Medical identity theft: the warning signs and how to fix your records

A thief uses your name, insurance member ID or Medicare number to see a doctor, fill prescriptions, get equipment or file false claims. Besides the bills, the real danger is your medical record: their blood type, allergies or diagnoses can end up in your file.

The FTC lists these warning signs:

• A bill or explanation of benefits for services you did not get or prescriptions you do not take.
• A debt collector contacting you about medical debt you do not owe.
• Medical collection notices on your credit report that you do not recognize.
• Your health insurer telling you that you have reached a benefit limit.

Health data breaches make this more likely. The Change Healthcare breach alone involved data on about 192.7 million people, including insurance IDs for many of them.

An explanation of benefits is the statement your health plan sends after it processes a claim. It is not a bill. It lists the date, provider, service and what the plan paid. Most insurers let you see them in their app or website, and you can usually switch to electronic delivery so they do not sit in a mailbox.

Each time one arrives, check three things:

1. Do you recognize the provider?
2. Did you have an appointment, test or prescription on that date?
3. Does the service match what happened?

If anything is wrong, call the number on your insurance card and ask for the fraud department, then call the provider's billing office. A mistake in coding is common and innocent; a provider you have never visited is not.

The FTC's recovery steps are to get your medical records from each doctor, clinic, hospital, pharmacy, lab and insurer where the thief may have used your information, review them, and report errors in writing.

• You have a right to your records. HHS says the HIPAA Privacy Rule gives you, with few exceptions, the right to inspect, review and get a copy of your medical and billing records from health plans and providers. A provider may charge reasonable copying and mailing costs, cannot charge for searching or retrieving, and cannot refuse because you owe a bill (HHS).
• You can ask for corrections. If information is wrong, request an amendment. The provider or plan must respond; if it disagrees, you can submit a statement of disagreement for your file.
• Write it down. The FTC suggests a letter with a copy of the incorrect record and an explanation, sent by a method that tracks delivery such as certified mail, and keeping copies.
• If a provider refuses to give you records, appeal to the contact in its Notice of Privacy Practices or its patient representative, as the FTC recommends.

1. Create a report and personal recovery plan at IdentityTheft.gov. The thief who has your insurance details may have more, and the plan covers the other steps.
2. Pull your free credit reports at AnnualCreditReport.com and look for medical collections you do not recognize. Dispute them with each bureau; see our credit report guide for how.
3. If your Social Security number may also be exposed, freeze your credit.

Our general identity theft recovery plan covers the rest.

• Keep insurance cards, records and bills somewhere safe, and shred old ones; see what documents to shred.
• For pill bottles you cannot shred, the FTC suggests marking out personal and medical details.
• Ask providers whether they can use something other than your Social Security number, or just the last four digits.
• Do not give insurance or health details to unexpected callers, emails or texts. Log in or call a number you know is real.