What Is Medical Identity Theft? (Are You A Victim?)

This Scam Could Cost You Your Life

There are few scams that can truly make a difference between life and death. Unfortunately, medical identity theft is one of those scams.

Here’s just one example: When agents from the U.S. Health and Human Services found Juan Seoane, they thought they'd caught the mastermind behind a $350,000 Medicare fraud [*].

Instead, they found an 84-year-old man on the brink of death and living in squalor. As it turned out, Seoane was the unfortunate victim of medical identity theft. Scammers used his stolen details to line their pockets while Seoane clung to life in a filthy room.

Medical identity theft can be devastating. So how do you know if you’ve been a victim of a medical scam? How can you protect yourself?

{{show-toc}}

What Is Medical Identity Theft? How Does It Happen?

Medical identity theft is a type of identity fraud in which someone steals your health insurance information to get illegitimate access to medical services, equipment, or prescription drugs, and/or submits fraudulent medical insurance claims.

The cost of medical identity theft can be astronomical. Data from as far back as 2017 show that almost two-thirds of victims report losing ~$13,500 to fraudulent bills [*]. More recent data shows that healthcare had the highest cost per stolen record at $429 [*].

For some people, unexpected bills and loss of benefits could even cost them their lives.

As with other types of identity theft, scammers need your personally identifiable information (PII) to pull off the crime. Scammers can gain this information through phishing scams, fake websites, or hacking your devices. But it’s more likely that they bought it online after it was leaked in a data breach.

Over the past five years, healthcare data has become one of the prime targets of data breaches.

Even worse, to carry out healthcare fraud, thieves only need fragments of your personal information, such as:

• Name
• Date of birth
• Contact information
• Social Security number (SSN)
• Other personally identifiable information (PII). This includes your driver’s license or bank account information.
• Other personal health information, including your healthcare plan data or medical and prescription history.

Once they have that information, they can impersonate you and run a range of scams in your name.

Medical ID theft vs. other identity frauds

Medical identity theft offers thieves a long-term income. If someone applies for credit in your name, chances are, you’ll quickly notice — especially if you have alerts set up through an identity theft protection service.

But it can take years for victims of medical identity theft to realize that they've been targeted. Often, you won't know until you visit the doctor's office or need urgent treatment at the hospital.

By then, a fraudster could have racked up thousands of dollars in fraudulent claims and hit your benefit limit.

📚 Related: Aura vs. LifeLock Comparison: 2023 Showdown →

What Happens When Thieves Use Your Medical Identity?

1. You’ll get billed for treatments a thief receives
2. You could experience delays in getting medical care
3. You might lose access to your health benefits
4. You could face criminal charges
5. You may get a misdiagnosis or incorrect treatments
6. You could end up with massive amounts of healthcare debt

Identity fraud of any kind can wreak havoc on a victim’s life for years. But medical identity theft is especially ravaging.

There are several common scams that arise from medical identity theft. Typically, these scams fall under one of three categories.

Criminals can destroy your health insurance coverage and leave you without a safety net when you need it most. Here are the six worst consequences of medical identity theft:

1. You’ll get billed for treatments a thief receives

False representation is when an identity thief pretends to be you in order to get medical care at a doctor’s office, clinic, or hospital. If someone steals your health insurance care or health plan information, you could get bills for medical treatments you never received.

A famous example of this was the case of June Smith. Thieves billed the 72-year-old New Yorker’s Medicare for almost $50,000 — including a pregnancy test [*].

📚 Related: How To Identify a Medicare Scam Call: 7 Scams To Watch Out For →

2. You could experience delays in getting medical care

In the digital age, bad data can cause a tangled mess that takes time to resolve. For people in need of urgent surgeries or treatment, such delays can cause immense stress.

In the worst-case scenario, a patient might pass while waiting for the authorities to sort out the confusion with their health insurance plan.

3. You might lose access to your health benefits

Once they've gained access to your medical benefits, criminals will abuse your Medicare as much as possible. By the time you need it for yourself, "you" have exceeded your insurance coverage and no longer have access to the benefits you need.

