In 2023, a woman in Phoenix received a collection notice for $120,000. The debt was for a liver surgery — one she never had, never scheduled, and had no knowledge of until the bill arrived. Someone had used her name, her insurance number, and her date of birth to check into a hospital in a different state, received the surgery, and disappeared. Her insurer had already paid a portion. The rest was now being pursued as a patient balance.
The surgery had been performed eight months earlier. Her medical records, meanwhile, had been updated with new diagnoses and a blood type entry that was wrong. They also listed post-operative medications that could have caused serious harm if a future physician had acted on them without checking.
This is what separates medical identity theft from the credit card variety. Financial fraud is reversible. Disputing charges, freezing accounts, and issuing new cards are established processes that work. Our guide to how identity theft happens covers the financial side. Medical identity theft corrupts something that cannot simply be reset: the clinical record a doctor uses to make decisions about your care.
What Medical Identity Theft Actually Does
When a thief uses your identity to obtain medical treatment, they do not just run up a bill. Every procedure, every diagnosis, every medication administered gets written into your record. If a thief has a different blood type, a different medication history, or untreated conditions you do not have, those details now sit in your file. The next time you present at an emergency room unconscious, or need surgery under anaesthesia, the physician working from that record is working from contaminated data.
The Ponemon Institute has tracked this fraud category since 2013. It found that the average victim spends $13,500 resolving a medical identity theft case and devotes more than 200 hours to the process. That means writing letters, disputing records with multiple providers, filing complaints, and chasing corrections through a system not built to accommodate them. The US Federal Trade Commission consistently reports hundreds of thousands of victims per year. Most researchers believe the figure is significantly undercounted, because so many cases go undetected or unreported.
Financial identity theft triggers alerts. Credit bureaux flag suspicious new account openings. Banks send fraud texts. The infrastructure for catching and signalling financial fraud is decades old and reasonably effective. The medical records system has nothing comparable. There is no single credit bureau for health data. There is no real-time alert when a claim is filed under your policy, and no automatic flag when treatment is documented somewhere you have never been.
The result is a category of fraud where victims find out late and the trail is cold. The records they need corrected are scattered across multiple providers, insurers, and systems that do not communicate with each other.
How Thieves Obtain Your Medical Identity
Three routes account for the majority of cases, and each is worth understanding because the defences are different.
Healthcare data breaches are the largest single source. In 2019, the American Medical Collection Agency was a billing contractor used by Quest Diagnostics, LabCorp, and several other major providers. It suffered a breach that exposed the records of approximately 25 million patients: names, dates of birth, Social Security numbers, and insurance details. The breach went undetected for months. The records surfaced on criminal forums and were sold in bulk. Quest alone notified nearly 12 million patients. Medical records sell for between $10 and $1,000 on dark web markets, depending on completeness. That is far more than credit card numbers, which fetch under a dollar each, because a full medical record enables both healthcare fraud and financial fraud at once.
Insider theft at medical facilities is the second major route. People with system access — billing clerks, receptionists, nurses, administrative contractors — sometimes sell patient records directly. In 2014, a Cedars-Sinai employee was caught accessing the records of celebrity patients and leaking them to tabloids. The same access that enables tabloid snooping enables identity fraud. The difference is motive. A low-paid billing contractor who can sell fifty patient records for $500 each faces a temptation the healthcare system has not structurally addressed.
Social engineering is the third route, and the most preventable. The most common version is a phone call claiming to be from your insurer or Medicare. It asks you to “verify” your membership number, date of birth, or insurance ID. The caller often knows your name already, because it takes nothing to find that on a data broker site like Spokeo or Whitepages. The request sounds routine. Medicare recipients are specifically targeted because Medicare ID numbers were, until 2018, the Social Security number itself. CMS has since issued new alphanumeric Medicare Beneficiary Identifiers, but old numbers remain compromised for anyone enrolled before the switch. The 1-800-MEDICARE number exists precisely because this scam is so persistent.
The Detection Problem
Most victims discover medical identity theft in one of three ways. The first is an unexpected bill for treatment they did not receive. The second is an insurance claim denial saying their annual benefit limit has been reached. The third is a visit to a new provider, where the medical record in front of the doctor contains information the patient does not recognise.
None of these are early warning signals. By the time a bill arrives or a claim is denied, the fraud has typically been running for months. The Ponemon Institute’s research found the average time between the start of medical identity theft and discovery is 14 months. Fourteen months of claims being filed, records being altered, and your insurance paying out on procedures you know nothing about.
There is a detection tool that most people ignore: the Explanation of Benefits letter. Every time a claim is filed against your health insurance, your insurer sends you an EOB. It is a document showing what was claimed, what was paid, and what you owe. Most people, particularly those who are not actively unwell, treat these as administrative noise and throw them away. Reading them carefully is genuinely the fastest way to catch this fraud early. Watch for a claim from a facility you do not recognise. Watch for a date when you were definitely not receiving treatment, or a procedure that does not match any appointment you recall. These are the flags.
