Medical Identity Theft Lawyer

Medical identity theft occurs when someone uses another person’s personal or health insurance information to obtain medical care, prescription drugs, medical devices, insurance benefits, or other healthcare services. It can also involve fraudulent claims submitted using someone else’s identity.

Unlike some forms of identity theft, the consequences are not necessarily limited to money or credit. Medical identity theft can introduce incorrect information into a person’s medical records, interfere with insurance benefits, generate bills for treatment the person never received, and potentially affect future healthcare decisions.

Net Law Advocates represents individuals nationwide in identity theft and privacy matters. When medical identity theft follows a data breach or another failure involving personal information, the circumstances may also raise questions about how the information was obtained and whether legal action may be available.

What Is Medical Identity Theft?

The Federal Trade Commission defines medical identity theft as the use of someone’s personal information, such as a name, Social Security number, health insurance account number, or Medicare number, to obtain medical care, prescription drugs, medical devices, or submit insurance claims.

For example, someone might use another person’s health insurance information at a medical provider and receive treatment under that person’s identity. The resulting visit, diagnosis, prescription, and insurance claim could then become associated with the victim.

Medical identity theft can also occur when stolen information is used to:

• Obtain prescription medications
• Receive medical or dental treatment
• Purchase medical equipment
• Submit fraudulent health insurance claims
• Use Medicare or other healthcare benefits
• Create fraudulent medical accounts
• Obtain services under another person’s identity

This distinguishes medical identity theft from a medical records or PHI data breach. A breach involves unauthorized access to or disclosure of information. Medical identity theft involves the information actually being used to impersonate someone or obtain healthcare-related services or benefits.

What Information Can Be Used for Medical Identity Theft?

A thief does not necessarily need someone’s complete medical history.

Personal identifying and insurance information can be enough to commit certain forms of medical identity theft.

Information involved may include:

• Name and date of birth
• Social Security number
• Health insurance member or account number
• Medicare number
• Medicaid information
• Medical record number
• Prescription information
• Provider or patient portal credentials
• Other identifying information connected to healthcare coverage

The information may come from a healthcare breach, stolen documents, phishing, account compromise, employee misconduct, or another source.

A healthcare data breach can be particularly significant when it exposes both identity information and healthcare or insurance credentials that can later be misused.

Medical Identity Theft Can Affect More Than Your Finances

The financial consequences of identity theft can be serious, but inaccurate medical information presents a different kind of problem.

Suppose someone uses your identity to obtain medical treatment. Information about that person’s condition, diagnosis, medications, allergies, blood type, or treatment could potentially become associated with your records.

The FTC warns that when an identity thief’s health information becomes mixed with a victim’s information, it can affect the medical care or health insurance benefits the victim receives.

This makes correcting medical records an important part of responding to medical identity theft.

Warning Signs of Medical Identity Theft

Medical identity theft is not always discovered immediately.

A person may first become aware of it after receiving paperwork related to treatment that never occurred.

Potential warning signs include:

• Bills for medical services you did not receive
• Explanation of Benefits statements showing unfamiliar treatment
• Prescription records for medications you do not take
• Calls or letters about medical debt you do not recognize
• Medical collection accounts appearing on your credit report
• Unexpected changes to your medical records
• Insurance claims for unfamiliar providers or procedures
• Notices that health insurance benefits have been exhausted or limited
• Medicare statements showing services or equipment you never received

The FTC identifies unfamiliar medical bills, Explanation of Benefits statements, collection notices, credit-report entries, and notices that insurance benefits have reached their limits as potential indicators that someone is using another person’s medical information.

One unfamiliar entry does not necessarily establish identity theft. Billing and administrative errors occur. But unexplained activity should be investigated.

How Medical Identity Theft Can Start With a Data Breach

Healthcare organizations maintain unusually detailed collections of personal information.

Hospitals, physician practices, health insurers, pharmacies, laboratories, billing companies, benefits administrators, and healthcare vendors may hold combinations of names, Social Security numbers, insurance information, medical records, contact information, and financial data.

