The nightmare of medical identity theft

Financial identity theft is bad enough. But lesser-known medical identity theft could be even worse. This eye-opening report from the World Privacy Forum says it often involves false entries in medical files that could haunt a person for ages and even lead to getting the wrong medical treatment.

Medical identity fraud has already been reported. One victim's record was altered with the wrong blood type. Another person's file was changed to include numerous psychiatric sessions that didn't occur and false diagnoses of severe depression. A Pennsylvania man discovered that an imposter used his identity at five different hospitals to receive more than $100,000 worth of medical treatment. At each hospital, the imposter created medical histories in the victim's name.

And in these cases, cleaning up the mess is even harder than it is for financial identity theft victims because medical files are decentralized (read: hard to correct) and HIPAA is weak.

Excerpts from the report:

What is medical identity theft? Medical identity theft occurs when someone uses a person's name and sometimes other parts of their identity -- such as insurance information -- without the person's knowledge or consent to obtain medical services or goods, or uses the person's identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim's name.

Medical identity theft typically leaves a trail of falsified information in medical records that can plague victims' medical and financial lives for years.

Victims may find it more difficult to recover from medical identity theft as medical errors are disseminated and redisseminated through computer networks and other medical information-sharing pathways.

Victims of medical identity theft may receive the wrong medical treatment, find their health insurance exhausted, and could become uninsurable for both life and health insurance coverage. They may fail physical exams for employment due to the presence of diseases in their health record that do not belong to them.

Medical identity theft can be difficult to uncover. It is typically well-hidden in large electronic payment systems and in widely dispersed databases and medical files. Medical identity theft does not always reveal itself through traditional financial avenues. Individuals who regularly check their credit reports, for example, may see no indication on the credit report that the problem exists, even if it is a significant one.

The people who commit medical identity theft can be sophisticated professionals who are adept at making sure victims do not detect the crime -- ever. Victims may only discover it many years later through an unhappy circumstance such as the discovery of an incorrect blood type on a medical chart, or the loss of a job opportunity after a background check reveals one or more diagnoses and diseases that didn't belong to them.

Victims do not have clear pathways for recourse and recovery. The Fair Credit Reporting Act allows for greater recourse for victims of financial identity theft than the HIPAA health privacy rule provides for victims of medical identity theft.

For example, victims do not have the legal right to demand correction of their medical information that was not created by the provider or insurer currently maintaining or using the information. This circularity can make it impossible for a medical identity theft victim to erase false entries from a medical or insurance record.

Individuals' rights to correct errors in their medical histories and files need to be expanded to allow them to remove false information from their files.

----------
Related:
Health-privacy coalition seeks HIPAA review of VA
Computers Stolen in Ohio with 72,000 Medicaid Subscribers' Personal Info (via Martin McKeay's blog)
A mock trial examines the legal issues of a hypothetical case where a disgruntled employee stole a laptop containing sensitive patient information from an orthopedic hospital (Wisconsin Technology Network).