For example, a California doctor was indicted after running illegitimate medical insurance scams through at least four home health agencies [*]. Over $6 million was paid out on the fraudulent claims, leaving the accused with the prospect of 10 years in federal prison.

4. You could face criminal charges

If someone steals your health insurance information and conducts a crime in your name, you might end up needing a lawyer.

For example, thieves can use stolen healthcare information to procure drugs at a pharmacy. These drugs may be prescribed medicines or restricted items like opioids, which thieves can take for recreational use or sell.

5. You may get a misdiagnosis or incorrect treatments

Fraudulent treatments done under your name can completely change your medical information history. This could lead doctors misdiagnosing your actual ailments or give you unneeded treatments.

📚 Related: Is Allstate Identity Protection Worth It? What To Know →

6. You could end up with massive amounts of healthcare debt

Scammers are almost always financially motivated. Another common medical identity scam occurs when criminals order expensive medical equipment to sell on the black market. In February 2022, two women were found guilty of their role in an elaborate Medicare fraud scheme in Boston [*].

The women falsified claims for durable medical equipment (DME) using Medicare patient data stolen from a range of call centers. By the time they were caught, they had made $107 million in fraudulent claims.

📚 Related: How To Prevent Medical Identity Theft (10 Safety Tips) →

How To Protect Yourself From Medical Identity Theft

The best way to tackle medical identity theft is to be proactive about securing your sensitive information.

Here are four steps for you and your family to prevent identity theft:

1. Safeguard your health insurance card and Medicare cards. Treat these cards and all personal health information as you would a credit card or SSN. If you lose these cards, contact your health insurance company immediately.
2. Protect your mail and online credentials. Never share your patient portal credentials with anyone else. You can opt for paperless bills to reduce the chance of mail fraud (like a change-of-address scam) leading to the exposure of your personal information. Another option is to get a locked mailbox to provide extra security for your sensitive information.
3. Review the Explanations of Benefits (EOB) and all bills and notices. It’s easy to set bills aside without a second thought. Make a habit of reviewing everything related to your medical care.
4. Monitor the medical records of your dependents. It’s important to protect your children and elderly family members who rely on you for support. Children are easy targets in medical identity theft because it’s easier for thieves to run a scam anonymously.

Finally, consider signing up for a family identity theft monitoring plan. Aura can monitor and alert you if someone is trying to scam you online or your family’s sensitive information — like your SSN — is being used for fraud.

7 Signs That You’re a Victim of Medical Identity Theft

It’s vital that you know when your identity has been stolen so that you can react quickly and limit the ensuing damages.

Here are seven warning signs indicating that you might be a victim of healthcare fraud:

1. You receive unexpected bills from medical providers for services that you’ve never received. Be especially suspicious of medical bills in your child's name.
2. You receive unexpected medical kits to your home. A Chicago musician discovered that someone had stolen her Medicare card when she received test kits and paperwork for a hereditary cancer screening she didn't order [*].
3. You receive calls from debt collectors for medical debts that you don't recognize.
4. Your health insurance provider notifies you that you reached your benefits limit. Be especially wary if you know you haven’t made many (or any) claims.
5. You notice mistakes or unexpected entries in your medical record, such as an incorrect address or date of birth. Look for fraudulent entries, like blood tests you didn’t request or medications you weren’t prescribed.
6. You receive a change of address confirmation from your medical insurance provider, even though you haven’t moved.
7. Your insurance claim is denied because your medical records show you have a condition (that you don’t actually have). This is one of the worst consequences of medical identity theft, and could cost victims their lives.

If any of the warning signs of identity theft above have your alarm bells ringing, follow these next steps.