If that information is compromised, the incident may create opportunities for several forms of fraud.

A breach by itself is not medical identity theft. The distinction is important.

Someone whose medical information was exposed but never misused has experienced a data-security or privacy incident. Someone whose compromised information is subsequently used to obtain healthcare or submit fraudulent claims may be dealing with medical identity theft as well.

Establishing a connection between a particular breach and later identity theft can require additional evidence.

Medical Identity Theft Can Also Involve Medicare

Medical identity theft can involve Medicare numbers and benefits.

Someone may use another person’s Medicare information to bill for medical services, equipment, or other benefits the legitimate beneficiary did not receive.

The FTC advises Medicare beneficiaries to review their statements and report medical identity theft when someone uses their information to obtain medical care or services.

Unfamiliar Medicare activity should therefore be investigated rather than assumed to be an administrative error.

What Happens When Someone Else’s Information Enters Your Medical Record?

One of the more difficult aspects of medical identity theft is separating the victim’s legitimate medical information from information generated through fraudulent use.

An identity thief may have different medical conditions, medications, allergies, diagnoses, or treatment history.

If inaccurate information becomes associated with the victim, simply resolving an insurance charge may not address the entire problem.

The individual may need to identify which providers or healthcare organizations possess inaccurate information and request corrections.

HIPAA gives individuals broad rights to access protected health information about themselves maintained in designated record sets by covered healthcare providers and health plans. Those records can include medical records as well as billing, payment, claims, enrollment, laboratory, and other information used to make decisions about the individual.

Reviewing those records can help identify entries that do not belong to you.

Can You Correct Medical Records After Identity Theft?

HIPAA provides a process for requesting amendment of inaccurate or incomplete protected health information maintained by covered entities.

If you discover a visit, diagnosis, treatment, medication, or other information that does not belong to you, you can request that the provider or health plan correct the record.

A provider or plan does not necessarily have to accept every requested amendment. If it denies a qualifying request, HIPAA generally provides a process through which the individual can submit a statement of disagreement that becomes associated with the record.

The FTC recommends identifying each doctor, clinic, hospital, pharmacy, laboratory, and health insurer where the identity thief may have used your information, obtaining the relevant records, reviewing them for errors, and reporting inaccuracies in writing.

Correcting the medical record can be just as important as resolving the financial consequences.

What Should You Do If You Discover Medical Identity Theft?

The appropriate response depends on how your information was used, but several steps can help establish what happened and limit further problems.

Obtain and Review Your Medical Records

Start with the providers, insurers, pharmacies, laboratories, or other organizations where suspicious activity appears.

Federal law generally gives individuals the right to access their health information maintained by HIPAA-covered providers and health plans, subject to limited exceptions.

Compare the records with treatment you actually received.

Review Insurance Statements

Examine Explanation of Benefits statements and online insurance records for unfamiliar providers, procedures, prescriptions, or claims.

Keep copies of suspicious entries.

Report Incorrect Information

Contact the provider or insurer when you identify records or claims that do not belong to you.

For medical records, submit correction or amendment requests in writing when appropriate and preserve copies of your communications.

Report the Identity Theft

The FTC’s IdentityTheft.gov allows victims to report identity theft and create a personalized recovery plan. Its medical identity theft guidance specifically recommends reviewing medical records, reporting inaccurate information, and notifying the health insurer.

Review Your Credit Reports

Medical identity theft may overlap with other forms of identity fraud.

Check your credit reports for accounts, collections, or other activity you do not recognize.

Keep Documentation of What Happened

Records can become important both for correcting the identity theft and evaluating whether a legal claim may exist.

Preserve documents such as:

• The original data breach notification, if applicable
• Medical bills for services you did not receive
• Explanation of Benefits statements
• Medical records containing incorrect information
• Insurance correspondence
• Prescription records
• Collection notices
• Credit reports
• Identity theft reports
• Communications with providers and insurers
• Documentation of financial losses or other consequences

Also keep a record of the organizations you contacted, when you contacted them, and what they told you.

