But doctor, I still have both feet! Remedial problems faced by victims of medical identity theft.

I. INTRODUCTION When Lind Weaver starting receiving collections demands for a foot amputation she never had, she assumed it was a clerical error.1 Unfortunately, the operation had been performed on someone pretending to be Weaver, causing Weaver's medical history to become entangled in the thief's.2 Media reports about identity theft show Weaver's experience is far from unique. For example, a Chicago man was arrested after using his friend's identity to obtain $350,000 worth of cardiovascular surgery at a local hospital.3 Hackers broke into the medical records of thousands of University of California students.4 A staff member left a laptop containing records of patients of a local AIDS clinic on Boston public transportation.5 Further opportunities for thieves lurk in every unshredded envelope, online transaction or credit card purchase. Breaches of financial data, often the result of hacking or theft or loss of sensitive computer equipment are routine fixtures of the news cycle.6 Consumers are encouraged to check their credit scores and monitor their accounts for any suspicious activity.7 In sum, we are being bombarded with warnings about the threat of identity theft. This media saturation focuses on the misuse of a data linked to a victim's identity to gain access to consumer credit tools such as credit cards and loans. Yet, medical identity theft, what Lind Weaver experienced, lurks in the background. Medical identity theft consists of the misuse of personal information to gain access to healthcare.8 A 2006 report by the Federal Trade Commission (FTC) estimated that there were at least 250,000 victims of medical identity theft for the period 2001-2006." The actual number is likely even higher.10 In a more recent survey of identity theft victims assisted in 2008 by the non-profit Identity Theft Resource Center, two thirds of the 100 victims surveyed reported being billed for medical services they did not receive.11 To some extent the emergence of medical identity theft is not surprising. First, healthcare providers are the largest compilers of personal data12 and are just as vulnerable to attack as the financial industry.13 Second, the high cost of health care creates an incentive to steal the identity of someone with insurance in order to obtain needed health care services, to further drug-seeking behavior, or to defraud third-party payers.14 In addition to financial harms such as being billed for services not rendered, medical identity theft can introduce inaccuracies into a victim's medical records, causing a cascade of clinical, insurance, and even reputational harms. Unlike victims of financial identity theft who can use the credit reporting system to recover from financial identity theft, victims of medical identity theft lack similar statutory resources, and there are few available private remedies. Further, structural and regulatory features of the healthcare system, including those governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA)15 make it extremely difficult for victims to discover and remedy the damage caused to their medical records by an identity thief. To put it simply, "[tjhere is no single place individuals can go to locate and correct inaccurate medical information."16 Current regulatory focus on increasing privacy and security through technological improvement, such as the HITECH Act amendments to HIPAA and the push to develop electronic health records (EHRs) do nothing to address victims' access problems to their own medical records. Further there is no private incentive to develop resources for victims. Finally, new regulations requiring health care providers to prevent fraud and new data breach notification rules do not resolve the basic problem of access. This note will argue that, given the fragmented nature of the healthcare market, a new federal regulatory initiative modeled on what is available to victims of financial identity theft is necessary to give victims an effective means of protecting the integrity of their personal health records. …