Request a complete claims history from your insurer if you have not kept your EOBs. Most insurers will provide several years on request. This is not a significant burden on their part; they maintain this data for their own reasons. Ask for it, and actually review it.
The Legal Framework and Who Can Help You
In the United States, the machinery for addressing medical identity theft exists, though it requires you to drive it.
The FTC’s IdentityTheft.gov handles medical identity theft alongside financial fraud. Filing a report there generates an Identity Theft Report — a formal document that has legal weight when disputing fraudulent accounts and records. The FTC will also create a personalised recovery plan. Do this first; you will need the report for almost every subsequent step.
HIPAA gives you two specific rights that matter here. Under 45 CFR § 164.524, you have the right to access your medical records from any covered healthcare provider within 30 days of request. Under 45 CFR § 164.526, you have the right to request amendment of your records if you believe they are inaccurate or incomplete. The provider can deny an amendment request, but they must document the denial and your disagreement. They must also include your written statement of dispute in your record going forward.
The practical sequence: file at IdentityTheft.gov first. Then write to each healthcare provider where fraudulent records appear, enclosing a copy of the Identity Theft Report, and formally invoke your right to amendment under HIPAA § 164.526. Also request an accounting of disclosures — HIPAA requires providers to tell you who your records have been sent to in the previous six years. This tells you how far the contaminated record has already travelled.
Contact your insurer’s Special Investigations Unit, not general customer service. Every major insurer has an SIU whose job is exactly this kind of fraud. A standard customer service rep cannot order a fraud investigation or reverse payments; the SIU can. Ask specifically to be transferred or to have your case escalated to that unit.
For Medicare recipients, report to the HHS Office of Inspector General hotline (1-800-HHS-TIPS). Then review your Medicare Summary Notice — the equivalent of an insurer’s EOB — for any unfamiliar claims. The OIG takes Medicare fraud seriously because it affects programme finances, and they have investigative resources.
Outside the United States, the frameworks differ but the rights exist. In the UK, the NHS has a formal complaints process, and the Information Commissioner’s Office handles data protection complaints under UK GDPR. If your NHS records contain inaccurate information from someone else’s treatment, you have a right to have them corrected. In EU member states, GDPR Article 16, the right to rectification, applies directly. Healthcare providers are data controllers; they are obligated to correct inaccurate personal data on request.
What to Do Right Now
You do not need to have discovered fraud to take protective steps. Most of these are one-time actions that take less than an hour.
Review your EOBs. Request a complete claims history from your insurer if you do not have the letters. Go through it looking for providers you do not recognise, dates that do not align with any appointment, or treatments you did not receive. Flag anything suspicious in writing.
Access your medical records. In the US, you can request records directly from each provider you have seen. Many now offer access through patient portals — MyChart is the most common. If records contain information you do not recognise, document it and prepare a HIPAA amendment request.
Check your Medical Information Bureau file. The MIB is a database used by insurers when evaluating life, health, and disability insurance applications. It holds coded records of conditions disclosed on applications. You are entitled to one free report per year at mib.com. This will not catch all medical identity theft, but it may surface conditions or diagnoses you did not disclose because you do not have them.
If you suspect active fraud, contact your insurer’s SIU directly. Explain what you have found and ask them to open a fraud investigation. Get a case reference number. Then file the FTC report and begin sending HIPAA amendment requests to each affected provider.
For Medicare recipients, review every Medicare Summary Notice you receive. You can also access your claims history through Medicare.gov. Report any suspicious claims to 1-800-MEDICARE (1-800-633-4227) or the HHS OIG hotline. Do not discuss your Medicare Beneficiary Identifier with anyone who calls you — Medicare does not make unsolicited calls asking for this information.
Document everything. Keep copies of every letter you send and receive, every reference number from every phone call, and every response from providers and insurers. Resolving medical identity theft takes months and sometimes years. The victims who resolve it most effectively are those who treated it from the start as a paper trail to be meticulously maintained.
One more thing: if you do discover your records have been corrupted, tell your current doctors explicitly. Do not assume the amended record will reach everyone who needs to see it quickly enough. Maybe your blood type was wrong in a record. Maybe a drug allergy was added that you do not have, or a condition was documented that you do not have. If so, tell the physicians treating you now, in person, and ask them to note the discrepancy in your current file.
Medical identity theft is unusual among fraud categories in that the financial harm, while serious, is the secondary problem. The primary problem is the clinical one: decisions made about your body, by people acting in good faith, on information that belongs to someone else.
See what a scan finds → walks through an example report of the kinds of personal data brokers expose. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.