Source: https://www.worldprivacyforum.org/2006/05/report-medical-identity-theft-the-information-crime-that-can-kill-you/
Timestamp: 2019-04-23 20:04:23+00:00

Document:
The report Medical Identity Theft: The Information Crime that Can Kill You was published May 3, 2006.
Report authors: Pam Dixon, edited by Bob Gellman.
This report finds that medical identity theft is a crime that can cause great harm to its victims. False and erroneous entries in victim medical files and other harms make it imperative to understand this crime better and learn more about it and how it works. This report is of historic significance, as it coined the term medical identity theft and outlines the harms and operations of this crime and its impacts on patients for the first time.
This report discusses the issue of medical identity theft and outlines how it can cause great harm to its victims. The report finds that one of the significant harms a victim may experience is a false entry made to his or her medical history due to the activities of an imposter. Erroneous information in health files can lead and has led to a number of negative consequences for victims. Victims do not have the same recourse and help for recovery from medical identity theft as do victims of financial identity theft. This report analyzes statistics in health care and identity theft, and estimates that approximately a quarter million to a half million individuals have been victims of this crime. The report presents the specific harms of medical identity theft based on analysis of cases, and explains why the falsification of information in victims’ medical files is one of the crime’s core harms. The report reviews the planned National Health Information Network and why the network may facilitate this crime. The report explains the reasons why medical identity theft is challenging to detect, and discusses the specific ways consumers have discovered they were victims of this crime.
Individuals should have the right to receive one free copy of their medical file.
how and where it is occurring, and how it can be detected and prevented.
protect health, and prevent losses.
comprehensive risk assessments focused on preventing medical identity theft while protecting patient privacy.
MEDICAL IDENTITY THEFT BY THE NUMBERS: HOW PREVALENT IS THIS PROBLEM?
WHO COMMITS MEDICAL IDENTITY THEFT?
WHY CAN’T VICTIMS CORRECT THEIR MEDICAL RECORDS?
Medical identity theft is a crime that can cause great harm to its victims. Yet despite the profound risk it carries, it is the least studied and most poorly documented of the cluster of identity theft crimes.  It is also the most difficult to fix after the fact, because victims have limited rights and recourses. Medical identity theft typically leaves a trail of falsified information in medical records that can plague victims’ medical and financial lives for years.
Medical identity theft occurs when someone uses a person’s name and sometimes other parts of their identity – such as insurance information — without the person’s knowledge or consent to obtain medical services or goods, or uses the person’s identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim’s name.
As the health care system transitions from paper-based to electronic, this crime may become easier to commit. Victims may find it more difficult to recover from medical identity theft as medical errors are disseminated and redisseminated through computer networks and other medical information-sharing pathways. The time has come for substantive attention to and understanding of this crime.
But unlike purely financial forms of identity theft, medical identity theft may also harm its victims by creating false entries in their health records at hospitals, doctors’ offices, pharmacies, and insurance companies. Sometimes the changes are put in files intentionally; sometimes the changes are secondary consequences of the theft. The changes made to victims’ medical files and histories can remain for years, and may not ever be corrected or even discovered.
Victims of medical identity theft may receive the wrong medical treatment, find their health insurance exhausted, and could become uninsurable for both life and health insurance coverage. They may fail physical exams for employment due to the presence of diseases in their health record that do not belong to them. It is nightmarish that patients’ medical records may include information about individuals who have stolen their identities for the purposes of using the victims’ insurance or for dodging medical bills. However, evidence exists that this is already occurring.
Another non-patient of the same Boston psychiatrist discovered that his medical record had been falsified to include numerous psychiatric sessions that did not occur and false diagnoses of severe depression.  He discovered the false diagnoses after he had applied for employment.
New York Attorney General Eliot Spitzer specifically discussed medical records and medical privacy issues and gave advice about protection of these records in 2005 identity theft education materials.  Some insurers have begun mitigation efforts by educating their beneficiaries about the problem. Blue Cross/Blue Shield’s web site, for example, warns about identity theft in the medical context. Its site advises consumers that identity theft “using another person’s health insurance card or identification to obtain health care or other services or to impersonate that individual,  is now among commonly seen scams.
Medical identity theft can be difficult to uncover. It is typically well-hidden in large electronic payment systems and in widely dispersed databases and medical files. Medical identity theft does not always reveal itself through traditional financial avenues. Individuals who regularly check their credit reports, for example, may see no indication on the credit report that the problem exists, even if it is a significant one.
The people who commit medical identity theft can be sophisticated professionals who are adept at making sure victims do not detect the crime — ever. Victims may only discover it many years later through an unhappy circumstance such as the discovery of an incorrect blood type on a medical chart, or the loss of a job opportunity after a background check reveals one or more diagnoses and diseases that didn’t belong to them.
Because of the difficulty of detection, the potential exists for this crime to be happening substantially more frequently than anyone has documented to date.
Financial difficulties and medical errors introduced into victims’ files because of this crime are bad enough. But those who learn that they are victims of medical identity theft have yet another discovery waiting for them: medical identity theft often leaves its victims without substantive recourse or clear pathways to follow for help. Recovery for victims of medical identity may be difficult or impossible because of the lack of enforceable rights, and because of the dispersed and often hidden nature of medical records.
But victims of medical identity theft do not have a similar complete set of rights or redresses. Victims of medical identity theft do not have the blanket right to correct errors in their medical files. In some cases, victims have not been allowed to even see the compromised files. And victims of medical identity theft do not have the right to prevent health care providers, medical clearinghouses, or insurers from reporting and re-reporting information that has resulted from identity theft.
Further complicating the challenges of medical identity theft is the push to make patient medical records electronic and place patient information in a National Health Information Network (NHIN).  Pilot projects to develop four different NHIN prototypes are already underway in at least 12 cities.  The digitizing of health records in general and the national network is a process related to an overall transition from paper records to electronic records.
Currently, the mantra is that digitization of patient records will improve health care, reduce fraud, reduce medical errors, and save lives. But this does not account for the challenging reality of medical identity theft and the substantial problems it can introduce into such a system. Many other questions and problems with medical information networks also remain unexplored. While a transition from a paper system to an electronic system is inevitable, the transition must be done correctly and with an acknowledgement of risks such as those medical identity introduces, in mind. Digitized patient records and the National Health Information Network in particular create two significant problems in the context of medical identity theft.
• First, the National Health Information Network may make individuals more vulnerable to medical identity theft by making personally identifiable health information more accessible to criminals who have already learned how to work inside the health care system.  Digitized information is much more portable and lends itself to rapid transmission. These are usually seen as benefits. But in the hands of an identity thief, these benefits may become liabilities.
• Second, the National Health Information Network as currently conceived may perpetuate and transmit medical errors in ways that have potentially negative consequences. Errors in medical charts and documents arising from medical identity theft could, if left uncorrected as they are by and large today, percolate through a nationwide system. Without more attention, patients who have incorrect files in one city will find their same incorrect files available to all doctors and insurers that use the health network. The same errors may also affect the factual accuracy and quality of medical research and public health interventions based on that data.
The implementation of new technologies in health care need not be a negative development for patient privacy and security. Conversely, neither is the implementation of new technologies a solution that will automatically resolve all problems with medical identity theft. This is especially true when the nature and scope of medical identity theft have not been rigorously studied or acknowledged as a problem. The digitization and wider availability of patient health records without adequate understanding and risk assessment could pose many difficulties.
Today, victims of medical identity theft are falling through several existing gaps in consumer and medical arenas. The medical world seldom focuses on financial identity theft, with few knowing the complexities of how to help victims with error reporting problems and so on. Financial identity theft experts are seldom experts in the federal health privacy rule known as HIPAA  or in the complexities of the medical care treatment and payment systems. The Federal Trade Commission (FTC), which has studied financial identity theft, is not responsible for addressing medical issues. That falls to the Department of Health and Human Services, which has not published focused studies or guidance about medical identity theft in particular. The HHS Office of Inspector General investigates cases of generalized health care fraud and abuse, which may only touch the issue tangentially. Statistics on health care fraud are plentiful, but they are not currently sufficient to document the incidence of medical identity theft.
