The rash of recent medical record breaches caused me to ask myself “what’s the reason?” Surely there must be easier ways to steal someone’s personal information. “There must be something going on here that I don’t yet understand,” I thought. So I started to research the issue and was stunned to learn of a fast-growing crime known as medical identity theft.

  

The most recent statistics on the crime is a 2007 federal report that cites more than 250,000 Americans a year are victims of medical identity theft. Pam Dixon, executive director of the nonprofit World Privacy Forum and author of a report on medical identity theft, believes that number has almost certainly increased since 2007 because of the increased use of electronic medical records systems and the lack of extensive safeguards.

 

The really frightening aspect if medical identity theft according to Ms. Dixon is that people may not discover they are victims for a very long time. It’s ridiculously easy for someone to use stolen insurance information, like the basic member ID and group policy number found on insurance cards, to impersonate the policy holder — and receive everything from a routine physical to major surgery under your coverage. Given the fact that many doctors and hospitals do not ask for identification beyond insurance information, a person may not learn that their medical information has been tampered with for months or even years - when a collections action shows up on a credit report.

 

Medical identity theft can take many forms. The most common being where medical information is stolen by insiders at a medical office. Thieves download vital personal insurance data and related information from the operation’s computerized medical records, then sell it on the black market or use it themselves to make fraudulent billing claims.

 

This is scary for a variety of reasons. When people are not aware their medical identities have been stolen, insurance companies may simply continue to pay the fraudulent claims without the victim’s knowledge. A person might learn of the fraud only when trying to make a legitimate claim, only to have the insurance company inform them they have reached their cap on benefits. In a country where the quality of medical care is contingent upon one’s ability to pay, the theft of one’s medical identity could be life altering.

 

18-months ago my daughter was struck by a car and suffered a traumatic brain injury. At every step of her 12-month rehabilitation the various hospitals performed a benefits eligibility assessment. We were very fortunate to have outstanding healthcare coverage. Today my daughter is fully recovered, but I shudder to think how her care would have been different had someone stolen her medical identity.

 

As if benefit availability and financial burden isn’t scary enough, the potential for victims’ medical files to contain erroneous information resulting from a fraudulent doctor or hospital visit may pose a bigger danger than the financial risks. Medical records contain vital information like blood type, allergies, prescription drug use or a history of disease that may be wrong. In an emergency, doctors could treat a patient that was a victim of medical identity theft based on erroneous information. Even a victim is lucky enough to discover the medical identity theft there are none of the consumer protections that exist for traditional identity theft. With medical identity theft the fraudulent charges can remain unpaid and unresolved for years, permanently damaging the victim’s credit rating.

 

So what is one to do to protect their medical identity? I’m not sure!!! Under HIPAA, the Health Insurance Portability and Accountability Act, you are entitled to a copy of your medical records, but you may have to pay a fee for them. Unfortunately there does not seem to be a good system to make a correction to your medical record. In cases where you are able to correct a record, say in your doctor’s office, the erroneous information may have been passed on to dozens of other health care providers and insurers. The reality is that victims must track down and resolve errors largely on a case-by-case basis.

 

Worse, HIPAA privacy rules can actually work against you. Once your medical information is intermingled with someone else’s, it may be difficult gaining access to your files. Ironically, HIPAA privacy laws dictate that the thief’s medical information, now contained in your records, must be kept confidential, too.

 

I’m not quite ready to advise people to keep a copy of the medical records in a lock box, but having faced a medical emergency with my child, I’m leaning that way personally.