The Medical Identity Theft Information Page

About medical identity theft, the world privacy forum medical identity theft report, and resources

What is medical identity theft?

Medical identity theft occurs when someone uses a person's name and sometimes other parts of their identity -- such as insurance information -- without the person's knowledge or consent to obtain medical services or goods, or uses the person’s identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim’s name.

Medical identity theft is a crime that can cause great harm to its victims. Yet despite the profound risk it carries, it is the least studied and most poorly documented of the cluster of identity theft crimes. It is also the most difficult to fix after the fact, because victims have limited rights and recourses. Medical identity theft typically leaves a trail of falsified information in medical records that can plague victims’ medical and financial lives for years.

The World Privacy Forum researched and published the first major report about medical identity theft and brought this crime to the attention of the public for the first time (Full report ). We also maintain the only detailed FAQ for victims of the crime as well as consumer tips and best practices for healthcare providers. We have also published a report on health care providers' obligations under the newly issued FTC Red Flag rules. We are currently researching the second report on medical identity theft, which will be published in 2009.

CONSUMER RESOURCE: A Patient's Guide to HIPAA

Released March 31, 2009

A Patient's Guide to HIPAA is a resource created specifically for consumers. Patients who are concerned about medical identity theft and who may be victims often have many related questions about HIPAA; this Guide is written for them and for anyone who wants to find practical ways of understanding HIPAA and their medical privacy.

• Visit the Patient's Guide to HIPAA

REPORT: Red Flag and Address Discrepancy Requirements: Suggestions for Health Care Providers

RELEASED SEPTEMBER 24, 2008

This report discusses the applicability of the new FTC Red Flag regulations to the health care sector along with suggestions for providers. The recently issued regulations by the FTC require financial institutions and creditors to develop and implement written identity theft prevention programs. Health care providers -- whether they are for-profit, non-profit, or governmental entities -- may have obligations under the new rules. Medical identity theft is a real concern in the health care sector, and is included expressly in the Red Flag Rules Guidelines. The new regulations take effect in 2009.

• Read the Full Report (30 pages)

REPORT: Medical Identity Theft: The Information Crime that Can Kill You.

Released May 3, 2006

Author: Pam Dixon; contributor: Robert Gellman

• Read the Executive Summary (15 pages)

• Read the Full Report (56 pages)

This report finds that medical identity theft is a crime that can cause great harm to its victims. False and erroneous entries in victim medical files and other harms make it imperative to understand this crime better and learn more about it and how it works.

Key recommendations in the report include:

• Individuals’ rights to correct errors in their medical histories and files need to be expanded to allow them to remove false information from their files.
• Victims of medical identity theft should have the right to receive one free copy of their medical file.
• Individuals should have expanded rights to obtain an accounting of disclosures of health information.
• Notification of medical data breaches to consumers has the potential to save lives, protect health, and prevent losses.
• All working prototypes for the National Health Information Network need comprehensive risk assessments focused on preventing medical identity theft while protecting patient privacy.

FAQ: Detailed steps for recovering from medical identity theft for victims

• FAQ for victims: Read the detailed Medical Records FAQ for victims (on the web):

  This FAQ is a step- by- step guide to accessing and amending medical records, getting a history of disclosures of medical files, and recovering from medical identity theft. This FAQ was released June 30, 2006 and is checked regularly for updates. This FAQ contains sample letters for victims, and is detailed.

CONSUMER TIPS: What to do if you are a victim of medical ID theft (or are worried about it)

• Read the Consumer tips (on the web)

  These consumer tips are more general than our detailed FAQ for victims. These are tips suited for victims of medical identity theft, and for people who are concerned about knowing what steps they can take to detect and prevent medical identity theft. These tips were released in May 2006 and are checked regularly for updates.

BEST PRACTICES: Medical Identity Theft: Best Practices and Solutions for Providers

Released October 2007

• Read Responses to Medical Identity Theft: Eight best practices for helping victims of medical identity theft (HTML)

  This is the World Privacy Forum's 8 best-practice responses to medical identity theft for the health care sector. Based on ongoing research in the area of medical identity theft.

• Read the speech Medical Identity Theft: Issues and Responses (PDF).

  World Privacy Forum speech on medical identity theft to AHIMA with the latest research and eight best -practice responses for responding to the crime.

What has the World Privacy Forum Been Doing About Medical Identity Theft?

The World Privacy Forum, as the organization that published the first major report about this crime, is very actively working on the issue of medical identity theft to both understand and document the crime and to find the best practices that can be used to assist victims after the fact and to detect, prevent, and deter this crime from happening. We are also working with victims of this crime to assist them.

• The World Privacy Forum published a Patient's Guide to HIPAA to assist all patients and victims of medical identity theft in understanding how to navigate HIPAA and better utilize their rights under HIPAA. (March 2009).
• The World Privacy Forum is actively engaging in dialog to determine national-level standards for responding to medical identity theft, including authentication practices (current as of 2009).
• The World Privacy Forum published a report on the Red Flag Rules set to go into effect May of 2009. (Report published September 2008).
• The World Privacy Forum presented a workshop to providers and government stakeholders regarding medical identity theft and best practices for responding to the crime in March 2008.
• In January 2008, a California law based on the World Privacy Forum recommendations in its report went into effect.
• The World Privacy Forum published research-based recommendations to providers regarding best responses to the crime of medical identity theft in October 2007.
• The World Privacy Forum presented recommendations and solutions regarding victim recovery from medical identity theft to the California Health Information Association in June 2007.
• The World Privacy Forum filed comments with the President's Strategic Task Force on identity theft in winter 2006 and explained the issues relating to medical identity theft. Medical identity theft was included in the Task Force's report published in April, 2007.
• The World Privacy Forum presented issues and solutions regarding medical identity theft as part of the HISPC project in regional meetings with health care providers and other stakeholders in November 2006.
• The World Privacy Forum presented issues and solutions regarding medical identity theft to thought leaders in Tokyo and other parts of Japan and discussed trans-national differences in the crime. (October 2006).
• The World Privacy Forum filed comments with the FTC and other agencies asking medical identity theft to be included in Red Flag guidelines. (September 2006).
• The World Privacy Forum testified before AHIC on medical identity theft in September 2006.
• The World Privacy Forum has developed detailed tips and downloadable letters for victims of medical identity theft. (June 2006).
• The World Privacy Forum has issued the first in-depth report about medical identity theft in May 2006. This is the first major report on medical identity theft to be published.
• The World Privacy Forum has submitted agency comments to Health and Human services to request changes to the HIPAA law to allow victims of medical identity theft expanded rights in November 2005.
• The World Privacy Forum has testified about medical identity theft before the National Committee on Vital And Health Statistics in August 2005. This is the first known public testimony about this crime.
• The World Privacy Forum submitted agency comments in December 2005 and asked the FTC to study medical identity theft more closely.