These gaps, which to date have been inadvertent and unintentional, must be closed. Close attention must be paid to the problem of medical identity theft and its victims by Federal and State governments, by private insurers, by researchers, by consumer groups, by patients-rights groups, law enforcement, and other stakeholders who can help create a body of factual knowledge, a pathway of clear, meaningful and effective recourse, and prevention and detection techniques.
Medical identity theft victims need clearer pathways of recourse. The laws that were intended to protect patient medical privacy need to be updated to reflect the reality of medical identity theft. These same laws need to be strengthened to give patients the broader rights they need to correct their medical files, wherever those files may be. Rights that patients currently have under the law to see who has accessed their medical files must be maintained and expanded.
This report presents information the World Privacy Forum could factually substantiate about medical identity theft, and discusses the reasons why it is essential that this crime be better documented, quantified, and understood.
It is remarkable that medical identity theft has not been recognized as a separate and distinct crime. Despite the lack of comprehensive statistics, it is nonetheless possible to assess the prevalence of medical identity theft by looking more intensively at two crimes of which it is a subset: health care fraud and identity theft.
• Interviews: The World Privacy Forum interviewed stakeholders, case workers, victims, members of law enforcement, insurers, hospitals and other health care providers, fraud units, prosecutors, HIPAA experts, identity theft experts, fraud experts, health care fraud experts in academia, and others. The goal was to get a “trench-level” view of this subject.
• Prosecutions: A selection of cases of medical identity theft that have come to light through civil or criminal prosecutions were analyzed for this report.
• Three bodies of statistics were reviewed for this report: statistics regarding medical identity theft as found through hotline and survey data, general health care fraud, and general statistics regarding identity theft. Fraud within government health care systems has been studied at length, creating a robust statistical literature, including reports on Medicare/Medicaid fraud and other health care fraud from the Department of Defense, HHS Office of Inspector General, and the Government Accountability Office (GAO). Identity theft material reviewed for this report includes publications from government agencies, in particular the FTC, as well as the GAO and privately issued reports from Javelin and others.
• The World Privacy Forum submitted Freedom of Information Act requests for information at government agencies to acquire relevant information. Some of these requests are still pending, and this report may be updated from time to time as new information becomes available.
Finally, a literature review was conducted looking for reports and studies by relevant associations such as the National Health Care Anti-Fraud Association and others. In some cases, interviews with report authors or the associations were conducted.
A thorough effort was made to uncover relevant material, but this report does not claim to be exhaustive.
• The World Privacy Forum has found unambiguous substantiation for the presence of medical identity theft as a separate and distinct crime from other forms of identity theft.
• In the cases the World Privacy Forum has analyzed, medical identity theft is a serious information crime that has had substantial consequences on patient well- being, often affects the accuracy of patient medical records, and can impact victims’ finances. The crime also entails financial losses to insurers and health care providers. While these losses can be large, the focus of this investigation has been on the effects on individuals.
• There have been 19,428 complaints regarding medical identity theft to the Federal Trade Commission since January 1, 1992, the earliest date the FTC began recording such complaints.
o Data from government identity theft hotlines and from identity theft surveys containing questions about medical use of data point with some consistency toward a range of approximately 1.5 to 2 percent for the rate of medically- related identity theft in comparison with other forms of identity theft.
• This crime is under-researched and under-documented. It is probable that more cases exist.
• False entries in medical records are a hallmark of medical identity theft. Victims have had their medical records altered without their permission, consent, and often knowledge. False entries can range from small ones to substantial changes that may introduce medical errors that could be threatening to patient health. Numerous harms to victims can result from false entries in medical records and files.
• False entries made to medical files can be difficult for many victims to find unless they have been notified through some other “crime flag” such as a bill for services they did not receive, or a collections notice from a hospital.
• Victims do not have clear pathways for recourse and recovery. The Fair Credit Reporting Act allows for greater recourse for victims of financial identity theft than the HIPAA health privacy rule provides for victims of medical identity theft. For example, victims do not have the legal right to demand correction of their medical information that was not created by the provider or insurer currently maintaining or using the information. This circularity can make it impossible for a medical identity theft victim to erase false entries from a medical or insurance record. This is true even when false entries were put in the record during the commission of a crime, such as health care fraud or medical identity theft.
• Available evidence suggests that medical identity theft is a crime that is not self- revealing, and is challenging for the average victim to uncover.
• All levels of the medical system may be involved in medical identity theft. Doctors, clinics, billing specialists, nurses, and other members of the medical profession have taken part in this crime, as have criminals who work in administrative positions inside the health care system to collect information and to carry out their crimes.
• A physician can be the victim of identity theft in the physician’s professional capacity. This type of identity theft is often the starting point for propagating incorrect information about patients, and it is often seen when professional crime rings are involved. Thieves can steal a doctor’s name, license number, forge a signature, falsify patient records, and forge prescriptions. The problems that health care providers encounter when their professional identities are stolen is beyond the scope of this report.
• Notification of medical data breaches to consumers has the potential to save lives, and protect health.
• Typical studies of data breach victims may not detect medical identity theft, because these studies cannot typically examine changes in the medical files of victims. Victims of medical identity theft may, but do not always have, fraudulent activity noted in their credit reports.
• The circulation of uncorrected errors in digital and paper medical systems may have long-range negative impacts on the viability and accuracy of medical research conducted using patient medical records. This includes medical records from hospitals and from government and state-run programs.
• In at least two documented cases of medical identity theft, hospitals are alleged to have refused to give victims copies of their own health records, or the health records recorded under their name and Social Security Number.
• The proposed National Health Information Network may increase risks to patient safety, privacy, and the security of patient data. There is no indication at this time that the network is being constructed with a specific acknowledgement of medical identity theft.
• An analysis of cases reveals that victims who discover that they are the subject of medical identity theft learn about it in several primary ways: through a collection notice sent to them or in some cases found on a credit report, receipt of someone else’s bill, notification by law enforcement or an insurance company, denial of insurance coverage or notification that insurance has reached lifetime caps, or irregularities seen on explanations of medical benefit notices. Less common discovery methods included being notified by a health care provider and noticing discrepancies in the file during medical treatment.
• The issue of medical identity theft needs immediate, thoughtful attention by a range of agencies and bodies, both public and private. It must be studied, quantified, and it must be accurately and vigorously taken into account in public and private systems in a meaningful way.
• Patients need expanded rights to obtain an accounting of disclosures of health information.  Expanded maintenance of disclosure histories is essential to tracking the flow of incorrect and fraudulent information inserted into medical files by criminals. The Office of Civil Rights at the Department of Health and Human Services should review the HIPAA health privacy rule and propose changes to expand the rights of medical identity theft victims.
• Patients must have the right to correct and delete errors in their medical record arising from fraud and medical identity theft. All iterations of a patient record must be able to be found and corrected. If this issue is not resolved, patient health and medical research can suffer as a result. The Office of Civil Rights at the Department of Health and Human Services should amend the HIPAA health privacy rule to expand patient rights to amend health records.
• A clear and effective pathway of recourse needs to be developed for victims of medical identity theft that is at least equal to the protections that victims of financial identity theft have. The Office of Civil Rights at the Department of Health and Human Services should work together with the Federal Trade Commission, State Attorneys General, and identity theft victims’ organizations to identify and implement solutions for victims.
• Health insurers should send each beneficiary a free annual listing of all claims that were paid and to whom. One of the few effective means of proactively discovering improper use of personal information is for consumers to contact their insurers and ask for a report of all claims paid to their accounts. In this way, patients can learn of changed billing addresses, changed phone numbers, and phony charges that they may otherwise not have seen or noticed.
• Notification to patients is crucial for any data breach that involves patient names and insurance numbers, and the notification should be given promptly. Sometimes the only indication that a medical inaccuracy exists in a file may be found as a result of the database breach notice. Post breach-studies of medical database breaches may have not been configured in a way that will actually find the incidences of medical identity theft, as they do not usually have access to victims’ actual medical files.
• The next comprehensive risk assessment of federal computer systems and computer networks with health information should expressly recognize medical identity theft as a specific threat and should determine the risk level of those threats and corresponding vulnerabilities.
