The Road to Recovery from Medical Identity Theft

According to a recent Bloomberg BusinessWeek article, medical identity thieves have walked away with a $12,000 liposuction from one victim and $100,000 of medical services from another, which included a $19,000 life-flight helicopter trip and multiple emergency room visits. For Brandon Sharpe of Houston, TX, it took approximately six months to reverse the $100, 000 in outstanding charges and correct his medical records. With medical information moving into electronic formats as part of Obama’s health care reform, the problem is likely to get worse. While this may save money and improve the quality of care people receive, it also increases medical identity theft since digital files are far easier to steal than paper files.

Of course we can’t control every aspect of our digital identity and this article doesn’t claim to provide answers to complex cases of medical identity fraud, but we can provide some basic steps to mitigate the damage should your identity be used to obtain health care services illegally.

If victimized contact your provider’s billing department or the collection agency that is requesting payment and explain that you may have been a victim of identity theft. In some cases, you may be directed to someone in the legal or fraud department. Some questions to ask include:

• What identification did the imposter provide? If it was an insurance card call your insurance company and report the problem to receive a replacement card.

• Was a social security number used or just a name and address? If you SSN was used, begin reviewing our recovery steps and take action immediately. Request recent copies of your credit report and consider placing a credit freeze or filing a fraud alert with the credit bureaus.

• Ask when and what type of service was provided? You might be able to prove you were somewhere else at the time of the crime. At the very least, you can prove that you do not have a particular condition or prove your innocence by providing other detailed medical information.

As with any identity theft it is important to file a police report where you currently reside. Because health care providers and insurers may request it, copies are essential. If you have a police report stating that someone is impersonating you, this can assist with tracking a thief if the stolen identity is used to acquire either pharmaceuticals or medical care at multiple locations.

Complete an affidavit of fraud. This document is available on the FTC’s website. You may be requested by the medical provider’s billing department, insurer or collection agencies to provide copies and any other documentation proving your case. Save copies of the documentation for your files.

If you find yourself a victim of medical identity theft, and for some reason a provider refuses to grant you access to your medical records, they must provide a reason in writing. Refusing to comply with your request may be in an effort to avoid violating another patient’s identity under HIPAA (Health Insurance Portability and Accountability Act of 1996), but you do have the right to file an appeal of denial to the individual listed within the provider’s Notice of Privacy Practices. Within this document there should also be an explanation of the provider’s appeal procedure. When communicating with both your health plan and health care provider, keeping detailed records of every conversation, phone call, and copies of postal and email correspondence is crucial. If you’ve filed an appeal, the provider has 30 days from the receipt of your written request to comply. After 30 days, you can file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights, at www.hhs.gov/ocr. Remember keep copies of any mail correspondence you receive or send, and be sure to mail it certified with a return receipt requested.

Request an accounting of disclosures from your health care provider or insurer. This record is a compiled list of disclosures stating what health information was disclosed, when and why it was disclosed and to whom it was disclosed to. If there is incorrect information it may have been circulated, and it can assist you in contacting every agency or entity that may now have it has a matter of record. Within the provider’s or insurer’s Notice of Privacy document, you can find the request procedure as well as to whom the request should be made to.

Recovery from medical identity theft can be a tricky road to travel. It can tarnish both your credit and your medical records. For more information on preventing medical identity theft, see Identity Thieves Want Your Health Care.