Hacking medical identities

Imagine you’re about to be married, and you’re trying to buy your first home to start your family. When you request your credit history to apply for a mortgage, you discover that supposedly you’ve received collection notices for high emergency room bills; however, you’ve never been treated in the ER.¹

Or consider that you’ve been waiting anxiously to see the results of a medical test. You receive in the mail not only your results but those of two others with their names, addresses and insurance numbers.

Or maybe you received a letter informing you that an employee at a company that provides technology-based services to medical industries had leaked 500 patients’ sensitive information and you were one of them.²

And you definitely don’t want to have Anndorie Sachs’ troubles. The local authorities mistakenly reported her as an unfit mother and threatened to take her four children away. A pregnant woman — a meth user — had stolen Sachs’ medical identity, delivered a baby in Sachs’ name, abandoned her child at the hospital and left Sachs with a $10,000 hospital bill.³

This woman’s crimes could hurt Sachs throughout her life. The perpetrator had a different blood type than Sachs, and uncorrected co-mingled medical records could result in Sachs’ death if she ever needed a blood transfusion. A future health care provider might even prohibit her from reviewing her medical records because they might not be in her name. Once Sachs disclosed that those records weren’t hers, her health care provider denied her access to them because the provider had to now protect the records of the woman who stole Sachs’ identity. Sachs was unable to verify that all the removed records were just those of the thief. The health care industry is addressing this market conflict.

COMPLEX QUAGMIRE

WHO GETS HIT AND WHY

The perpetrators rack up insurance claims or high charges through treatment in emergency rooms where physicians are required to treat patients regardless of insurance coverage.

Insurance companies that pay the claims along with providers (hospitals, doctors and clinicians treating patients) might be secondary victims because they often have to write off expenses incurred by the thief. They might also spend time and money in working with victims to correct medical histories and records. The most significant consequence for the providers of care is compromised medical decision making because of incorrect patient information.

Perpetrators commit medical identity fraud for many reasons: to simply obtain free services, steal benefits or services for which they’re ineligible or to perpetrate other frauds or illegal activities such as pilfering drugs for personal use or illegal distribution.

MITIGATING MIT

The AHIMA practice brief, “Mitigating Medical Identity Theft,” includes an 18-step consumer checklist guide to begin the process of mitigating MIT:  

1. Read “Taking Charge: What To Do if Your Identity is Stolen” [See “How to Correct Errors in Your Medical Records” on p. 31 of "Taking Charge." — ed.] provided by the Federal Trade Commission (FTC). Consider completing the universal affidavit to submit to creditors on page H-1 of the publication.
2. Review credit reports, correct them and place a “fraud alert” on them.
3. If you suspect someone is inappropriately using a Social Security number, contact the Social Security Administration’s fraud hotline at (800) 269-0721.
4. If mail has been stolen or misdirected, contact the U.S. Postal Service at (800) 275-8777 to obtain the number of the local U.S. postal inspector.
5. For stolen passports, contact the U.S. Department of State at (877) 487-2778.
6. If a thief has stolen checks, contact your financial institution and both check verification companies: Telecheck [(800) 366-2425] and the international Check Services Company [(800) 526-5380] to place a fraud alert on the account to ensure that counterfeit checks will be refused.
7. Contact the health information manager or the privacy officer at the provider organization or the anti-fraud hotline at the health plan at which the medical identity theft appears to have occurred.
8. Request an accounting of disclosures. If the provider or plan refuses access to medical records, file a complaint with the Office for Civil Rights at Health and Human Services at (866) 627-7748. 
9. Take detailed notes of all conversations related to the medical identity theft. Write down dates, names and contact information of everyone contacted, as well as the contents of conversations.
10. Make copies of any letters, reports, documents and emails sent or received about the identity theft.
11. Work with the organization at which the medical identity theft occurred to stop the flow of the incorrect information, correct the existing inaccurate health record entries and determine where incorrect information was sent.
12. File a police report and send copies with correct information to insurers, providers, and credit bureaus once the identity theft has been confirmed.
13. File a complaint with the attorney general in the state where the identity theft occurred. The National Association of Attorneys General provides state-by-state information.
14. Check with the National Association of Insurance Commissioners to determine if your state has a state insurance department for online complaints. 
15. File a complaint with the Identity Theft Data Clearinghouse, operated by the FTC and the Internet Crime Complaint Center. 
16. Contact the Department of Health and Human Services at (800) 368-1019 for suspected Medicare or Medicaid fraud. 
17. Prior to seeking health care, review health records to make sure they’ve been corrected. 
18. Change all personally identifiable information and passwords for protected accounts, sites, access points, etc. Choose unique personal identification numbers and complex passwords rather than common ones, such as mother’s maiden name, birth date or pet name.¹⁰ [Note: We’ve updated web links and information in these 18 steps. — ed.]  

MIT victims have to thoroughly inspect medical bills and records to decide if their charges and medical information is correct. Victims must fight imposters’ charges and correct any altered medical information — a difficult task, at best. The ultimate insult is when a victim’s benefit plan places services on hold because the perpetrator depleted dollars in the account. (Unfortunately, the health care industry has been slow to provide ways to repair medical identities. However, it has become an emerging cottage industry because of the millions lost annually.)

The U.S. Health Insurance Portability and Accountability Act — more commonly known as HIPAA — guarantees all Americans copies of their medical records. However, unlike the laws that guarantee each person a copy of his or her credit report, HIPAA doesn’t guarantee free medical records. Some medical providers charge, and they can be quite expensive. Also, HIPAA protects the privacy of thieves’ medical information, which can further impede victims’ search for medical histories’ changes.¹¹

AUTOMATED PROCESSES TO DETECT ANOMALIES 

IMPLICATIONS FOR FRAUD EXAMINERS

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to FraudMagazine@ACFE.com.