• NHIN prototypes, as they become available for testing, need formal risk assessments for medical identity theft. Given the insider nature of this crime, any digitization of medical files in electronic health records and any proposed NHIN needs to be built with an understanding that some doctors, nurses, clinics, and hospitals – as well as their administrative staffs — may be the bad actors. This poses significant security hurdles, but if these issues are not taken into account now, then the NHIN and other electronic systems can become a means to potentially perpetuate medical errors across the county and facilitate medical identity theft.
Medical identity theft occurs when someone uses a person’s name and sometimes other parts of their identity – such as insurance information or Social Security Number– without the victim’s knowledge or consent to obtain medical services or goods, or when someone uses the person’s identity to obtain money by falsifying claims for medical services and falsifying medical records to support those claims.
Medical identity theft is a crime that has many operational models. For the purposes of separating medical identity from the plethora of health care fraud and identity theft crimes, this report considers one of the essential hallmarks of medical identity theft to be the use of identity information that results in the falsification of the victims’ medical charts with information related directly to the crime, not the actual conditions the real patient has.
Medical identity theft can be seen as a subset of health care fraud. But it is not just that, because the crime can also have financial and other life-consequences. Medical identity theft therefore also needs to be understood in its context as an information crime, that is, as a crime involving theft or abuse of identity information, and as a crime that makes individuals victims in addition to the providers and insurers who may directly bear financial losses.
Operationally, based on known cases, a single thief can steal one or more identities. A doctor can steal patients’ identities, as can a clinic or other health provider. It is not unusual in medical identity theft to find cases where entire crime rings purchase hundreds of patient names and insurance information then alter medical files and diagnoses to make millions of dollars in a few months, then move on to new victims.
Medical identity theft can be detected, but typically not by traditional reporting methods associated with financial identity theft. For example, victims may never have their credit cards or credit score affected by this crime. But they may be turned down for jobs, and may potentially have serious medical complications from the crime. For example, victims who have erroneous information put into their health record due to an imposter’s activity in their name could receive improper treatment if the errors go undetected by the victim.
In the identity theft literature, there is a debate over what parts of the crime are “identity fraud,” and what parts are “identity theft.”  There is not currently a consensus on this definitional issue, and this lack of clarity has impacted a number of survey instruments that quantify identity theft. For example, some do not include credit card fraud in the definition of identity theft. Others do. What most people can agree on is that when a person takes over the identity information of another and uses it without consent, that can be called identity theft.
This report is a first attempt to define this subset of health care fraud and identity theft. As statistics become available, definitions may sharpen and we may gain a better understanding of the crime.
Some health care fraud cases involve the alteration of patient information, but are not medical identity theft. For example, a doctor who wants to cover up a medical error may alter patient charts. This is not medical identity theft. The hypothetical doctor falsified records, but did not take over or abuse the identity information of the patient, although the doctor surely abused the patient.
Some identity theft cases occur in medical settings, but are not medical identity theft. For example, if a hospital worker steals patient credit cards or other financially-related identity information and goes on a shopping spree at a mall, that is not medical identity theft but more traditional financial identity theft. In this situation, the medical identity of the person was not impacted, even though their financial information was used.
A razor-thin line exists between some cases of health care fraud. This narrow line can be seen in comparing the following two cases.
• In the case where numerous victims in Southern California were allegedly given medical tests by non-physicians and had false diagnoses inserted into their medical files by a sophisticated, organized network of medical imaging companies, the individuals actively recruited Medicare beneficiaries with the promise of free transportation, food, and medical care. The alleged perpetrators, posing as doctors and health professionals, obtained the victim’s personal information and photocopied the victim’s Medicare cards.  In this case, the victims’ information was taken, and the victims did not know their information was going to be used for further billing for visits they never made. The lack of knowledge and consent here is the key point.
There are unambiguous indications that medical identity exists, and clear indications that this crime is a substantial problem based on the presence of statistical frequency, the presence of prosecutions, and anecdotal evidence from investigators in the field and other members of law enforcement. Statistically, medical identity theft can be viewed both as a subset of identity theft, and as a subset of health care fraud. These two information areas can help gauge the broad trend lines of medical identity theft.
The statistics of health care fraud are not currently configured in such a way to allow even an educated guess as to what percent of health care fraud is comprised by medical identity theft. However, general identity theft surveys have included questions about medical identity theft, and as such, give more indication as to what percent of identity crimes are comprised by medical identity theft.
The following discussion of the available statistical numbers following looks first at statistics that specifically inform about medical identity theft. A background discussion of overall identity theft statistics and overall health care fraud statistics is included at the end of this section.
There is a small set of statistics that points to medical identity theft. These statistics, when analyzed in conjunction with the larger universe of health care fraud statistics, suggest that medical identity theft, while reported, is likely to be underreported, and that what is seen may be barely the tip of the iceberg.
The Federal Trade Commission has recorded that a total of 19,428 individuals have filed complaints specifically concerning medical identity theft at the Federal Trade Commission from January 1, 1992 to April 12, 2006 though its Consumer Sentinel database.31 For the FTC, which is an agency that does not handle medical issues, nineteen thousand-plus complaints is a high number.
The number of total people identifying themselves as victims of identity theft has risen each year from 86,168 victims in 2001 to 255,565 victims in 2005.
The number of people who had their Government benefits misused each has risen steadily from .4 percent of all victims in 2001 to 1.5 percent of all victims in 2005.
The number of people who experienced medical identity theft rose from 1.6 percent in 2001 to 1.8 percent in 2005.
The FTC 2003 Identity Theft Survey identified a broad segment of individuals, who when surveyed said that they had “discovered that their personal information had been misused to open new accounts, to obtain new loans, or to commit theft, fraud, or other crimes. (“New Accounts & Other Frauds” ID Theft).”  This group comprised 1.5 percent of all identity theft victims., or almost 3.25 million individuals, according to the FTC. The FTC includes gaining medical treatment in this category. This number indicates that an unknown portion of approximately 3.25 million American adults had their information used to get medical care .
Regarding existing accounts, the FTC found that 2 percent of victims had had their insurance accounts taken over. Again, the type of insurance was not differentiated to be either auto or medical, so this statistic is not highly articulated regarding medical identity theft.
The Identity Theft Resource Center, in its 2003 survey “Identity Theft: The Aftermath 2003” found that 13 percent of respondents said that: “Using my information, someone obtained medical services.” The 2004 follow up survey found that 12 victims, or 23 percent of respondents experienced this. Both surveys also found that despite the right to correct records for financial identity theft victims, 70 in 2004 and 66% in 2003 said that there was still negative information in their records.35 197 respondents completed the 2004 survey, 180 completed the survey in 2003. The respondent pool was comprised of victims of identity theft.
Though there are not national survey statistics about medical identity theft prosecutions, the California Attorney General’s Office, the New York Attorney General’s Office, and the Pennsylvania Attorney General’s office have prosecuted large cases of medical identity theft, where there was a clear intersection between health care fraud and identity theft. As a trend indicator, these prosecutions indicate at the very least the presence of a trend, if not an uptick. In California and New York, the cases involved large, complex, organized schemes involving the theft of many identities.
It is not possible to draw clear, sharp conclusions from this body of statistics. However, these statistics are useful and suggest a few broad conclusions.
Medical identity theft has been repeatedly documented as a facet of identity theft crimes.
Medical identity theft appears to be increasing, based on the numbers available.
Data from hotlines and census-style identity theft surveys with questions about medical use of data point with some consistency toward a number in the approximate area of 1.5 to 2 percent for rate of medically-related identity theft in comparison with other forms.
This estimate is highly uncertain because of the lack of comprehensive or firm data. Hopefully, in several years this measurement will be more precisely narrowed by additional studies on medical identity theft.
Though it is not yet a mature body of research, identity theft has begun to acquire the beginnings of some statistical information regarding its scope, mechanics, and incidence.
The Department of Justice identity theft survey, released in April 2006, found that an estimated 3.6 million households (approximately 3 percent of all households in the nation) had learned they were the victim of at least one type of identity theft during a six-month period in 2004.  The survey instrument for this study differed from the Javelin and FTC studies.
