About Medical Identity Theft and Health Information Breaches

Q. What is medical identity theft?

A. Medical identity theft is when someone:

  • Uses a person's name and sometimes other personal information — such as insurance information — without the person's knowledge or consent to obtain medical services or goods, or
  • Uses the person's identity information to make false claims for health care services or goods.


Medical identity theft often results in wrong entries being put into medical records and can result in the creation of fake medical records in the victim's name.

Q. What are the dangers of medical identity theft?

A. The most serious problem faced by victims is having someone else’s health information in their medical record or health insurance records. To provide safe health care treatment, a health care provider needs correct health information for the individual being treated. A common problem faced by victims of medical identity theft is that they are charged for health care services that they did not get.

Q. How do I know if I am a victim of medical identity theft?

A. There are several ways you can tell that you may be a victim.

Explanation of Benefits. One way to know if you are a victim of identity theft is to look at any Explanation of Benefits sent by Community Health Plan or another insurance company.

An Explanation of Benefits is a list of all the health care services provided under your health plan account number. It is sent to you after you or a family member gets health care services. If you do not get an Explanation of Benefits after going to the doctor, you may want to call your insurance company.

Look for the following risks in your Explanation of Benefits and your medical records:

  • Office visits you did not make.
  • Health care services you did not get.
  • Medical equipment you did not buy or get.
  • Health information such as health care problems you do not have and medicines you do not take.


HIPAA Rights—Know if You’re a Victim. Another way to know if you are a victim of identity theft is to use your rights under the Health Insurance Portability and Accountability Act or HIPAA for short. HIPAA is a federal law that protects health records and medical privacy.

There are two rights under HIPAA you can use to figure out if you are a victim of medical identity theft:

  • Right to Access. The right to see or get a copy of your medical records from your health care provider and/or health insurance company.
  • Right to an Accounting of Disclosures. The right to get a list of the times your health care providers or health insurance company shared your personal information with another person or organization.


Q. How can I protect myself if I am a victim of medical identity theft?

A. There are several ways to protect yourself if you are a victim.

HIPAA Rights—Protect Yourself. One way to protect yourself after becoming a victim of medical identity theft is to use your rights under the Health Insurance Portability and Accountability Act or HIPAA for short. HIPAA is a federal law that protects health records and medical privacy.

There are three rights under HIPAA you can use to protect yourself:


If you find wrong information in the records you requested from your health care providers or your health insurance company, you will want to ask them to correct the information in your file.

Change Personal Identification Numbers. If you suspect that you are a victim of medical identity theft, you may want to tell your health insurance company and medical providers to change your member or patient identification numbers.

File a Police Report. You may also want to file a police report and keep a copy of the report for your records. A police report is very helpful when you are working with health care providers, health insurance companies, and creditors to correct your health records and credit file.

Online Resources: