What Is Medical Identity Theft? How It Happens & What to Do

Medical identity theft is one of the least discussed — and most dangerous — forms of identity theft. Unlike financial identity theft, which primarily damages your credit and bank account, medical identity theft can corrupt your actual medical records. Incorrect blood type, medications, and diagnoses can follow you into emergency rooms and affect the care you receive when you’re at your most vulnerable.

It is also among the fastest-growing types of identity theft. Healthcare data breaches have exposed hundreds of millions of patient records in recent years, and the stolen information is worth far more on the black market than credit card numbers — a complete medical record can sell for as much as $1,000, compared to just $1 to $5 for a credit card number.

—

What Is Medical Identity Theft?

Medical identity theft occurs when someone uses your name, insurance information, or Social Security number to receive medical care, purchase prescription drugs, or submit fraudulent medical billing claims — all without your knowledge, and all billed to your insurance or your account.

The thief may be an uninsured individual looking to access healthcare they can’t afford, someone seeking prescription medications they can’t obtain under their own name, or a criminal operation submitting fraudulent insurance claims for care that was never actually provided.

—

How Does Medical Identity Theft Occur?

Medical identity theft can happen in several ways:

Healthcare data breaches. Hospitals, insurance companies, and healthcare networks hold vast quantities of sensitive patient data. When these organizations are breached — and breaches are frequent — patient records including names, SSNs, insurance IDs, and dates of birth are exposed. The Anthem breach in 2015 exposed 78.8 million patient records. The Change Healthcare breach in 2024 is estimated to have exposed the data of more than 100 million Americans.

Stolen or duplicated insurance cards. A physical insurance card contains everything a thief needs to receive care in your name at many facilities. Lost wallets and stolen mail are common sources.

Corrupt healthcare employees. Insiders with access to patient records occasionally misuse that access — selling patient data to criminal networks or using it themselves.

Phishing attacks targeting patients. Fraudulent emails impersonating hospitals, insurance companies, or the Medicare program can trick patients into submitting personal and insurance information.

Fake healthcare providers. Some criminal operations establish fake medical practices and submit fraudulent claims to insurers using stolen patient identities — billing for care that never happened.

—

Warning Signs of Medical Identity Theft

Medical identity theft is notoriously difficult to detect because it doesn’t show up on a credit report. The warning signs are subtler:

Explanation of Benefits (EOB) for care you didn’t receive. Your insurer sends you an EOB every time a claim is processed. If you receive one for a procedure, prescription, or hospital stay you don’t remember, investigate immediately.

Bills from healthcare providers you’ve never visited. A bill from a hospital, clinic, or lab you’ve never been to is a significant red flag.

Collection calls for medical debts you don’t recognize. If a debt collector contacts you about medical bills you’ve never seen, it could indicate a fraudulent account.

Inaccurate information in your medical records. If a healthcare provider references conditions, medications, or allergies that you don’t have, your records may have been contaminated.

Your health insurance claims are denied because you’ve reached your benefit limit. If your insurer tells you you’ve exhausted benefits for a category of care you haven’t heavily used, someone else may be using your coverage.

Notifications from your insurer about claims for care in a different city or state.

—

What to Do If You’re a Victim of Medical Identity Theft

Acting quickly limits the damage — to your finances and to your health records.

Step 1: Contact your health insurer’s fraud department

Report the fraudulent claims immediately. Ask for a complete accounting of all claims filed under your policy for the past 12 months. Request that fraudulent claims be flagged and investigated.

Step 2: Request copies of your medical records from all major providers

You have a legal right to your complete medical records. Review them carefully for unfamiliar entries — diagnoses, medications, procedures, or provider names you don’t recognize.

Step 3: Submit a request for correction

Under HIPAA, you have the right to request corrections to inaccurate information in your medical records. Contact the medical records department of each provider and submit written correction requests.

Step 4: File a report with the FTC at IdentityTheft.gov

This creates an official Identity Theft Report and helps generate a personalized recovery plan for your specific situation.

Step 5: File a complaint with the HHS Office for Civil Rights

The U.S. Department of Health and Human Services investigates HIPAA violations, including those related to medical identity theft. File at hhs.gov/hipaa.

Step 6: Contact Medicare or Medicaid if applicable

If a government health program was used fraudulently, contact the relevant agency directly. Medicare fraud can be reported at 1-800-MEDICARE.

Step 7: Monitor your credit

Medical identity theft sometimes also involves financial identity theft. Check your credit reports for unfamiliar accounts or inquiries.

—

How to Prevent Medical Identity Theft

Protect your insurance card like a credit card. Your insurance ID is as valuable as your Social Security number to a medical identity thief. Don’t share it unnecessarily.

Review every Explanation of Benefits you receive. Don’t file them away unread — they are your early warning system. Even small discrepancies deserve a call to your insurer.

Be skeptical of healthcare-related emails and calls. Legitimate healthcare providers rarely contact you out of the blue asking for insurance information. Verify by calling the provider’s official number before sharing anything.

Use a patient portal. Most major healthcare systems offer secure patient portals where you can view your records and claims history. Enable access and review it regularly.

Opt out of directory listings where possible. Some healthcare systems participate in patient directories. If your state allows it, you can opt out, limiting the visibility of your records.

Be careful about medical discount cards and other healthcare offers. Some “discount health plans” are scams designed to collect your insurance information.

—

Frequently Asked Questions

Q: What is the most common type of medical identity theft?

A: Fraudulent billing — where someone submits claims to your insurer for care that was never provided — is the most common form, largely because it can be done remotely with just your insurance ID and personal information.

Q: Can medical identity theft affect my actual healthcare?

A: Yes, and this is why it’s uniquely dangerous. If a thief’s blood type, medications, or conditions are added to your medical record, it can lead to incorrect treatment decisions — potentially with life-threatening consequences.

Q: Is medical identity theft covered by the Fair Credit Reporting Act?

A: Medical debt that appears on your credit report is subject to FCRA protections. However, the correction of medical records themselves is governed by HIPAA, not the FCRA. You’ll need to use HIPAA-based rights to request corrections to your health records.

→ Back to Types Hub: https://www.scammed.org/identity-theft/types/

→ Back to Pillar: https://www.scammed.org/identity-theft/