring, and how it can be detected and prevented.
- Notification of medical data breaches to consumers has the potential to save lives and protect
health.
- All working prototypes for the National Health Information Network need comprehensive risk
assessments focused on preventing medical identity theft while protecting patient privacy.
It is in your best interest to find out about medical identity theft, because fraudsters who are using
your identity for medical care or services can introduce changes to your medical record that can be
nearly impossible to undo. These changes can range from small things that do not pose a risk to you to
substantial erroneous information that can pose a medical risk to you.
For this reason, to truly resolve medical identity theft, it is important to clean up your credit
report if necessary. And it is just as important to clean up your medical files, which may have been
altered to reflect diseases that you do not have.
Discovering medical identity theft is not like discovering financial identity theft: it can be harder
to detect medical identity theft, and you sometimes need to look in different places. For example,
some people find out about medical identity theft when a debt collector sends a letter or calls. But
others only find out after an insurance investigator alerts them to the problem, or after they notice
errors in their medical file, or after they get a strange bill for medical services they did not
receive.
Based on some of the cases of medical identity theft that have come to light, World Privacy Forum
offers these tips:
Closely monitor any "Explanation of Benefits" sent by an public or private health insurer.
A number of victims discovered they had a problem by carefully reviewing insurance statements. If
anything appears wrong, raise questions with the insurer or the provider involved. Do not assume that
things are okay just because you don't owe money.
The kinds of problems you may see can include:
- Being charged for services that you did not receive .
- Being charged for office visits you did not make.
- Being charged for medical equipment you did not receive.
Request an accounting of payments from your insurers
Once a year, pro-actively request a listing of benefits paid in your name by any health insurer that
might have made payments on your behalf. It is important to do this pro-actively, without waiting for
the insurance company to simply send you a listing. Sometimes fraudsters will change your billing
address and phone number, which means you may not be seeing all of your bills. Asking your insurer
pro-actively for this information will help foil fraudsters who use this technique.
Request an accounting of disclosures
Request annually (or more often if there is a specific cause for concern) an accounting of disclosures
from health care providers and health insurers. "Accounting of disclosures" is a specific right under
the federal health law, HIPAA. What the accounting will tell you is, generally, who has accessed your
health records in certain circumstances. An accounting of disclosures should, if done correctly by the
health care provider, reveal any data breaches that have occurred.
To request an accounting, follow the directions your health care provider gives you. You will need to
make your request in writing.
Request a copy of current medical files from each health care provider.
Under HIPAA, you have the right to see your health care file. If you want a copy of your files, a
health care provider does have the right to charge you a fee for this. In some cases of medical
identity theft, health care providers have been reluctant to show medical identity theft victims their
health records. If this happens to you, stand your ground and insist on your rights: your medical
file is a crucial document for you to see.
If a healthcare provider, for example, a hospital, refuses to release medical files that are in your
name, file an appeal under HIPAA at the hospital. Also file a complaint with the Office of Civil
Rights at the federal Department of Health and Human Services if you are not satisfied. Consider
seeking assistance from state health departments, fraud investigators, elected representatives, or
lawyers if you believe that the denial of access may be covering medical identity theft.
Correct erroneous and false information in your file
If you discover your medical or insurance records contain erroneous information, work to amend those
records. If you find information that is not about you or that bears no relationship to diseases you
have, or if the information describes treatment that you did not receive, demand that the false
information be removed entirely from the record.
Released: May 08, 2006
|