Fraud measurement is a challenging measurement environment, and the statistics that exist do not attempt to differentiate medical identity theft as a subset. This report could spend considerable pages discussing statistics detailing claims error rate and money recovered from fraud, and more. But the more useful approach at this point is to gauge how large the overall problem is, and where the trend lines lie.
• The Office of the Inspector General of Health and Human Services TIPS line accepts calls about health care fraud and abuse. In 1998, that line received 76,000 calls. In 1999, the TIPS line received approximately 300,000 calls.  Private insurers also maintain fraud tips lines, which then pass those tips to their internal investigation units.
Victims of medical identity theft may suffer financial pressures and losses. Victims have to clean up not just their medical files, but also their financial files as a result.
In the case of a Colorado victim who had his medical identity stolen by a man who received multiple surgeries in his name, two years later he is struggling to keep his cell phone bill paid. The victim did not have insurance, and has lost property and a business due to his medical identity theft.
This case is the best-documented case of this kind of harm. However, many victims of medical identity theft may have similar issues, they just haven’t learned about them yet.
This is true. After falsified information is entered into a patient file, that information is in that file typically for good. Most health care providers, upon learning of a mistake in the file will correct the file. But not all will.
Physicians may experience theft of their professional identity in association with either the commission of medical identity theft, or for other health care fraud purposes. This is an area that will need to be watched carefully for any increases. It is unknown what kind of professional education is available to physicians about this issue. This report does not consider the specific challenges physicians encounter in this situation.
If an individual is a victim of medical identity theft and his or her records have been altered by a physician or another individuals, those records that have been altered may be subpoenaed for a criminal or civil case against that individual. The records can be sealed by the court, but the medical history still gets floated to more parties than a trusted health care provider.
The FTC 2003 survey found that identity theft victims spent an average of 30 hours cleaning up and recovering from the misuse of their identifying information. It is unknown how many hours it will take for medical identity theft victims to clean up after the crime, but evidence suggests that it may take more time because of the difficulty in amending medical records and the time it takes to follow up with insurance companies.
Medical identity theft is a crime that hides itself well. It is a form of health care fraud, which, like other kinds of white-collar fraud, is not a self-revealing crime.  There is no way today to quantify or even guess at the percentage of victims who actually discover that their medical identities have been used fraudulently.
Statistics from the FTC address one aspect of this issue. The 2003 FTC Identity Theft Survey found that 52 percent of victims of financial identity theft discovered the misuse of their personal information “by monitoring the activity in their accounts.” This included examining monthly statements from banks and credit card issuers. The World Privacy Forum did find instances of medical identity theft victims who had “crossover impact” from perpetrators who also opened credit cards in their name, or who ran up large hospital bills that went to collections. These victims may see unusual bank or credit card activity.
But the kinds of fraudulent activity that prosecutions have documented suggest that many victims of medical identity theft will not have any unusual bank or credit card activity to alert them of the problem. As a result, victims of this crime should realistically not depend only on traditional “red flags” to alert them to trouble.
Based on cases the World Privacy Forum has studied, following are the primary ways victims have discovered medical identity theft.
• An acquaintance of the Birmingham victim stole his expired temporary drivers’ license and used it to receive emergency medical treatment in his name at several hospitals. Months later, the victim received a letter from an attorney demanding payment for an anesthesia group. The victim in this case was able to clear his name because an investigative reporter from a TV station helped him break through hospital red tape. The hospital was apparently reluctant to release the medical file to the victim. But the reporter was able to convince the hospital to compare a medical x-ray of the perpetrator’s and the victim’s right hand – which were markedly different, and thus cleared the victim’s name. The victim said his imposter’s activities added up to more than $10,000 in medical bills.
Consumers whose medical bills go to collections and whose identity information is used to open multiple accounts will see that activity on credit reports. Based on consumer complaints made to the FTC regarding medical identity theft, many of those victims were alerted after seeing a credit report.
However, it should be kept in mind that there are likely many more victims who simply did not find out they were victims because the criminals did not open other accounts beyond the medical accounts.
One woman who complained to the FTC stated that she received a bill for her son for medical lab fees at a hospital when her son had never been to that hospital.
These incidents illustrate why its a good idea for consumers to review all bills and notices they receive concerning medical services. If there is a less sophisticated criminal, bills can tip victims off. But this is not something victims can rely on, however. Medical identity theft can be a sophisticated crime with professional operators that typically change billing addresses so this sort of thing doesn’t happen. Because of the high level of the criminal operators, it is more likely that victims will not know that their identities are being used.
When a fraud case comes to light, victims associated with those cases may be contacted by an insurance fraud investigator for a private insurance company, or by a member of law enforcement. In one situation like this, parents of teenagers were informed that their childrens’ psychiatrist had altered their childrens’ medical files to include diagnoses of “suicidal ideation” and other serious psychological illnesses that the children did not have.
The worst-case scenario is that a victim does not learn about medical identity theft, or only learns about it during the course of a medical emergency when obvious medical discrepancies that have been introduced into the medical file by the criminal are discovered.
False entries made to the medical file is common in medical identity theft, 79 what may be less common is for victims to find out about the changes.
Medical data breaches are serious business, because there is a long and well-substantiated history of criminals using lists of patient names in medical identity theft operations.  Criminals who have broken into hospital computers and have stolen patient identities for the purpose of medical identity theft may leave no other trail for victims other than a database breach notification by the breached organization.
Medical files belonging to Oregon and Washington patients were stolen in a health system database breach in December of 2005. A Beaverton resident was quoted in The Oregonian describing a strange experience: after the breach, he received an alert from his identity theft watch service to tell him that someone was trying to reassign his phone number.  Changing and reassigning victim’s phone numbers is a trick medical identity thieves have used to keep their victims in the dark about the crime.
This man probably did not know about how organized medical identity theft rings operate; in his case, he was fortunate to receive notification. A post-breach check of victims’ credit reports will usually not reveal medical identity theft, particularly if the perpetrator is a professional, as is typical with medical identity theft. Only a proactive check of insurance claims with all relevant insurers will provide the necessary clues to victims.
Some victims discovered medical identity theft when they found mistakes on their explanations of benefits notices. Medicare, Medicaid, and private insurers send these notices. In medical identity theft, the recipients’ addresses may be changed, but when this is not the case, the explanation of benefits notices can be helpful detection tools.
The intentional submission of false claims is the core of health care fraud, and the intentional misuse of personally identifying information is the core of identity theft. Medical identity takes elements from both crimes: medical identity theft is the intentional misuse of personally identifying information to receive medical goods or services, and it usually involves the creation of false medical records, or false entries into existing medical records.
That this happens frequently is well-known among those working in the trenches of insurance fraud. Insurance fraud investigators know that identity theft frequently leads to fraudulent insurance claims. In one case, for example, a person’s insurance card was stolen and used to obtain nearly $50,000 worth of medical care.  The World Privacy Forum’s interviews with investigators from multiple jurisdictions and agencies found that the concerns about identity theft and insurance fraud are widespread.
The prosecutor’s observations were echoed by the interviews the World Privacy Forum conducted with investigators from multiple jurisdictions and agencies.
No matter why or how it happens, when victims’ medical files are altered, it can have negative impacts on their lives. Victims may not be able to get health or life insurance due to diseases they never had that were recorded fraudulently in their medical files. They may receive improper treatment at a hospital emergency room or other health provider that is life-threatening due to misinformation in the medical file.
Identity theft can be committed by individuals, doctors, nurses, lab technicians, organized crime rings, and more. This report does not primarily focus on the mechanics of how the crime occurred. However, it is important to note that medical identity theft is an “insider” crime more often than not, and frequently involves health professionals at some level. One Medicaire/Medicaid fraud investigator interviewed for this report went so far as to say that the crimes she saw always had a component of a medical professional being involved. Sometimes, even the doctors are victims of identity theft; one of the mechanisms of medical identity theft in organized crime is to use a legitimate and innocent doctors’ identity to steal patient identities.
