Medical Identity Theft

Why medical identity theft is the hardest type to recover from — and what to do if your records are mixed with a stranger's.

How the Scam Works

Medical identity theft happens when someone uses your health insurance card, Medicare number, or personal information to obtain medical services, prescription drugs, durable medical equipment, or to file fraudulent insurance claims. Unlike financial identity theft, the damage often shows up not in your bank account but in your medical records — where it can be life-threatening.

When a thief uses your Medicare or insurance to get treatment, their medical history — blood type, allergies, medications, conditions, drug-use history — gets merged with yours in hospital and pharmacy systems. If you later go to an emergency room and the records show "you" are allergic to penicillin (when you're not), have diabetes (when you don't), or are on a blood thinner (when you're not), you could receive the wrong treatment.

Common varieties:

•Insurance fraud rings billing Medicare for fake equipment or treatments (see DME fraud)
•Family member fraud: An uninsured relative uses your insurance card for their own treatment
•Opioid prescription fraud: Thieves use stolen identities to obtain prescription opioids
•Hospital insider theft: Employees with database access sell patient information
•Phishing attacks targeting health plans to obtain member information

Recovery is particularly difficult because HIPAA privacy laws make it hard for you to even see "your" medical record — the record now reflects both your data and the thief's. Insurance companies and hospitals are often slow to correct merged records, and you may discover the fraud only when you receive a bill for treatment you never had, your benefit limits are exhausted, or your insurance is canceled.

Real-World Example

🏥 Real Case

A 76-year-old retired bookkeeper in Florida lost her wallet at a pharmacy. Six months later, she received an Explanation of Benefits showing $87,000 in emergency surgery, intensive care, and follow-up visits at a hospital she had never visited. A man using her insurance card had been treated under her name. When she later had a real emergency room visit, her medical record incorrectly listed her as Type 1 diabetic, prescribed insulin she never took, and showed a recent appendectomy. Correcting her medical record across three hospitals and her insurance company took 26 months and required a federal complaint to HHS.

Warning Signs

•Bills for medical services you never received.
•Medicare Summary Notices (MSNs) or insurance EOBs listing visits, equipment, or prescriptions you didn't get.
•Insurance benefits "maxed out" before you've used them.
•Collection notices for medical debt you don't recognize.
•Your medical record shows incorrect information — diagnoses, medications, allergies you don't have.
•You're denied insurance, life insurance, or a job because of a "medical condition" you don't have.
•Unexpected packages of medications or equipment arrive.

How to Protect Yourself

✓Treat your Medicare and insurance cards like credit cards. Don't carry them everywhere; bring them to scheduled appointments only.
✓Review every Medicare Summary Notice and EOB within a week of receiving it. Even small unfamiliar charges can be the start of larger fraud.
✓Create a Medicare.gov account to see claims faster than paper notices.
✓Request your free annual medical records from your doctors and pharmacy. Look for entries you don't recognize.
✓Shred medical paperwork with insurance numbers before throwing it away.
✓Beware of "free" medical services or equipment offers — most are bait for insurance fraud.
✓If you're a victim:
→ Call your insurance and 1-800-MEDICARE immediately
→ Report to the HHS Office of Inspector General at oig.hhs.gov
→ Request medical records and submit corrections in writing
→ File a report at IdentityTheft.gov
→ Contact your local Senior Medicare Patrol at smpresource.org

Think Your Identity Is Compromised?

Use our free Scam Checker to instantly analyze any phone number, email, or website for known scam patterns.