📚 Related: How Long Does It Take To Recover From Identity Theft? →

How To Recover from Medical Identity Theft

• File a report at IdentityTheft.gov. The Federal Trade Commission (FTC) will take details of the fraud, create a recovery plan, and start an investigation. You’ll also get an FTC Identity Theft Report.
• File a police report with your local law enforcement. Notifying the police will increase the chances of catching the criminals before they target other people.
• Request copies of your medical records. Contact the individual doctors and healthcare institutions that may have your information. This includes clinics, labs, pharmacies, and hospitals. Ask for your medical records and insurance EOB statements. You might have to pay fees to obtain copies.
• Report any errors. When you review your records, make a note of any errors or questionable entries. Send a written letter to the healthcare provider to explain the issue and request that your records be amended. The provider must respond to the request within 30 days.
• Contact the OIG’s fraud hotline. If you suspect or know that you’ve been the victim of Medicare fraud, you should contact the U.S. department of health and human service’s Fraud Hotline at 1-800-447-8477 (1-800-HHS-TIPS).
• Go through your credit reports. When you’re the victim of medical identity theft, there’s always a chance fraudsters have access to more of your information. For example, they could commit loan fraud and open credit in your name. Get in touch with the three credit bureaus (Experian, Equifax, and TransUnion) to get a credit report, so you can check for any fraudulent activity and start to repair your credit score.
• Set up a fraud alert or credit freeze. Notify the bureaus of the fraud and set up credit monitoring to receive notification of any attempts to open new accounts in your name. If you're worried, you can initiate a credit freeze to stop the approval of any new accounts.

📚 Related: 12 Awful Senior Citizen Scams: How To Prevent Elder Fraud →

Recent Healthcare Data Breaches: Were You Impacted?

Protected Health Information (PHI) is one of the most common type of information hacked in data breaches. Healthcare breaches costed an average of $10.1 million in 2022, an increase of 9.4% from 2021 [*].

If your data has been leaked or accessed by hackers, you could be at risk of medical identity theft. Here are some of the most recent healthcare data breaches to be aware of [*]:

1. MOVEit transfer attack (July 18, 2023): 1.2 million people were impacted by a data breach at Pension Benefit Information (PBI) after widespread cyberattacks on MOVEit.
2. HCA Healthcare (July 10, 2023): Data from 11 million patients was leaked and posted online, including patient names, appointment information, email addresses, phone numbers, and more.
3. OneTouchPoint (July 7, 2022): 4.1 million people were affected by a ransomware attack on this Wisconsin-based mailing and printing vendor. The breach exposes healthcare member IDs and other information provided during health assessments.
4. Advocate Aurora Health (October 14, 2022): The PHI of three million patients had potentially been disclosed to Meta/Facebook as a result of website tracking codes on the healthcare system’s websites.
5. Connexin Software (November 11, 2022): More than 2.2 million individuals were notified of a healthcare data breach that took place in August 2022. The paediatric-specific health IT provider disclosed that the data breach potentially included Social Security numbers, treatment information, and other health insurance information.
6. Shields Health Care Group (May 27, 2022): The Massachusetts-based medical services provider suffered a data breach that exposed the data of two million people. The data loss included patient information such as insurance number, Medical record number, and other PII.
7. Professional Finance Company (July 1, 2022): This Colorado-based debt collection company helps hospitals process customer unpaid bills and outstanding balances. In a ransomware attack that affected the company, more than 1.9 million patients were affected.

These are just some of the most recent healthcare data breaches, with more happening every single week.

Medical Identity Theft Is a Matter of Life and Death

It’s not an understatement to say that medical identity theft is possibly the most damaging type of identity fraud there is. Not only can this crime cost you money, but it could even cost you your life. 

Of course, that would be an extreme scenario. But the reality is that the fallout from medical identity theft can be severe. 

Keep your health documents secure from scammers. And for added protection, sign up for Aura’s identity theft protection plan. We’ll monitor your personal information for signs of identity theft and alert you of any suspicious activity. 

And if the worst happens, you’re covered by a $1,000,000 insurance policy for eligible losses due to identity theft.

Protect your identity and finances from scammers. Try Aura free for 14 days.