This can help establish a timeline of the identity theft and the steps required to correct it.

Who May Be Responsible for Medical Identity Theft?

The person committing the fraud is responsible for the identity theft itself, but a separate legal question can arise concerning how that person obtained the victim’s information.

Sensitive information may have been stolen in a cyberattack, exposed by a healthcare organization, compromised through a vendor, obtained through phishing, accessed through a patient account, or acquired in another way.

When identity theft follows a known breach, an attorney may examine whether the information used by the thief matches the information compromised in that incident.

Timing can also matter, but timing alone does not establish causation.

Personal information can be exposed through multiple sources. Determining whether a healthcare provider, insurer, employer, vendor, or another organization may bear civil liability requires examining the specific incident, applicable law, security practices, causation, and the individual’s resulting harm.

Does HIPAA Let You Sue for Medical Identity Theft?

HIPAA establishes important federal privacy and security requirements for covered healthcare providers, health plans, and their business associates, but HIPAA itself generally does not provide individuals with a private right of action for damages.

That does not necessarily mean there are no legal options.

Depending on the facts and jurisdiction, conduct involving medical identity theft or the underlying exposure of information may implicate state privacy laws, consumer-protection statutes, negligence principles, contractual obligations, or other legal theories.

The existence of a HIPAA issue and the existence of a private civil claim are therefore separate questions.

Can You Sue After Medical Identity Theft?

Potentially.

The answer depends in part on how the identity theft happened and who is alleged to be legally responsible.

A lawsuit against an organization that experienced a data breach, for example, requires more than establishing that identity theft occurred. The analysis may involve:

• What information the organization possessed
• What information was compromised
• Whether the stolen information was actually acquired
• Whether that information matches what was later used
• How the breach allegedly occurred
• What legal duties applied to the organization
• Whether applicable law permits a private claim
• What harm resulted from the identity theft
• Whether the harm can be connected to the incident

Actual misuse of compromised information can be important evidence of injury, but it does not automatically prove that a particular organization is legally responsible.

What Harm Can Medical Identity Theft Cause?

The consequences can vary substantially from one person to another.

Potential harm may include unauthorized medical bills, insurance problems, collection activity, credit damage, time spent correcting records, out-of-pocket expenses, loss of access to benefits, and other consequences recognized under applicable law.

Inaccurate medical information may create additional concerns because the victim may need to correct records held by multiple providers or healthcare organizations.

The type of harm and available remedies depend on the facts and the legal claims involved.

Medical Identity Theft vs. Healthcare Data Breach

These concepts are related but should not be treated as interchangeable.

A healthcare data breach concerns unauthorized access to or acquisition, disclosure, or exposure of information maintained within the healthcare ecosystem.

Medical identity theft concerns the use of another person’s identity or insurance information to obtain healthcare, prescriptions, medical devices, benefits, or submit claims.

One can lead to the other, but it does not always.

That distinction is important when evaluating both the practical response and potential legal claims.

When Should Medical Identity Theft Be Reviewed by an Attorney?

Attorney review may be worthwhile when medical identity theft appears connected to a known data breach or security incident, particularly when sensitive information such as Social Security numbers, insurance credentials, Medicare numbers, or medical information was compromised.

Review may also be appropriate when the identity theft caused substantial financial losses, insurance problems, inaccurate medical records, loss of benefits, or other significant consequences.

The purpose is to determine how the information was obtained, what laws may apply, whether another party may be legally responsible, and what remedies may be available based on the circumstances.

Speak With Net Law Advocates About Medical Identity Theft

Medical identity theft can affect financial accounts, insurance benefits, and the accuracy of medical records. When stolen information was obtained through a data breach or another privacy or security failure, there may also be questions about whether an organization bears legal responsibility.

Net Law Advocates represents plaintiffs nationwide in identity theft, data breach, and privacy matters. If your identity or health insurance information was used without authorization and you want to understand your legal options, contact Net Law Advocates at 888-913-2318 for a free, confidential consultation.