Click here and sign up for our Elder Care Tips monthly newsletter and receive 10 free recipes!
Identity thieves prey on patients' medical records
Updated 5/7/2008 11:31 AM
By Julie Appleby, USA TODAY
Doctors' offices, clinics and hospitals are a fruitful hunting ground for identity thieves, who are using increasingly sophisticated methods to steal patient information, lawyers and privacy experts say.
Recent disclosures that hospital workers snooped into the medical files of Maria Shriver, Britney Spears and George Clooney highlight the vulnerability of patients to the merely curious and the criminal.
Legal experts say lawbreakers use medical information to get credit card numbers, drain bank accounts or falsely bill Medicare and other insurers.
RECORDS: It's often hard for patients to get even their own files
Marc Rotenberg, executive director of the Electronic Privacy Information Center, says attention on identity theft has focused on how easily criminals can get financial records. "Now we're moving into an era where many of those same problems occur with medical records," he says.
Hospitals and other medical settings often encrypt data and take other steps to protect privacy, but "people are acting with increasing sophistication to steal information," says Stuart Gerson, a Washington, D.C.-based attorney who represents health care firms.
Those intent on crime "attempt to gain the assistance of insiders" and use new techniques to capture data from files, even those that are encrypted, he says.
Pam Dixon, executive director of the World Privacy Forum, an advocacy group, says "sophisticated crime rings" often can make more money by stealing medical identities than by going after individuals' bank accounts or credit cards. "If you steal someone's medical identity, then multiply that by 100 or 1,000" other thefts "and do fake billings, you can make hundreds of thousands, if not millions, of dollars," Dixon says.
In Florida last year, a front-desk coordinator at the Cleveland Clinic was convicted of identity theft, computer fraud and other charges after downloading patient information and selling it to a cousin, who submitted more than $2.5 million in phony bills to Medicare.
In April, a former New York-Presbyterian Hospital employee was arrested for participating in an identity theft scheme in which he allegedly accessed nearly 50,000 patient records over two years.
False information from fake billings can end up in patients' medical files — and creditors might seek payment from the patients. Until the creditors call, patients might not know their medical information has been accessed.
In a recent survey of 263 health care providers, 13% said their facility had experienced a data breach. Of those, 56% said they notified the patients involved, according to the survey by HIMSS Analytics, a non-profit data analysis firm, and Kroll Fraud Solutions, which offers security-related services.
In January, California began requiring that consumers receive notice when their medical information is improperly accessed. It is only the second state, besides Arkansas, to do so, Dixon says.
Similar legislation, written by Sens. Patrick Leahy, D-Vt., and Arlen Specter, R-Pa., is being debated in Congress.
To guard against and deal with medical record theft:
•Check medical records or statements from your insurer for benefits paid under your name but not received.
•Monitor your credit report for collection notices from medical providers.
•File a police report if your information is stolen.
•Amend your records to correct misinformation.
Source: USA TODAY research
Medical Identity Theft Turns Patients Into Victims
By Michelle Andrews
U.S. News and World Report
Posted February 29, 2008
If identity thieves were to disregard your financial accounts and instead target your medical information, your first thought might well be, "Take my medical identity. Please." What nut would want your high cholesterol, trick knee, and family history of Alzheimer's? The answer is simple: one without health insurance who needs surgery or prescription drugs, or someone who sees a medical ID as the open sesame that will allow him or her to collect millions in false medical claims. These thieves don't actually want your medical ailments, of course, but by pretending to be you they can get what they're really after. Untangling the mess is hard: Unlike financial identity theft, there's no straightforward process for challenging false medical claims or correcting inaccurate medical records. For victims, the result can be thousands in unpaid charges, damaged credit, and bogus, possibly dangerous details cluttering up their medical records for years to come.
Medical identity theft currently accounts for just 3 percent of identity theft crimes, or 249,000 of the estimated 8.3 million people who had their identities lifted in 2005, according to the Federal Trade Commission. But as the push toward electronic medical records gains momentum, privacy experts worry those numbers may grow substantially. They're concerned that as doctors and hospitals switch from paper records to EMRs, as they're called, it may become easier for people to gain unauthorized access to sensitive patient information on a large scale. In addition, Microsoft, Revolution Health, and, just this week, Google have announced they're developing services that will allow consumers to to store their health information online. Consumers may not even know their records have been compromised. In January, a new law took effect in California that requires providers to let consumers know if their medical information has been "breached." But only a handful of other states spell out notification requirements regarding unauthorized release of patient medical data. In contrast, most states have so-called breach laws that address accidental disclosures of financial information; these may also apply to medical data in certain instances. This month, Democratic Reps. Ed Markey of Massachusetts and Rahm Emanuel of Illinois, with support from several privacy groups and Microsoft, introduced a bill that would strengthen safeguards protecting access to consumers' medical information and make it a federal requirement to notify patients if their healthcare data get exposed.
Brandon Reagin didn't realize someone had snatched his medical identity until his mother called to tell him he was the lead suspect in a car theft in South Carolina in 2005. The 22-year-old marine had lost his wallet more than a year earlier while celebrating with friends after completing boot camp at Parris Island, near Beaufort, S.C. After his training, he was posted to California. But in South Carolina, Reagin lived on, as an impostor used his military ID and driver's license to not only test-drive new cars and then steal them but also visit hospitals on several occasions to treat kidney stones and an injured hand, running up nearly $20,000 in medical charges. Reagin found out about the unpaid hospital bills when he asked for a credit report following the car theft. "It was horrible," he says. "And what made it worse is that no one really knew what to do when it first started happening."
Reagin got nowhere with local police, but with the help of a state senator, he finally connected with the U.S. attorney's office in South Carolina. Staff there notified the Secret Service, and Reagin's doppelgänger, a 30-something guy named Arthur Watts from a tiny Midlands town called Blythewood, was eventually arrested. Watts pleaded guilty last September to identity theft and is awaiting sentencing.
But for Reagin, now serving in Iraq, the case isn't closed. Because of the outstanding hospital bills, the state intercepted his $362 tax refund, money he has yet to see. And although the hospitals no longer dun him for the unpaid balances, he's still trying to clean up his credit. (In addition to racking up medical bills, Watts opened cellphone and other accounts in Reagin's name and stole another car.) There's another potential problem: The hospitals Watts used may have medical records in Reagin's name for treatment he never received. If he visits his family in South Carolina and needs medical attention, those records could complicate his treatment, even cause harm. And if those medical records someday become electronically linked to one big nationwide health information network, as envisioned by the Bush administration, some privacy experts worry it may be impossible to find and correct the errors once they percolate through the vast interconnected system. Others argue that the technology could actually make tracking errors easier. The reality is unclear.
JANUARY 8, 2007NEWS & INSIGHTS
Diagnosis: Identity Theft
Weaver eventually persuaded the hospital to drop the charges but in the process discovered that the mistake wasn't a simple billing error. Weaver's identity had been stolen by a fraudster who had used her personal information—her address, Social Security number, and even her insurance ID number—to have the expensive procedure performed. The nightmare didn't end there. When Weaver was hospitalized a year later for a hysterectomy, she realized the amputee's medical info was now mixed in with her own after a nurse reviewed her chart and said, "I see you have diabetes." (She doesn't.) With medical data expected to begin flowing more freely among health-care providers, Weaver now frets that if she is ever rushed to a hospital, she could receive improper care—a transfusion with the wrong type of blood, for instance, or a medicine to which she's allergic. "I now live in fear that if something ever happened to me, I could get the wrong kind of medical treatment," she says.