Medical Identity Theft Turns Patients Into Victims

Victims of financial identity theft have a much clearer path to recovery than those whose medical identities are stolen. If someone swipes your wallet and goes on a spending spree, you can ask any of the three major credit bureaus for a free credit report, place a fraud alert on your account, and get inaccurate charges expunged. With medical identity theft, it's not that simple. In the first place, your records are most likely scattered among many different providers, and there's no medical records clearinghouse that keeps them. Under HIPAA, the federal law that addresses medical privacy, you're entitled to a copy of these documents, though you may have to pay for it. If there's an error, you can add a correction to the record, but you can't have information deleted. And if an impostor gets healthcare services in your name, you may really be stuck. Healthcare providers may actually refuse to let you see your own record because once it's intermingled with someone else's, that person's privacy must be protected.

Even seemingly obvious errors can be hard to clear up in this fragmented system. Wayne Ivey, who formerly led an identity theft task force at the Florida Department of Law Enforcement, remembers getting a call from an extremely agitated Illinois woman a few years ago. A hospital in Miami, she said, was calling her repeatedly and demanding that she pay a $2,000 bill for giving birth. She told the callers she'd never been to that hospital—and was 72 years old. It still took weeks of phone calls to various agencies to resolve the problem.

Insider fraud. Until recently, experts believed most medical identity thieves were solo operators who pretended to be someone else because they needed medical care. Now a different picture is emerging, one of employees inside the healthcare system stealing patients' information to make false insurance claims. "It's trending above the 90th percentile that insiders are doing the identity theft," says Pam Dixon, executive director of the World Privacy Forum, who authored a 2006 report on medical identity theft that was perhaps the first in-depth examination of this crime.

An insider was behind the theft of more than 1,100 Medicare beneficiaries' medical identities at the Cleveland Clinic in Weston, Fla., a few years ago. A front desk clerk named Isis Machado downloaded their names, addresses, and Social Security and Medicare numbers and sold the data to her cousin, who then made more than $2.8 million in false Medicare claims. Machado was caught because a coworker told her supervisor she was acting suspiciously. "There's no way to prevent insiders from becoming crooks," says Robert Gellman, a privacy and information policy consultant in Washington, D.C. With sometimes hundreds of employees legitimately needing access to patient records, even robust computer monitoring and auditing systems may not pick up a problem.

Healthcare providers can be victims, too. A dying man confessed to his doctor that he'd posed as a cousin to fraudulently receive more than $85,000 in medical services at the University of Connecticut Health Center in Farmington. The hospital got stuck with the bill when the patient died. It now requires a picture ID at every visit and pastes a photograph to the inside of each patient's medical chart, says Marie Whalen, assistant vice president for ambulatory services. But that's not going to protect the facility from the kind of insider crime that experts now believe is more common.

Ultimately, no matter how sophisticated the technology or diligent the healthcare provider, patients themselves may be the best first line of defense against medical identity theft. "Most of the time, these problems are consumer reported," says Byron Hollis, managing director of the national antifraud department for the Blue Cross Blue Shield Association, which coordinates antifraud activities for the 39 independent BCBS companies nationwide. "They know what procedures they did or didn't receive."