Medical Identity Theft, Warning Signs Rights Fixing Records

Medical identity theft happens when someone uses your name, Social Security number, health insurance information or Medicare number to get medical care, prescription drugs or equipment, or to submit insurance claims without your permission. You may find out through a bill for a hospital visit you never made, an insurance statement for a prescription you never filled, or a medical record that lists someone else’s diagnosis.

The damage goes beyond money. If another person’s information becomes mixed with yours, it can lead to wrong diagnoses, incorrect medication or allergy histories, denied coverage and used-up benefits. A bad entry in your chart can affect care in a real emergency.

If you suspect it: contact the provider and insurer, request your records, dispute fraudulent claims in writing, ask to amend inaccurate records, and report at IdentityTheft.gov. A credit freeze helps with some financial fraud but does not stop someone from using stolen health insurance information.

Medical Identity Theft: Quick Facts

Question	Answer
What is it?	Using your identity or insurance information to get care, prescriptions, equipment or insurance payments
Common warning signs	Unfamiliar bills, EOBs, prescriptions, providers or collection notices
First steps	Save evidence, contact the provider and insurer, request records, dispute in writing
Right to your records (HIPAA access)	Providers and plans generally must respond within 30 days, with one 30-day extension
Right to correct records (HIPAA amendment)	Generally 60 days to act, with one 30-day extension
Right to a list of disclosures	Generally 60 days to respond, with one 30-day extension
HIPAA complaint deadline	Generally within 180 days of when you knew of the violation
Medicare fraud reporting	1-800-MEDICARE (1-800-633-4227)
Is every unexplained bill identity theft?	No. Billing errors, duplicate claims and patient-matching mistakes also happen

What Counts as Medical Identity Theft?

It occurs when someone uses your personal or insurance information without authorization to get healthcare services, medication or equipment, or to make false insurance claims. A thief does not need your physical card. Information from a scam, a stolen document or a data breach may be enough.

1. Fraudulent medical bills

Someone receives treatment using your identity and the bill goes to you or your plan. Before assuming fraud, check whether the provider’s name or billing company changed, whether a covered family member received care, and whether it is a delayed or duplicate claim.

2. Fraudulent insurance claims

Someone uses your member ID to bill for services, tests or equipment. The first sign is often an Explanation of Benefits (EOB), a summary of a processed claim that is not a bill. An unfamiliar EOB may be fraud or a provider billing error, so ask the insurer to investigate.

3. Incorrect medical records

An imposter may receive care under your name, or a provider may combine another patient’s information with yours. Future clinicians may rely on those entries when choosing tests and treatments.

4. Prescription and pharmacy fraud

Someone may use your information to fill prescriptions or request refills. An unfamiliar record can cause a pharmacy or insurer to question a legitimate prescription. If a controlled medication is involved, notify the prescriber and pharmacy quickly. Correction of entries in state prescription monitoring programs depends on state law.

5. Medicare or Medicaid fraud

Someone may bill a government program using your number for services or supplies you never got. Review your Medicare Summary Notice or plan EOB.

6. Child medical identity theft

A child’s information can also be used to get care or insurance benefits. See How Child Identity Theft Occurs.

How to Detect Medical Identity Theft

Do not wait for a collection notice. Check statements and records regularly. Warning signs include:

A bill for care you never received. Check the date, provider, place and procedure.

An unfamiliar claim on an EOB for tests, visits, equipment or a hospital stay.
A prescription you never filled. Ask the pharmacy and plan which pharmacy processed it.
A notice that benefits are used up when you have not received that care.
A collection letter for an unfamiliar medical debt.
A diagnosis, allergy or blood type you do not recognize in your patient portal or records.
An unfamiliar provider or pharmacy on your claims history.
Account changes, such as password-reset messages, new contact details or an insurance card you did not request.
Denied coverage or higher premiums because databases show a condition that is not yours.
A data breach notice from a provider, insurer or pharmacy.

No single sign proves identity theft. Identify the specific entry, find out how it was created, and preserve evidence while the organizations investigate.

What to Do First

Step 1: Save the evidence

Keep copies of the bill, EOB, collection notice or record that revealed the problem. Note the date you found it, account or claim number, provider and amount. Keep a log of calls, names, reference numbers and letters you send.

Step 2: Contact the provider and the insurer

Use the phone number on your insurance card or an official website. Tell each that you suspect medical identity theft, and ask them to flag your account, investigate and explain how to file a formal dispute. Ask the insurer whether it can issue a replacement member ID, which depends on the plan.

