What to Do If You’re a Victim of Medical Identity Theft?
You found the bill, the EOB, or the denial letter — and none of it matches anything you actually did. Now what matters is order. Do things in the wrong sequence and you’ll spend months chasing your own paperwork. Here’s the order that actually works, including one escalation step almost nobody tells victims about.
Do These Three Things Today
- File a report at IdentityTheft.gov. This gets you an official FTC Identity Theft Report and a personal recovery plan built around your specific situation. Keep the report number — you’ll use it repeatedly.
- Contact every provider and insurer involved, even ones you’re not sure are affected. Tell them you suspect medical identity theft and ask them to flag your account.
- Freeze your credit with all three bureaus. It won’t touch the medical side of this, but it stops the financial side from getting worse while you sort out the rest.
Get Every Record, From Everyone
Contact each doctor, clinic, hospital, pharmacy, lab, and insurer where the thief may have used your information, and ask for copies of your records in writing. You may have to pay a small copying fee. Go through them line by line looking for visits, prescriptions, or procedures you don’t recognize — that’s the map of what actually happened.
Some providers wrongly believe releasing your own records would violate the thief’s privacy. It wouldn’t. HIPAA gives you the right to your own record regardless of whose information got mixed into it.
The Escalation Path Most Guides Leave Out
Here’s the piece almost every article on this topic skips. If a provider refuses to give you your records, or simply doesn’t respond within 30 days of your written request, you’re not stuck. The FTC’s own guidance tells victims to file a complaint directly with the U.S. Department of Health and Human Services’ Office for Civil Rights at hhs.gov/ocr. OCR enforces HIPAA, and a provider that stonewalls a records request is violating it.
Most people don’t know this option exists, so they either give up or keep calling the same front desk that already ignored them twice. File the OCR complaint instead. It puts the provider’s compliance department, not just their receptionist, on notice.
Correct the Record — In Writing, With Proof You Sent It
Once you’ve found the errors, send each provider a written correction request. Include a copy of the record showing the mistake and a short explanation of why it’s wrong. Send it certified mail with a return receipt, and keep the receipt in your file. If a provider disagrees with your correction and won’t fix it, you can still request that a statement of your dispute be added to the record — so anyone reading it later sees your side too.
Stop It From Reaching Your Credit
Once you have your FTC Identity Theft Report, the Fair Credit Reporting Act blocks businesses from reporting the resulting debt to the credit bureaus. Send a copy of your report to any collector or credit bureau involved, along with a written request to block the fraudulent account. If something already made it onto your credit report before you filed, dispute it directly with the bureau, citing your Identity Theft Report as backup.
If Medicare or Medicaid Is Involved
Report it separately — an FTC report doesn’t automatically reach Medicare’s fraud system. Call 1-800-MEDICARE, or your local Senior Medicare Patrol at 1-877-808-2468, in addition to everything above. This is the channel that actually flags your claims history so a thief can’t keep billing under your number.
If Your Coverage Was Denied Because of the Fraud
If your insurer denies a claim, says you’ve hit a benefit limit you haven’t reached, or cancels coverage because of a fraudulent diagnosis in your file, you’re not out of options. Every health plan has an internal appeals process, and depending on your plan type, an external review after that. Ask your plan for its appeals procedure in writing, and include your FTC report and your corrected records as evidence the original claim wasn’t yours.
Keep a Paper Trail — This Is the Part People Skip
Every call, every letter, every name. Write down the date, who you spoke to, and what they said, every single time. Send anything important by certified mail so you have proof it arrived. This isn’t busywork — if this ends up in front of a HIPAA complaint reviewer, an insurance appeals board, or an attorney, the difference between “I called them” and a dated log with a certified mail receipt is the difference between a fast resolution and a stalled one.
When to Call an Attorney
Most cases resolve through the steps above. Consider talking to an attorney if a provider ignores an OCR complaint, if fraudulent debt keeps reappearing on your credit after an FCRA block, or if you can trace the theft back to a company’s data breach — in which case you may have a separate claim entirely, similar to the legal theory behind data-breach identity theft lawsuits against major companies. If the theft was severe enough to involve real financial harm, it may also qualify as a felony under state law, which matters for any police report you file.
For the full breakdown of how this happens and the warning signs to watch for, see our guide on what medical identity theft is. If you haven’t been victimized yet, our guide on preventing medical identity theft covers two federal tools — a free annual MIB report and a HIPAA accounting of disclosures — that can catch this before it reaches this stage.
What to Do If You’re a Victim — Frequently Asked Questions
Do I have to pay a medical bill I believe is from identity theft?
Don’t ignore it, but dispute it in writing before paying. Tell the provider or collector you believe it’s the result of identity theft and request they investigate before pursuing payment.
How long does the correction process take?
Providers generally have 30 days to respond to a records request, with one possible 30-day extension. Fixing every affected record across multiple providers can take a few months.
What if a provider ignores my correction letter entirely?
Follow up in writing once, then escalate. If the issue involves refused record access, file a complaint with HHS Office for Civil Rights. If it involves an unfixed billing error, escalate to your state’s attorney general consumer protection office.
Can debt collectors keep contacting me while I dispute the debt?
Send them your FTC Identity Theft Report in writing and request they stop reporting the debt under the FCRA. Keep records of every contact in case they don’t comply.
Do I need to file a police report?
Not always, but some FCRA protections require an official Identity Theft Report, and a police report strengthens it if you can identify a specific incident or suspect.
What if I already paid a fraudulent bill before realizing it was theft?
You can still dispute it and request a refund from the provider, and you should still file your FTC report and correct your records — paying it doesn’t waive your right to fix the underlying fraud.
Can I sue the provider or insurer involved?
Sometimes, particularly if their negligence — like a data breach or failure to verify identity — caused the theft. A consumer rights or data privacy attorney can evaluate whether your specific facts support a claim.
Sources Used in This Article
- Federal Trade Commission — “What To Know About Medical Identity Theft,” consumer.ftc.gov
- Federal Trade Commission — “Medical Identity Theft: What to Know, What to Do” (consumer brochure, August 2019), bulkorder.ftc.gov
- Federal Trade Commission — “Medical Identity Theft: FAQs for Health Care Providers and Health Plans,” ftc.gov
- U.S. Department of Health and Human Services, Office for Civil Rights — HIPAA complaint process, hhs.gov/ocr
Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against Federal Trade Commission consumer guidance and HHS Office for Civil Rights procedures, as of September 16, 2026. Last Updated: September 16, 2026.
This article is for informational purposes only and does not constitute legal or medical advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney or healthcare provider.