Individuals who work in settings where there is a lot of patient data may be tempted by the quick money medical identity theft provides. The pattern here is for people who have insider access to doctor’s offices or hospitals to copy patient information and sell it, or to use that information to help provide victims for more organized medical identity theft schemes.
Financial identity theft — such as situations where a thief takes over a victim’s credit card account or uses the victim’s information to create new accounts — typically reveals itself on the victim’s credit card or in the victim’s credit report. Additionally, credit card companies and other financial institutions have sophisticated fraud detection systems that flag fraud attempts in real-time. Many people who use credit cards can identify a time that they received a phone call from a credit card company asking about “unusual activity” on their cards. As a result of these and other tools, quite often, victims of financial identity theft may discover the crime if they are paying enough attention. Currently, there are a number of mechanisms such as free credit report checks that help victims do just that.
Victims of medical identity theft may need help with recovery in the area of correcting medical files and insurance records. They may also need help in the area of correcting financial information. In the area of financial recovery, multiple excellent resources exist for consumers. But in the area of medical and insurance information correction and recovery, victims will not find nearly the same resources or availability of recourse.
Multiple high-quality resources and pathways of recourse exist for victims of financial forms of identity theft. The Federal Trade Commission has dedicates resources to this area, and offers clear, effective tips for consumers. For example, the FTC maintains a consumer identity theft information page96 < http://www.consumer.gov/idtheft/> which contains a four-step plan for recourse. Consumers have a statutory right to receive one free credit report from each of the three main credit reporting bureaus once per year.
Victims of medical identity theft may also experience in addition to the medical identity theft the full range of financial identity theft. In these cases, medical identity theft victims can use the available tools for financial identity theft victims and at the very least work to achieve recovery in that area.
The high-quality tips and resources and the rights afforded to victims of financial forms of identity theft do not extend to the medical and insurance aspects of identity theft crimes. Victims of medical identity theft may generally experience multiple difficulties in attempting to recover.
Lack of enforceable rights to correct medical records in all instances.
Lack of a government agency dedicated to help victims of medical identity theft.
Lack of enforceable rights to delete misinformation from medical records.
Lack of ability in most cases to find all instances of medical records.
Lack of information resources about the unique needs of medical identity theft victims.
This means that any medical information sent by one provider or insurer to another provider or insurer does not have to be corrected by the recipient of the information, even though that recipient is using the information to make decisions about the record subject. HIPAA does not prevent an entity covered by the law from considering a request for amendment of a records provided by a third party, but an individual cannot even use the limited force of HIPAA to compel consideration of a request for amendment.
In medical identity theft, victims can get trapped in a maze of blame-shifting and circularity. If a doctor or hospital submitted an incorrect record, the insurance companies have no requirement to correct those medical files. The doctor in some cases may correct the file, but that does not ensure that all copies of the file (for example at labs) get corrected. And in cases where doctors have committed the identity theft or were part of the theft, it is nearly an impossibility to get the records corrected after the fact.
In short, anyone who is a victim of this crime may have an extremely challenging time trying to get medical files corrected, even if there are life-threatening changes on those files. The shift from paper files to electronic files has exacerbated this problem: victims of this crime may never be able to find each and every copy of their medical file, much less get it corrected. This can be especially problematic if the file was primarily an electronic file with no paper backup and did not have adequate audit and security controls. Hospitals or other providers may refuse to show the victim the medical file that was fraudulently created by the thief, even if the file has the victim’s name on it.
In some reported cases, an individual may not be able to see the record in the first place. Hospitals or other providers have in some cases refused to show the victim the medical file that was fraudulently created by the thief, even if the file has the victim’s name on it.  The HIPAA right of access may help, but if a patient argues that the information cannot be about himself, a hospital may be unwilling to disclose the records. A patient could be stuck in a Catch-22, where the patient cannot see the record in their file because the patient claims not to be the subject of the information.
The reason for the HIPAA limitation on amendment of information provided by a third party originated with legitimate a concern that the holder of information may not have the knowledge to make a decision about the correctness of the information. However, the HIPAA limitation provides no recognition of the problem faced by medical identity theft victims.
To illustrate the sweep of the HIPAA amendment limitation, consider how the same policy would work for financial identity theft. The Fair Credit Reporting Act as amended grants access and correction rights to subjects of credit reports held by credit bureaus (“consumer reporting agencies”). All of the information found in a typical credit report comes from third parties and does not originate with the credit bureau. Thus, if the HIPAA amendment limitation applies to credit reports, a financial identity theft victim would have no ability to change a credit report. Instead, however, the FCRA imposes on the credit bureau has to conduct a reasonable reinvestigation to determine if the disputed information is inaccurate.  The FCRA establishes a procedure that defines the role of the credit bureau (and of a furnisher of information  to a credit bureau) that seeks to find a reasonable balance among all of the interests involved. HIPAA essentially washes its hand of the problem with an overly broad exemption.
From a perspective of a system with zero fraud and zero medical identity theft, this would make sense. But given the realities of these crimes, this “all records in any city” perspective means that medical errors introduced by criminals and unable to be corrected by victims will be endlessly perpetuated. Further, it is possible that a network will contain information for which no identifiable organization has responsibility to consider amendments. Everyone with access to the network may claim that someone else is responsible in order to avoid the expense and complication of handling amendments.
The HIPAA legislation and privacy rule were written at a time when medical identity theft was not foremost on the minds of policymakers. While health care fraud as a general issue was definitely on lawmakers minds (as is evidenced by the specific anti-fraud provisions in HIPAA), medical identity theft and its specific consequences were not.
One provision in HIPAA, which is called the Accounting of Disclosures,  could possibly be helpful for some victims of medical identity theft in some circumstances, but it too has exceptions that limit its utility.
The HIPAA privacy rule requires covered entities – such as a health care provider — to maintain an accounting for disclosures. An accounting contains a history of disclosures that have been made by the covered entity. The accounting is useful because it allows a covered entity to send amendments to any person who previously received information determined to be incorrect. In addition, the HIPAA accounting requirement allows a patient to ask any covered entity to provide a copy of the accounting.
While this provision might be of particular use to the victim of medical identity theft, the exceptions to the requirement render it almost useless. A covered entity is not required to maintain any accounting of disclosures for disclosures for treatment, payment, or health care operations.  This restriction may make it impossible for a patient to track the flow of medical information to and from sources that may perpetrators of identity theft.
In response to complaints about the accounting requirement, the Office of Civil Rights has publicly but unofficially stated that it is considering eliminating the accounting requirement altogether or changing it.  Eliminating the accounting requirement would be counterproductive, and would serve to ensure that consumers never found out where their health records have gone.
It is readily apparent that health care record keeping will be increasingly automated and networked in the future.  This prospect, especially the increased networking, means that the risks of improper access to and disclosure of records will increase in the future.  This report has abundantly discussed the consequences of improper access to patient medical information. The U.S. government and its agencies such as HHS must find a way to control improper uses and disclosures. A thorough accounting of disclosures is one way to accomplish that goal.
HHS officials have touted the benefits of digitized environments. One benefit of a digitized medical health care environment is that maintaining accounting is a relatively simple task provided that the capability for accounting is built into the system at the beginning and not added on later. Indeed, many automated health record systems installed today already include a capability for accounting for all uses and disclosures and not just those required by the HIPAA rule.  Health care providers should include accounting in automated systems not just because of the rule, but because it is good a record keeping policy that protects the provider as well as the patient. The federal government has operated under the Privacy Act of 1974 for many years, and no problems with accounting for health care disclosures have been reported.
A better approach would be to have a universal accounting rule covering all disclosures without any exceptions. Accounting for uses (accesses within the institution maintaining the records) would also be helpful to record subjects and to record keepers. A full, robust data accounting architecture and system should be an essential element of any National Health Information Network (NHIN). With sufficient notice, system vendors will be able to meet any accounting requirements at marginal cost.
Whether the HIPAA accounting rule was an unreasonable burden when imposed on paper or computer systems that did not already include the ability to do accounting is an open question. However, for any computerized system of health records – and certainly for any computer system established in the future and certainly for any network – accounting should be a universal requirement for all disclosures and for all internal uses as well. No exceptions to accounting should be permitted when the accounting can be accomplished automatically and inexpensively by well-designed software designed in advance to meet a requirement.