Step 3: Request your records and a list of disclosures

Under the HIPAA Privacy Rule (45 C.F.R. § 164.524), you generally have the right to see and get copies of your medical and billing records from covered providers and plans. The organization generally has 30 days to respond, with one 30-day extension if it explains the delay in writing. You can be charged a reasonable cost-based fee.

Also ask for an accounting of disclosures (45 C.F.R. § 164.528), which lists certain disclosures of your health information and can help show where false information traveled.

A provider may say it cannot release a record because it contains another person’s information. Ask the privacy officer to review and to give you the parts that are yours. If access is wrongly refused, you can complain to the HHS Office for Civil Rights.

There is no central file, so ask every provider, lab, pharmacy and plan involved.

Step 4: File an FTC identity theft report

Go to IdentityTheft.gov for a report and a recovery plan. Keep it, since you will need it when disputing bills, claims and credit entries. For a wider look at reporting options, see Where Is the Best Place to Report Identity Theft?

Step 5: Protect your financial identity too

Get your credit reports through AnnualCreditReport.com, look for medical collection accounts, and dispute fraud with the credit bureau and the company that reported it. You can also freeze your credit to stop new accounts. A freeze does not stop misuse of your health insurance number, so continue investigating the medical side separately. If your SSN was misused, read What Is Social Security Identity Theft?

How to Dispute a Fraudulent Medical Bill

A bill can be wrong because of identity theft, a coding error, a duplicate claim or an insurer mistake. Say exactly what is wrong.

Ask for an itemized bill with dates, procedure codes, provider information, payments and adjustments, and compare it to your own history.

Dispute in writing to the provider’s billing office. Include your name and account number, the date and amount, a clear statement that you did not receive the service or authorize it, copies of supporting records, and a request for an investigation, a corrected bill and written results. Send copies, keep originals, and use a delivery method with proof of receipt. Do not ignore the bill. If it goes to collections, dispute it there as well.

If a debt collector contacts you

The Fair Debt Collection Practices Act (15 U.S.C. § 1692g) and the CFPB’s Regulation F (12 C.F.R. Part 1006) let you dispute a debt in writing. If a covered debt collector receives your written dispute within the validation period, generally 30 days after you receive the validation notice, it generally must stop collecting until it verifies the debt. These rules apply to third-party collectors, not necessarily to a provider collecting its own debt. You may still dispute after the period, but acting early gives more protection. Keep the notice and a copy of your dispute.

Medical debt and your credit reports

The three credit bureaus have voluntary policies on medical collections, which have included removing paid medical collections, waiting a year before reporting unpaid ones, and not reporting small balances. A CFPB rule that would have banned medical debt from credit reports was struck down by a federal court in 2025, so these policies are not guaranteed by federal law and can change. Where a collection arises from identity theft, you can ask the bureau to block it under the FCRA by sending an identity theft report (15 U.S.C. § 1681c-2). Confirm current rules before relying on them.

How to Dispute a Fraudulent Insurance Claim

Dispute it with the insurer, not just the provider. Call member services and ask for the fraud or Special Investigations Unit. Ask the insurer to:

Identify the provider, date, procedure or drug, and the amount billed.
Explain how the claim was submitted and what records support it.
Investigate whether your identity or member number was used without authorization.
Reverse or retract a fraudulent claim.
Correct your member record and explain the effect on your deductible, out-of-pocket maximum and benefit limits.
Give you the findings in writing.

Send a written dispute with the EOB, any provider correspondence and your FTC report.

Appeal rights

If the insurer will not correct the claim or denies your legitimate care because the thief used up your benefits, use the plan’s internal appeal. Most health plans must offer internal appeals and, for many denials, an independent external review under the Affordable Care Act (42 U.S.C. § 300gg-19). Employer plans covered by ERISA generally give at least 180 days to appeal (29 C.F.R. § 2560.503-1). For Medicare, the Medicare Summary Notice explains the appeal steps, and a first-level appeal generally must be filed within 120 days. State insurance departments also take complaints. Deadlines vary, so read your notice.

A billing dispute is not a record correction. Fixing the money side of a claim does not fix the medical chart. Follow up separately on both.

How to Correct Medical Records Under HIPAA

The HIPAA Privacy Rule gives you the right to ask a covered provider or plan to amend protected health information in its designated record set (45 C.F.R. § 164.526).

Step 1: Identify each incorrect entry

List the dates, providers, record numbers, diagnoses, medications or procedures that are wrong.

