HIPAA actually makes it harder for patients to fix victimized records.

Imagine you’re in a car accident, taken unconscious to the emergency room. Physicians there look up your electronic health record -- and give you a blood transfusion. But it’s the wrong blood type, making you even sicker.

Why the error? A thief’s medical history has been inserted into your records.

More than a quarter of a million U.S. residents are victims of medical identity theft each year, the New York Times reported recently. Many patients don’t find out about it for months or years. Health care providers and insurers are beginning to take precautions, such as asking people for additional forms of ID and screening for spikes in claims.

What Is Medical Identity Theft?

Medical identity theft comes in many forms, the Times reported. Here are some of the ways criminals do it:

            • Using a person’s name and Social Security number to receive emergency medical services, which many hospitals must provide whether or not a person has insurance.

            • A thief may impersonate someone using his insurance member ID and group policy number found to get anything from a routine physical to major surgery. Many doctors and hospitals do not ask for identification beyond insurance information.

            • Insiders steal medical information at a clinic or hospital. Thieves download vital personal insurance data and related information from the operation’s computerized medical records, then sell it on the black market or use it to make fraudulent billing claims.

In 2003, the Identity Theft Resource Center, found that 13 percent of respondents said that: “Using my information, someone obtained medical services.” The 2004 follow up found that 12 victims, or 23 percent of respondents, experienced this.

Most cases involve organized crime rings that get rich using medical information to file false claims with insurance companies, WebMD reported. Criminals even set up fake clinics, or buy real ones, as a cover, World Privacy Forum’s Pam Dixon told WebMD.

And now that medical records are going electronic, stealing them is easier. “Before, you couldn’t steal a million paper files from a hospital. Now, you can walk out with a million digital files on your iPod,” Dixon said.

Patients Harmed Financially, Medically

Medical ID thieves take insurance companies to the cleaners. But such theft directly hurts patients, too. An insurance customer might learn of fraud only when trying to make a legitimate claim, and the insurance company informs him he’s met his lifetime cap on benefits.

Or victims may discover erroneous information in their medical files during a doctor or hospital visit. “Borrowed” medical records may contain vital information like blood type, allergies, prescription drug use, or a history of disease that is just plain wrong. In an emergency, doctors could treat you based on this erroneous information.

With medical identity theft, there are few protections for consumers. Fraudulent charges can remain unpaid and unresolved for years, permanently damaging a patient’s credit rating. Under the Health Insurance Portability and Accountability Act, privacy rules can work against legitimate patients. Once a patient’s medical information is intermingled with someone else’s, privacy laws dictate that the thief’s medical information must be kept confidential, too. 

“Medical identity theft is deeply entrenched in the healthcare system,” Dixon wrote in the World Privacy Forum’s 2003 report, “Medical Identity Theft: The Information Crime That Can Kill You.”  

Dixon recommended expansion of rights for medical-identity-theft victims, such as:

            • Expand patients’ rights to correct errors in medical histories to allow them to remove false information from their files;

            • Patients should have the right to receive a free copy of their medical file; and