The Justice Department recently charged 455 individuals in its annual National Health Care Fraud Takedown, with alleged false claims totaling more than $6.5 billion. The cases, which involved an increased number of state Medicaid units participating than in previous years, included charges against 90 doctors and other licensed medical professionals. Prosecutors maintain that the charges must still be proven in court.
Many of the schemes involved the misuse of individuals' medical identities. Prosecutors also filed aggravated identity theft charges across numerous states. In one instance, a Virginia mental health company's co-owner allegedly provided homeless individuals with hotel stays in exchange for using their Medicaid numbers. The company then allegedly billed Medicaid for crisis services that the patients never received.
For the individuals whose identities were exploited, the legal case may eventually conclude. However, rectifying their medical records can be a more arduous process. When another person's medical treatment is recorded under someone else's name, it can introduce inaccuracies into their health records and deplete insurance benefits that may be needed later. This is a more complex issue to resolve than canceling a compromised credit card.
Medical identity theft occurs when a person's name, Social Security number, health insurance account number, or Medicare number is used by another individual to receive medical care, obtain prescriptions, or purchase medical equipment. The Federal Trade Commission (FTC) states that when medical care is billed under a victim's name, the identity thief's health information can become intertwined with the victim's. The FTC warns that such mixed records can impact the quality of care a person receives and the benefits they can utilize. A stranger's blood type, drug allergy, diagnosis, or prescription might appear in the records a physician consults before providing treatment.
Data breaches at healthcare facilities and insurance companies provide criminals with the sensitive records necessary to perpetrate these fraudulent activities. While not every data breach results in fraud, stolen insurance and Medicare numbers, Social Security numbers, and medical records can remain valuable long after a breach notification is issued. For example, NYC Health + Hospitals reported a security incident where an intruder copied files potentially containing health insurance and other personal information, affecting approximately 1.8 million current and former patients and employees.
Once this personal health information enters the criminal marketplace, it can be resold to individuals who then use it to submit fraudulent claims. Experts advise treating health insurance and Medicare numbers with the same caution as credit card numbers. This includes securing enrollment forms, benefit statements, and prescription labels, and shredding them before disposal. When asked for a Social Security number at a doctor's office, individuals should inquire if an alternative identifier or only the last four digits can be used. Scammers may also contact people via calls, texts, or emails offering free services like braces or genetic tests in exchange for Medicare numbers, which are then used for fraudulent billing.
For Medicare beneficiaries, regularly logging into a secure Medicare account to review claims and checking Medicare Summary Notices for unrecognized services or equipment is crucial. Discrepancies should be reported immediately by calling 1-800-MEDICARE.
Unlike financial fraud, which typically triggers credit monitoring alerts, medical identity theft often bypasses these systems. Victims should be vigilant for bills or Explanation of Benefits (EOB) statements for services they did not receive, calls from debt collectors for medical debts they do not owe, unrecognized medical collections on credit reports, or notices from insurers indicating benefit limits have been reached. A Medicare Summary Notice listing unreceived services is also a red flag.
If a fraudulent medical claim is suspected, prompt action is necessary. Contact the insurer or Medicare directly using the number on the card, gather details about the claim including provider name, date of service, and service description, and request medical or billing records in writing from the provider. Report the error to the insurer's fraud department and file an identity theft report at IdentityTheft.gov. Keeping detailed records of all related documents is essential.
Correcting medical records can be a lengthy process. Under HIPAA, healthcare providers generally have 30 to 60 days to amend inaccurate or incomplete information in a patient's record after a written request. However, providers may refuse to release records containing a stranger's information due to privacy concerns. In such cases, individuals can seek assistance from the provider's privacy officer or file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
Furthermore, a credit freeze is ineffective against medical identity theft because it does not prevent claims filed under an existing insurance number. Identity theft protection services can monitor various online sources for exposed personal and medical information, as well as track credit bureaus for medical collections. Such services can also offer assistance in resolving fraud issues.