Step 2: Send a formal amendment request

Contact the medical records department or privacy officer and ask whether a form is required. Explain that the entry appears to result from medical identity theft or a patient mix-up. Enclose your FTC report, relevant insurance records and any proof you were elsewhere. Ask the provider to flag the entries during review and to notify others who received the wrong information.

Step 3: Know the deadline

The provider or plan generally must act within 60 days, with one extension of up to 30 days if it gives written notice within the first 60 days explaining the delay and the new date. (The 30-day period belongs to record access requests, not amendments.)

Step 4: Know when a provider can refuse

HIPAA does not guarantee deletion. A provider may deny an amendment if it finds the record accurate and complete, if it did not create the record, or if the information is not in the designated record set. Providers often keep the original and add a correction. If it agrees, it must amend the record and make reasonable efforts to inform persons who received the wrong information and those you identify.

Step 5: Challenge a denial

A denial must be in writing. You can submit a statement of disagreement, which the provider must link to the disputed entry and include in future disclosures of it, and you can ask that your request and the denial be included. You can also file a complaint with the provider’s privacy officer and with HHS OCR.

Sample amendment request

Subject: Request to Amend Medical Records Due to Suspected Identity Theft

I am requesting an amendment to my records under the HIPAA Privacy Rule. My records appear to contain inaccurate information about services, prescriptions or treatment that I did not receive.

Disputed entry: [date of service or entry]; [provider or facility]; [record or claim reference]; [why it is inaccurate].

Please investigate the suspected identity theft or record mix-up, amend the inaccurate information where appropriate, and tell me in writing whether my request is accepted or denied. If it is denied, please explain how I can submit a statement of disagreement. I have enclosed supporting documents. Please confirm receipt and give me a reference number.

Sincerely, [Your name and contact information]

Use the provider’s secure submission method. Do not email your full SSN through unverified channels.

Prescription and Pharmacy Fraud

Contact the pharmacy for the fill date, drug and prescriber.
Tell the named prescriber that you did not authorize or receive the prescription.
Dispute the claim with your insurer or pharmacy benefit manager.
Ask the pharmacy and clinic to correct their records.
Ask whether the fill was reported to a state prescription monitoring program and how to review an inaccurate entry under your state’s rules.

Tell your treating clinician about any entry that could affect current care. Do not stop or change prescribed medication because of a suspicious entry. Ask a clinician to review it.

Laws That Protect You

This is general information, not legal advice.

HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164). Gives you rights to access your records (§ 164.524), amend them (§ 164.526), get an accounting of disclosures (§ 164.528), and complain (§ 164.530(d) and § 160.306).
HIPAA Breach Notification Rule (45 C.F.R. § 164.404). Covered entities generally must notify affected individuals within 60 days of discovering a breach of unsecured health information.
Federal identity theft crimes (18 U.S.C. §§ 1028 and 1028A). Using someone’s identification to commit a crime can be a federal offense, with mandatory added prison time for aggravated identity theft.
Health care fraud (18 U.S.C. §§ 1347 and 1035). Knowingly defrauding a health benefit program, or making false statements in health care matters, is a federal crime.
Wrongful disclosure of health information (42 U.S.C. § 1320d-6). Knowingly obtaining or disclosing identifiable health information in violation of HIPAA is a federal crime.
Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.). Lets you dispute inaccurate credit information (§§ 1681i and 1681s-2), place freezes and fraud alerts (§ 1681c-1), and request blocking of identity theft information (§ 1681c-2).
Fair Debt Collection Practices Act (15 U.S.C. § 1692 et seq.). Limits collector conduct and gives dispute and verification rights.
Affordable Care Act appeal rights (42 U.S.C. § 300gg-19) and ERISA claims rules (29 C.F.R. § 2560.503-1). Govern internal appeals and external review of denied claims.
State laws. Many states have medical privacy and record correction laws, identity theft statutes and insurance fraud rules. California’s Confidentiality of Medical Information Act is one example.

Where to Report Medical Identity Theft

Different agencies handle different parts. Reporting once does not fix every record.

Where	When
IdentityTheft.gov (FTC)	To report identity theft and get a recovery plan
Your provider and insurer	To dispute claims and correct records
HHS Office for Civil Rights	If a HIPAA-covered organization violated your privacy or access or amendment rights; generally file within 180 days
Medicare (1-800-633-4227) or Senior Medicare Patrol	Suspicious Medicare claims
HHS Office of Inspector General (1-800-447-8477)	Suspected fraud in federal health programs
State Medicaid Fraud Control Unit	Suspected Medicaid fraud
Consumer Financial Protection Bureau	Debt collection and credit reporting problems
Your state insurance department	Disputes over health insurance practices
State attorney general or police	Suspected criminal conduct. See How to Report Identity Theft to Police, and When You Actually Need To

An HHS complaint does not replace telling the provider or insurer which entry you dispute.