Medical identity theft brings forward pronounced security issues for the medical world, including issues related to data breaches, physical security issues, and other security issues.
Given the evidence that sophisticated criminals are working in the area of medical identity theft, it is reasonable to conclude that the data breaches targeting hospital systems with rich patient and insurance data may well lead to patient information being used without patient consent or knowledge.
Individuals must be informed directly anytime their protected health information is inappropriately accessed. If individuals are not notified of a breach, then they may not know that their medical files may be being altered by criminals in ways that may threaten their health, impact their insurability, or cause other harms. Because of a lack of studies in the area of medical identity theft, we do not know how many medical identity theft crimes go undetected. Data breach notification is one way to ensure that breach victims begin to monitor their insurance information closely.
Since 2005, some health care providers have given notice to consumers when there is a data breach involving sensitive or protected health information, depending on state laws.
For example, in January 2006, Providence Health System notified individuals of a data breach.  It is not unusual for the health care provider to follow up with a “post-breach study” of victims to determine if there has been any incidence of identity theft. Companies such as ID Analytics and others have acquired expertise in analyzing credit report activity and other indicators to make this assessment. While breach assessments have been helpful for victims of financial identity theft, the same may not necessarily hold true for victims of medical identity theft.
Medical identity theft may not always reveal itself like standard financial identity theft, and as a result, it has not always been identified in follow-up studies of data breaches of medical data. One of the questions that could be asked to begin to develop a more effective methodology for victims of identity theft would be to poll insurers to see if there are claims made in the victims’ names. This kind of polling is expensive, because the individual victims need to be interviewed as well. Victims may be the only ones who can tell if a medical service billed to an insurer in their name was really a service that they received or sought.
A number of well-intended individuals and organizations have claimed that making all health records electronic and implementing the NHIN will reduce costs, save lives, and reduce fraud. This report does not consider the cost claims of the NHIN. However, this report has considered the claims of the HHS and others that the NHIN will reduce fraud and save lives.
The NHIN will save lives because medical records for everyone will be online, and will be available everywhere.
The NHIN will save lives because there will be no more medical errors when medical records are digitized and put online.
The NHIN will reduce fraud because it will be easier to analyze records when they are in digital form.
It would be difficult to find a person who would not desire for these statements to be true. However, due to the presence of medical identity theft and other forms of fraud from within the system, these statements cannot be and are not supported by the current facts.
This statement is an excellent summary of the problem that already exists in Medicare/Medicaid, and it is a potent harbinger of what the NHIN will face.
The Office of the National Coordinator for Health Information Technology  commissioned a report to look at fraud in the NHIN. The report concluded that the NHIN could be used to reduce fraud.  One of the suggestions in the report was that data required from the NHIN for monitoring fraud and abuse must be derived from its operations and not require additional data transactions.  In light of all the studies of fraud in the already-digitized Medicare systems, this is an assertion that needs to be reevaluated. If this model is indeed incorporated, this recommendation may ensure that medical identity theft would not be caught by the system. This is something that has already been shown in the Medicare systems.
Medicare/Medicaid systems are highly digitized. That is how HHS handles more than a billion health care claims each year: the majority of those claims are auto-adjudicated. A voluminous number of excellent studies have been conducted on fraud within the electronic systems of Medicare and Medicaid. At this point, prominent researchers have concluded – based upon the factual evidence – that the electronic environment has greatly contributed to the fraud problem in those programs.  There is no reason to think that the NHIN will not be subject to these same dynamics.
A February 2006 GAO report looked at Medicare Claims Processing Systems. These are the CMS contractor-operated group of systems that are used to process Medicare claims. These processing systems include inpatient hospital care, nursing facilities, home health care, and other health care services. The GAO investigation found significant weaknesses in information security.
If the HHS systems reveal systemic weaknesses such as that which the GAO discovered, then how can another system that HHS is overseeing be substantively different?
What the authors may not have taken into consideration is that particularly in medical identity theft, comparing a fake billing record with an equally fake electronic treatment record only proves that the slick criminals lied two times. This pattern of “lying twice” is the norm in medical identity theft, and this proposal of automated checking would do nothing to prevent or even detect medical identity theft, particularly the variety that introduced life-threatening changes to health records.
Thoughtless automation is not helpful in prevention. And automation that does not have rigorous security enhancements and audit trails can introduce new challenges into the environment.
The medical environment poses unique challenges for anyone attempting to provide meaningful security against crimes such as medical identity theft. In a financial environment such as a bank, the structure and idea of defense is to erect an impermeable perimeter with a membrane that only the right people (such as legitimate account holders) can get through – using such tools as two –factor authentication and so on. Auditing tools and protocols can strictly control and track insider access.
The security issues go further and deeper, though, than just display of data. Medical information has to be moved across software and hardware, and sent off to multiple third parties such as insurers, labs, and so forth, thus infinitely making more complex the security issues. These profound security issues, which have no simple or easy or even a perfect answer, must be seriously and rigorously considered in the context of medical identity theft. To do any less is to jeopardize patient safety and health, and ultimately, the integrity of medical research based on patient data.
One of the most challenging issues in a medical environment is to physically secure data. In a provider environment such as a hospital, where a few seconds or minutes may mean the difference between life and death for a patient, the emphasis is correctly on speed and ease of access to information. And therein lies the extraordinary challenge of securing patient data in the health care environment.
How does an organization or provider go about meeting health and safety goals while meeting security goals that also impact health and safety? These two issues are at odds, and to date there have not been mature enough solutions that fully meet both needs. In even the most rigorous, responsible environment, there will be a tension. In environments where there or a lack of attention to security issues, various types of disasters ensue.
Based on the known cases of medical identity theft and health care fraud, many medical identity theft cases have an insider aspect to them. This is true in the private and in the public sector.
Of all the security issues raised by medical identity theft as a whole, other than the harm to victims and to the medical system , the insider nature of the crime is likely going to be the most intransigent to correct. While a bank may use internal audit trails to log and monitor insider access, in a medical environment that depends on a high amount of interaction between people, the same kinds of controls are not likely to be as effective.
Risk management and anti-fraud experts have not been visibly included as stakeholders in the NHIN process. Robert Charette is the chair of the ISO/IEEE Standard on systems and software engineering risk management, and is the president of a company that specializes in enterprise risk management. As an expert who understands the risk of the proposed NHIN, he wrote a thoughtful commentary expressing his frustration with the lack of a clear, systemic planning effort or vision for finding, anticipating, and mitigating risks in electronic health care systems.
“What disturbs me most is that I don’t see any comprehensive risk management plan for this effort, nor do I see much in the way of a desire to define one. As anyone who has been involved in large-scale endeavors, managing the risks involved from a total enterprise perspective is absolutely vital to achieving success. If the NHIN is so critical to the nation, if it will radically transform health care in this country, shouldn’t there be at least some systemic risk management plan with the risks defined, prioritized and where possible, mitigated?
Charette is correct on this point. Going further, it is reasonable to say that there has been a lot of sales pitches for the NHIN and electronic health records, but there have not been reality checks such as those Charette is wisely bringing forward.
Currently, sharp, clear numerators for medical identity theft do not exist. There is too much that is not known because it has not been studied. In order to develop adequate and effective prevention and detection of this crime, its incidence, prevalence, and so forth will need to be quantified.
Currently, some providers are checking a passport or drivers’ license at points of entry to the healthcare system, such as at doctor’s offices and hospital emergency rooms. This will catch the most desperate and least professional thieves, but it will do nothing about the fraud that occurs because a crime ring has stolen a dozen doctors’ identities, hundreds of identities belonging to the doctors’ patient rosters, and is systematically billing and changing medical files without ever stepping foot in the health care provider’s office or seeing a single patient.
Closely monitor any “Explanation of Benefits” sent by an public or private health insurer. If anything appears wrong, raise questions with the insurer or the provider involved. Do not assume that things are okay just because you don’t owe money.
Once a year, pro-actively request a listing of benefits paid in your name by any health insurer that might have made payments on your behalf.
