Medical Identity Theft

Medical identity theft is more devastating to the victim than traditional financial identity theft.  This article from the New York Times explains some of the known affects of this crime and the bureaucratic process to fix the erroneous information in medical or health insurance records. 

Medical Problems Could Include Identity Theft

New York Times

By Walecia Konrad, June 12, 2009

Excerpt……

The last time federal data on the crime was collected, for a 2007 report, more than 250,000 Americans a year were victims of medical identity theft. That number has almost certainly increased since then, because of the increased use of electronic medical records systems built without extensive safeguards, said Pam Dixon, executive director of the nonprofit World Privacy Forum and author of a report on medical identity theft.

And uncountable, Ms. Dixon said, are the people who do not yet know they are victims. They may not know that their medical information has been tampered with for months or even years until, as in Mr. Sharp’s case, it shows up in collections on a credit report.

Medical identity theft takes many guises. In Mr. Sharp’s case, someone got hold of his name and Social Security number and used them to receive emergency medical services, which many hospitals are obliged to provide whether or not a person has insurance. Mr. Sharp still does not know whether he fell victim to one calamitous perp who ended up in several emergency rooms or a ring of accident-prone conspirators.

In another variant of the crime, someone can use stolen insurance information, like the basic member ID and group policy number found on insurance cards, to impersonate you — and receive everything from a routine physical to major surgery under your coverage. This is surprisingly easy to do, because many doctors and hospitals do not ask for identification beyond insurance information.

Even more common, however, are cases where medical information is stolen by insiders at a medical office. Thieves download vital personal insurance data and related information from the operation’s computerized medical records, then sell it on the black market or use it themselves to make fraudulent billing claims.

and…..

And there are none of the consumer protections for medical identity theft victims that exist for traditional identity theft. Under the Fair Credit Reporting Act you can get a free copy of your credit report each year, put a fraud alert on your account and get erroneous charges deleted from your record. If your credit card is stolen and the thief goes on a spending spree, you’re not liable for more than $50 worth of the charges.

With medical identity theft, though, the fraudulent charges can remain unpaid and unresolved for years, permanently damaging your credit rating. Under the federal law known as HIPAA — the Health Insurance Portability and Accountability Act — you are entitled to a copy of your medical records, but you may have to pay a hefty fee for them.

Worse, HIPAA privacy rules can actually work against you. Once your medical information is intermingled with someone else’s, you may have trouble accessing your files. Privacy laws dictate that the thief’s medical information now contained in your records must be kept confidential, too.

Even when you are able to correct a record, say in your doctor’s office, the erroneous information may have been passed on to dozens of other health care providers and insurers. Victims must track down and resolve these errors largely on a case-by-case basis, Ms. Dixon says.

More…….

The FTC Red Flags rule require  entities  with covered accounts to implement programs to identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft.  This will add another layer of consumer protection against identity theft and greatly expand the reach of the FTC, helping consumers fight fraud. 

I would think that the providers of health care would be the first line of defense in preventing medical identity theft.  The American Medical Association (AMA) is making efforts to persuade the FTC that doctors are not “creditors.”  While the enforcement of the Red Flags rule has been postponed twice (November 2008 – original date, May 2009, and August 2009), the FTC has made it clear (see below:   The “Red Flags” Rule: What Health Care Providers Need to Know About Complying with New Requirements for Fighting Identity Theft) that the Red Flags rule is based on each individual business.  Only after considering the definition of a “creditor” and “a covered account” can they determine the type of program that must be implemented, based on the risk of identity theft.  

These are references that relate to the Red Flags rule.  

Health care and the Red Flags rule-

-The “Red Flags” Rule: What Health Care Providers Need to Know About Complying with New Requirements for Fighting Identity Theft

The FTC, by Steven Toporoff, May 2009

-Hot Issues Alerts - Law Firms:  Do The FTC Red Flag Rules Apply To You? What Health Care Companies Should Know About The New FTC Requirements To Prevent Identity Theft

The Metropolitan Corporate Counsel, H. Carol Saul and EpsteinBeckerGreen, 1 June, 2009

The FTC  -

Fighting Fraud with the Red Flags rule 

Do-It-Yourself Program for Businesses at Low Risk For Identity Theft

The World Privacy Forum - The Medical Identity Theft Information Page

An unanswered question - Do ID Theft protection services even provide coverage for medical identity theft?