How to Prevent Medical Identity Theft

Protect your insurance and Medicare numbers like financial information. Do not post your card or lend your coverage.
Question requests for your SSN. Ask whether another identifier or the last four digits will do.
Use secure patient portals with unique passwords and multi-factor authentication.
Read your EOBs and Medicare notices and compare them with your visits and receipts.
Protect paperwork. Shred statements and remove labels from empty prescription bottles.
Be wary of unsolicited calls and messages claiming to be an insurer, Medicare or a provider. Call back on a number you verify.
Check your credit reports for unfamiliar medical collections.
Act on breach notices right away.

For a deeper checklist, see Best Ways To Prevent Medical Identity Theft (2026).

Frequently Asked Questions

Can medical identity theft affect my health, not just my credit?

Yes. Another person’s diagnoses, medications or allergies in your chart can lead to wrong treatment. Ask the provider to investigate and correct the record, and tell your clinician promptly if it could affect care.

Am I responsible for a medical bill caused by identity theft?

Dispute services you did not receive and ask the provider and insurer to investigate. Do not ignore the bill, and dispute any collection in writing.

Can I force a hospital to delete a fraudulent diagnosis?

Not necessarily. HIPAA gives you a right to request an amendment, not to demand erasure. A provider may keep the original and add a correction, and if it refuses you can submit a statement of disagreement.

How long does it take to correct medical records?

Generally 60 days to act on an amendment request, plus one possible 30-day extension. Insurance claims, pharmacy records and collection accounts may take their own time.

What deadline applies to getting copies of my records?

Generally 30 days, with one 30-day extension if the organization explains the delay in writing.

What if the insurer says the claim is valid?

Ask for its reasoning and records, then appeal with evidence. If the chart is also wrong, file an amendment request. A state insurance department or consumer attorney may help.

Does freezing my credit stop medical identity theft?

No. It limits new credit accounts but does not stop use of your insurance information for care or claims.

Will medical debt from identity theft hurt my credit?

Possibly. Medical collections can appear on credit reports, though the bureaus have policies limiting some of them. Dispute fraudulent entries and ask for a block using your identity theft report.

Should I file a police report?

You can, especially if you have evidence of a suspect or transaction. Start with IdentityTheft.gov. Some organizations may ask for a report.

Can a child’s medical identity be stolen?

Yes. A parent should contact the insurer and providers, request records and dispute false claims. See our guide on child identity theft.

Will an FTC report automatically remove fraudulent debt?

No. It documents the theft, but you must dispute each bill, claim and credit entry with the organization responsible.

Sources

FTC: What To Know About Medical Identity Theft – https://consumer.ftc.gov/articles/what-know-about-medical-identity-theft
FTC: IdentityTheft.gov – https://www.identitytheft.gov
HHS: Your Medical Records and HIPAA Rights – https://www.hhs.gov/hipaa/for-individuals/medical-records/index.html
HHS OCR: Filing a Health Information Privacy Complaint – https://www.hhs.gov/hipaa/filing-a-complaint/index.html
Medicare: Reporting Medicare Fraud and Abuse – https://www.medicare.gov/basics/reporting-medicare-fraud-and-abuse
HHS Office of Inspector General: Report Fraud – https://oig.hhs.gov/fraud/report-fraud/
CFPB: How to dispute an error on your credit report – https://www.consumerfinance.gov/ask-cfpb/how-do-i-dispute-an-error-on-my-credit-report-en-314/
CFPB: Disputing a debt – https://www.consumerfinance.gov/ask-cfpb/can-a-debt-collector-still-collect-a-debt-after-ive-disputed-it-en-338/
Annual Credit Report – https://www.annualcreditreport.com
Federal rules: 45 C.F.R. Parts 160 and 164; 18 U.S.C. §§ 1028, 1028A, 1035, 1347; 42 U.S.C. §§ 1320d-6, 300gg-19; 15 U.S.C. §§ 1681 et seq., 1692 et seq.; 12 C.F.R. Part 1006; 29 C.F.R. § 2560.503-1 – https://www.law.cornell.edu

Disclaimer: This article is general information only and not legal, medical or financial advice. AllAboutLawyer.com is a consumer legal information website, not a law firm. HIPAA rights, insurance dispute procedures and debt collection protections depend on the record, the organization and the circumstances.