Request annually (or more often if there is a specific cause for concern) an accounting of disclosures from health care providers and health insurers.
Request a full copy of current medical files from each health care provider.
If a healthcare provider, for example, a hospital, refuses to release medical files that are in your name, file an appeal under HIPAA at the hospital. File a complaint with the Office of Civil Rights at the federal Department of Health and Human Services if you are not satisfied. Consider seeking assistance from state health departments, fraud investigators elected representatives, or lawyers if you believe that the denial of access may be covering medical identity theft.
If you discover your medical or insurance records contain false information, work to amend those records. If you find information that is not about you or that bears no relationship to treatment that you did not receive, demand that the false information be removed entirely from the record.
The World Privacy Forum will publish on its web site a set of detailed consumer draft letters to help victims find and correct their records.
Medical identity theft is occurring right now. Victims are being harmed right now. Victims are experiencing a disturbing lack of recourse, lack of redress, and inability to recover from the crime due to structural, systemic problems built into the system.
There are not clear numerators for this crime, and in general, it appears that it is just now that the health care provider community is beginning to take some small preventive steps such as checking identification. However, this will not be enough to stop medical identity theft. This is a crime that is often committed by people who know they can make a lot of money from patients and the health care system, and these individuals are often running sophisticated schemes that are difficult to detect.
It is crucial to see the problem of medical identity theft clearly. This will take research and serious studies by both the government and the private sector. Survey instruments need to be designed anew, and need to include questions that will cull out and differentiate medical identity theft as a separate, unique crime so as to begin to better grasp its movements and characteristics.
Consumer education programs for victims of financial identity theft are well-refined; medical identity theft victims are in need of this same kind of refined information that is focused on the problems unique to medical identity theft, such as problems with medical files and amending records at insurers.
Some promising predictive technologies are in process now for health care fraud, and experts such as Malcolm Sparrow have created greater understanding of how to measure fraud. This learning needs to be applied to any iteration of the NHIN. To date, the NHIN has not been well-defined, and it may be over promising on what it can deliver. Going forward, the NHIN planning must include thoughtful and meaningful participation of fraud experts, identity theft experts, technology and security experts who do not have a financial stake in the outcome, medical experts, privacy experts, and most importantly, people who are patients and who have been victims of this crime.
The victims who have been impacted by medical identity theft have to date been largely ignored, despite the serious consequences and harms they must face and deal with. It is now time to work diligently to create new pathways of help and recourse for these victims, who deserve to be heard and helped.
Pam Dixon, Executive Director, World Privacy Forum.
Malcolm K. Sparrow generously suggested the broad outline for this report. His comments about useful writing approaches to the complexity of fraud issues were greatly appreciated, and were useful.
Caitlin Tobin at the Federal Trade Commission performed miracles with FOIA requests.
 For a description of identity theft crimes and statistics about the incidence of these crimes, see Federal Trade Commission, Identity Theft Survey Report (Sept. 2003). The complete report is available at: <http://www.consumer.gov/idtheft/pdf/synovatereport.pdf>.
 Littleton Police Department, Inclusive Case Report, March 25, 2004 (Case 2004001789).
 United States v. Skodnek, 933 F. Supp. 1108,; 1996 U.S. Dist. LEXIS 9788 (D. D. Mass. 1996).
 Office of Inspector General, Health and Human Service, Criminal Actions (Sept. 2005), <http://oig.hhs.gov/fraud/enforcement/criminal/05/0905.html>.
 United States v. Sample, 213 F. 3d 1029, 2000 U.S. App. Lexis 11945. (8th Cir. 2000).
 United States v. Sullivan, Affidavit of Probable Cause for Arrest Warrant. Also see “AG Corbett announces arrest of Philadelphia man in $144,000 identity theft scam,” Press Release, July 29, 2005. Available at <http://www.attorneygeneral.gov/press.aspx?id=122>.
 United States v. Dzugha, Case No. 5:05-cr-00589-JF, Indictment at 4-7 (N. Cal).
 For example, some doctor’s offices in the Kaiser Permanente system in San Diego have had signs posted explaining that they ask for ID. < http://www.kaiserpermanente.org/>.
 Interviews with hospital staff members. See also University of Connecticut Advance, “Steps taken to stem healthcare identity theft,” (Sept.7, 2005), <http://www.advance.uconn.edu/2005/050907/05090711.htm>.
 The booklet, “Tips for Protecting Your Privacy: Don’t Become a Victim of Identity Theft,” April 2005, is available at <http://www.oag.state.ny.us/consumer/tips/identity_theft_pamphlet.pdf>.
 The FTC has a detailed page describing these rights and specific actions to take: Take Charge: Fighting Back Against Identity Theft. <http://www.ftc.gov/bcp/conline/pubs/credit/idtheft.htm>. See also Government Accountability Office, , Identity Theft Rights: Some Outreach Efforts to Promote Awareness of New Consumer Rights are Underway, (June 2005) (GAO-05-710).
 For example, this situation may occur if the person who stole a victim’s identity was impersonating a doctor or working in a clinic. Also see statement of Louis J. Freeh, director, Federal Bureau of Investigation, before the Special Committee on Aging, U.S. Senate. Federal News Service, March 21, 1995.
 Beyond resolving the financial impacts of the crime, medical identity theft victims may also need to take action to amend their medical files. One way consumers may be able to pro-actively detect this crime is to request copies of all insurance payments, services, and goods delivered in their name. If a consumer is a victim of this crime, they may not be receiving these explanation of benefit notices.
 The National Health Information Network (NHIN) is an ambitious modernization plan proposed by the U.S. government. The idea is to move from paper medical files to electronic medical files that are shared. The government goal is to digitize patients’ health records and medical files and create a national network to place the information in. The network, called the NHIN, would be a sophisticated network that hospitals, insurers, doctors, and others could potentially access. For more, see the World Privacy Forum NHIN page at < http://www.worldprivacyforum.org/medicalprivacy_NHIN.html>.
 See Astara March, “National health IT system taking off,” United Press International, November 10, 2005.
 See statement of Louis J. Freeh, director, Federal Bureau of Investigation, before the Special Committee on Aging, U.S. Senate. Federal News Service, March 21, 1995. From his testimony: “Schemes crafted by health care criminals have changed dramatically in the past few years. Indeed, organized criminal enterprises have penetrated virtually every legitimate segment of the health care industry.” Also see Malcolm K. Sparrow, License to Steal: How Fraud Bleeds America’s Health Care System, at Introduction and pages 39-52 (Westview Press, 2000).
 The Federal health privacy rule was issued by the Department of Health and Human Service under authority granted by the Health Insurance Portability and Accountability Act of 1996. The privacy rules were first issued in 2000 and became effective in 2003. There are also HIPAA rules for security. More information and copies of all the HHS rules and publications can be found at the website of the Office of Civil Rights, which is the HHS agency responsible for enforcement of the HIPAA privacy rule. <http://www.hhs.gov/ocr/hipaa/>.
 Statistics are from the FTC Identity Theft Clearinghouse data, taken from the FTC Consumer Sentinel database. The bottom range of this figure represents 1.8 percent of 214, 905 victims, which is the percent of victims that said they experienced medical identity theft in 2003. The larger figure of “approximately 3.25 million” is taken directly from the FTC 2003 Identity Theft Survey. The number represents the entire category of “New Accounts & Other Frauds’ ID Theft” which includes use of identity information for medical purposes. See pages 4, 13, and Table 1. 2003 FTC Identity Theft Survey Report, September 2003, Federal Trade Commission. “1.5 percent of survey participants reported that in the last year they had discovered that their personal information had been misused to open new credit accounts, take out new loans, or engage in other types of fraud, such as misuse of the victim’s name and identifying information when someone is charged with a crime, when renting an apartment, or when obtaining medical care (“‘New Accounts & Other Frauds’ ID Theft”). This result suggests that almost 3.25 million Americans discovered that their personal information had been misused in this kind of fraud in the past year,” p.4. The complete report is available at < http://www.consumer.gov/idtheft/pdf/synovatereport.pdf>.
