TL;DR: Medical identity theft is when someone uses your name, Social Security number, insurance or Medicare number to get care, prescriptions or devices, or to bill your insurer. Warning signs include bills or Explanation of Benefits statements for care you never had, medical debt you don't recognise, and being told you've hit a benefit limit. Get copies of your records, dispute errors in writing, check your credit reports and report it at IdentityTheft.gov.
What medical identity theft is
The FTC defines it as someone using your personal information, such as your name, Social Security number, health insurance or Medicare number, to see a doctor, get prescriptions or medical devices, or file claims with your insurer. It's harder to spot than card fraud, and it does a different kind of damage: the thief's diagnoses, blood type and prescriptions can end up in your medical file.
Warning signs
- A bill or Explanation of Benefits (EOB) for a visit, test or prescription you didn't get
- A debt collector chasing you for medical debt you don't owe
- Medical collection accounts on your credit report that you don't recognise
- Your insurer saying you've reached your benefit limit
- A claim denied because your records show a condition you don't have
Read every EOB, even the ones that say "this is not a bill." That's usually the first place the fraud shows up.
How it happens
- Healthcare data breaches. Hospitals, insurers and billing firms hold exactly the details a thief needs. Our breach pages on Change Healthcare, Anthem and HCA Healthcare show how much leaked.
- Phone and text scams. Callers pretending to be Medicare, an insurer or a "free genetic test" service ask for your member number. Our guide to open enrollment insurance scams covers the scripts.
- Lost or stolen cards and paperwork. Insurance cards, prescription bottles and old statements in the bin.
- Someone close to you. A relative or carer using your card for their own care.
What to do if it happens
These steps follow the FTC's guidance:
- Get your medical records from each doctor, hospital, pharmacy, lab and insurer the thief may have used. You may need to fill in forms or pay fees. If a provider refuses, appeal to its privacy officer or patient representative.
- Review them for errors such as visits, conditions or prescriptions that aren't yours.
- Dispute errors in writing with each provider, enclosing a copy of the wrong record. Use a trackable method such as certified mail. The FTC says the provider must respond within 30 days and notify others that may have the same error.
- Check your credit reports for medical collections at AnnualCreditReport.com and dispute billing errors with all three bureaus.
- Report it at IdentityTheft.gov to get a recovery plan, since the thief may have used your details elsewhere. Our guide to reporting identity theft to the FTC walks through the form.
- Tell your insurer's fraud department and ask for a new member number.
How to protect yourself
- Keep insurance and medical papers locked away, and shred them before throwing them out.
- Ask why any organisation needs your insurance or Medicare number, and who they'll share it with.
- Never give medical details to unexpected callers, emails or texts. Call your provider on a number you already have.
- Set up online access to your insurer's portal so you can see claims as they're filed.
- Consider a credit freeze. It won't stop medical fraud directly, but it blocks new credit in your name if the thief tries that next.
Outside the US
The same fraud happens wherever health records are digital. In Australia, the Medibank breach exposed health claims data for millions. Wherever you live, ask your insurer or health service for a record of claims made in your name and report anything you don't recognise.
A healthcare breach usually leaks your email and phone along with your medical details, and those are what scammers use to contact you next. A free email exposure check shows which breaches your email is in.
Frequently Asked Questions
What is medical identity theft?
Someone using your name, Social Security number, insurance or Medicare number to get medical care, prescriptions or devices, or to file claims with your insurer.
What are the signs of medical identity theft?
Bills or Explanation of Benefits statements for care you did not receive, unfamiliar medical debt or collection calls, medical collections on your credit report, and being told you have reached a benefit limit.
How does medical identity theft occur?
Through healthcare data breaches, phone and text scams asking for insurance or Medicare numbers, lost or stolen cards and paperwork, and sometimes people close to the victim.
How do I fix my medical records after identity theft?
Request your records, identify the errors, and dispute them in writing with each provider. The FTC says providers must respond within 30 days.
Where do I report medical identity theft?
In the US, report it at IdentityTheft.gov, tell your insurer's fraud department, and dispute medical collections with the credit bureaus.