The Potential Damages and Consequences of Medical Identity Theft and Healthcare Data Breaches

What Is Medical Identity Theft? 

A vicious new type of identity theft is on the rise: medical identity theft. It occurs when someone steals your personal information to receive free medical care, goods, and/or prescription drugs.

“Medical identity theft is dangerous because it not only has financial implications but can have life-threatening consequences,”. If a thief’s health information is mixed with your medical records, then your treatment, health insurance, payment records, and credit report may all be affected, according to the Federal Trade Commission. Medical identity theft can disrupt your life, damage your credit rating, and waste taxpayer dollars. 

Medical identity theft comes in many different forms. Here are some ways thieves are profiting from your medical identity. They: 

• Make fraudulent claims against your own health insurance policy or Medicare so they can receive free healthcare; 

• Obtain illegal, free, or bogus treatment by assuming your identity at a hospital or clinic to obtain their own medical care free; your health insurance plan is then billed for fake or inflated treatment claims; and 

• Secure prescriptions, such as addictive drugs and medical products, which they may use or sell. 

Why Medical Identities Are So Valuable 

Your medical records may be more valuable than your credit card number. Here’s why. 

• Access. Hospitals have relatively low security compared to banks and credit card companies, and collecting personal information is fairly simple. Another challenge to maintaining your privacy is that there is no central repository for medical records, says Bearak. 

• Data. Medical records contain more sensitive personal information than a bank account. With names, birth dates, insurance policy numbers, diagnosis codes, and billing information, fraudsters sell the information, create fake identities, file false insurance claims, and purchase medical equipment or drugs. • Timing. Most people are not regularly checking their medical records, so the fraud may not be immediately flagged. Credit card theft, on the other hand, is quicker and easier to uncover, and the compromised accounts can be cancelled. 

• Value. Medical identities are 20 to 50 times more valuable to criminals than financial identities, according to a recent Fortune magazine article 

Who Commits the Crime?

• Hackers. The Affordable Care Act’s HealthCare.gov website was hacked last fall, and Community Health Systems had their computers hacked by Chinese identity thieves who stole personal information, exploiting the infamous Heartbleed security flaw (discovered in April 2014) that is used by as many as two-thirds of websites on the Internet, according to a recent report in USA Today. 

• Employees. Doctors, nurses, and lab technicians at healthcare facilities may be at fault. They have easy access to medical information, and their knowledge of the insurance billing systems presents opportunities for a quick profit.

What You Can Do to Protect Yourself 

• Track your medical records and check for mistakes. Remember, you have the right to see your records and have errors corrected. Wrong information not only points toward evidence of identity theft but also has implications for your treatment. 

• Read your medical and insurance statements regularly and completely. They can show warning signs of identity theft. 

• Review your insurance benefits. Ask your insurer for a listing of benefits paid out under your policy at least once a year. 

• Monitor where and when you provide your personal medical information (in person, over the phone, or online). Always decide if the information is absolutely necessary before providing it. 

• Keep paper and electronic copies of your medical records and health insurance records in a safe place. And, when no longer needed, shred documents containing personal information. 

• Look for medical organizations that follow the “Red Flags Rule,” which requires many businesses and organizations to implement a written identity theft prevention program designed to detect the “red flags” of identity theft in their day-to-day operations and take steps to prevent the crime and mitigate its damage.