 The accounting of disclosures requirement in the HIPAA health privacy rule requires covered entities to maintain a history of some disclosures of patient information. It also allows patients in some circumstances to obtain a copy of the accounting. 45 C.F.R. § 164.528.
 American Health Information Management Association, “The State of HIPAA Privacy and Security Compliance”,at 16. Available at <http://www.ahima.org/emerging_issues/2006StateofHIPAACompliance.pdf>.
 Electronic Health Record (EHR) is one of many terms that describe digitized patient medical and health records. Another term is Electronic Medical Record (EMR.) This report is using the term Electronic Health Record (EHR).
 Medical identity theft as the World Privacy Forum is defining it should not be confused with financial identity theft that occurs in a medical setting. See the section: “Underlying Thinking: What Identity Theft is Not” in this report.
 An identity theft literature review may be found at <http://www.ncjrs.org>. Type in the search term “identity theft” at the site’s search box.
 A definitive review of health care fraud issues may be found in Malcolm K. Sparrow, License to Steal: How Fraud Bleeds America’s Health Care System (Westview Press, 2000)..
 United States v. Dzugha, No. 5:05-cr-00589-JF, Indictment at 4–7 (N. Cal).
 United States v. Bainbridge Management, No. 1:01 cr 0049, Superseding Indictment (N.D. Ill).
 Statement of Louis J. Freeh, director, Federal Bureau of Investigation, before the Special Committee on Aging, U.S. Senate. Federal News Service, March 21, 1995.
 Statistic provided in response to a World Privacy Forum FOIA request to the Federal Trade Commission, FTC FOIA-2006-00560.
 See the Federal Trade Commission’s ID Theft Clearinghouse Data, available at: <http://www.consumer.gov/idtheft/id_federal.htm>.
 Government Accountability Office, Identity Theft Prevalence and Cost Appear to be Growing, March 2002 (GAO-02-363) at 30.
 The ITRC 2003 and 2004 surveys are available at <http://www.idtheftcenter.org/idaftermath.pdf> and < http://www.idtheftcenter.org/aftermath2004.pdf> respectively.
 Statistics are from the FTC Identity Theft Clearinghouse data, taken from the FTC Consumer Sentinel database. The bottom range of this figure represents 1.8 percent of 214, 905 victims, which is the percent of victims that said they experienced medical identity theft in 2003. The larger figure of “approximately 3.25 million” is taken directly from the FTC 2003 Identity Theft Survey. The number represents the entire category of “New Accounts & Other Frauds’ ID Theft” which includes use of identity information for medical purposes. See pages 4, 13, and Table 1. 2003 FTC Identity Theft Survey Report, September, 2003, Federal Trade Commission.
 Study available at < http://www.pirg.org/alerts/route.asp?id2=3683>.
 < http://www.javelinstrategy.com/research?cat=2>. See also <http://www.bbb.org/alerts/article.asp?ID=565> and <http://www.bbbonline.org/idtheft/safetyQuiz.asp>. 39 < http://www.javelinstrategy.com>.
Federal Trade Commission, Identity Theft Survey Report (Sept. 2003). <http://www.consumer.gov/idtheft/pdf/synovatereport.pdf>.
 Katrina Baum. Identity Theft, 2004. Released April 2, 2006. (NCJ-212213). <http://www.ojp.usdoj.gov/bjs/abstract/it04.htm>.
 The World Privacy Forum submitted comments suggesting changes to the FTC identity theft survey instrument in response to FTC’s Federal Register notice of 18 November2005, 69970, Vol. 70, No. 222 requesting input. The comments may be read at < http://www.worldprivacyforum.org/pdf/wpf_ftcidsurveycmt_fs.pdf>.
 Federal News Service. July 12, 2000. Prepared testimony of Penny Thompson Program Integrity Director, Health Care Financing Administration. Before the House Budget Committee Task Force on Health. Medicare and Medicaid program integrity.
 Government Accountability Office, May 7, 1992. T-HRD-92-29. Health Insurance: Vulnerable Payers Lose Billions to Fraud and Abuse. Statement of Janet L. Shikles, Director, Health Financing and Policy Issues, Human Resources Division. “Though no one knows for sure, health industry officials estimate that fraud and abuse contribute to some 10 percent of U.S. health care’s current $700-plus billion in costs,” p. 2.
 Malcolm K. Sparrow, License to Steal: How Fraud Bleeds America’s Health Care System, at Preface (Westview Press, 2000).
 The Department of Health and Human Services And The Department of Justice, Health Care Fraud and Abuse Control Program.Annual Report For FY 1999. See “Beneficiary Outreach” section.
 “Fighting On New Fronts.”October 1 2005, Best’s Review.
 Statistics obtained by Transactional Records Access Clearinghouse using FOIA. Statistical reports were generated by TRAC for the World Privacy Forum. TRAC is a data gathering, data research and data distribution organization associated with Syracuse University.< http://trac.syr.edu/>.
 “Fighting On New Fronts.”October 1 2005, Best’s Review. See also <http://www.bcbs.com/antifraud>.
 World Privacy Forum FOIA to the Federal Trade Commission. FTC FOIA-2006-00601. FTC Reference No. 8079665.
 Ibid, FTC Reference No. 8079842.
 Ibid, FTC Reference No. 8078067.
 Ibid, FTC Reference No. 8078114.
 Ibid, FTC Reference No. 8077739.
 Ibid, FTC Reference No. 8077815.
 Ibid, FTC Reference No. 8079385.
 Ibid, FTC Reference No. 8078141.
 Ibid, FTC Reference No. 8079056.
 Ibid, FTC Reference No. 80299279.
 Ibid, FTC Reference No. 8079611.
 Ibid, FTC Reference No. 8079613.
 Ibid, FTC Reference No. 8079713.
 Ibid, FTC Reference No. 8079862.
 Ibid, FTC Reference No. 8079524.
 “Individual arrested for criminal charges with health care fraud.” Federal Bureau of Investigation, Knoxville Division, press release, May 15, 2003. < http://knoxville.fbi.gov/pressrel/2003/kx051403.htm >.
 “Nurse imposter arrested, faces identity theft charge.”Office of New York State Attorney General Eliot Spitzer, press release, August 31, 2005. < http://www.oag.state.ny.us/press/2005/aug/aug31c_05.html >.
 See discussion of this point in Malcolm K. Sparrow, License to Steal: How Fraud Bleeds America’s Health Care System at 120 (Westview Press, 2000).
 Author interviews with the FBI and Department of Justice. Also see Sparrow pages 132, 133. Also see public records on cases discussed in this report. For example, See Littleton Police Department Inclusive Case Report from January 17, 2006 re: Criminal Impersonation of Joe Ryan.
 Medical Identity Theft: What’s the Deal? NBC13.com, March 21, 2003. <http://www.nbc13.com/news/2057120/detail.html>.
 See Littleton Police Department, Inclusive Case Report,Criminal Impersonation of Joe Ryan, pages 5, 6, and 11 (Jan. 17, 2006).
 Interview with Joe Ryan, April 2006.
 5. The Lufkin Daily News, 15 July 2005, Police Report.
 Rozanna M. Martinez ,“Ex-Deputy Is Indicted On Charges of Fraud.”, 5 April 2006, Albuquerque Journal.
 See Jason Kandel, “Medi-Cal Fraud Flourishing on Black Market,” 7 August 2005, Los Angeles Daily News.
 Interviews with Department of Justice by author.
82 World Privacy Forum FOIA to the Federal Trade Commission. FTC FOIA-2006-00601.
 See, e.g.,United States. v. Skodnek. 933 F. Supp. 1108, 1996 U.S. Dist. LEXIS 9788. (D. Mass. 1996.).
 See U.S. Department of Justice “Doctor and Biller Convicted in Multi-Million Dollar Medicare and Medi-Call Billing Scam,” Press Release, December 23, 2005. < http://www.usdoj.gov/usao/cac/pr2005/176.html >.
 US Fed News. September 15, 2005. “Office of insurance fraud prosecutor charges Newark woman with using stolen identity to commit insurance fraud.” Dateline: Trenton, N.J.
 Federal Trade Commission, <http://www.ftc.gov/bcp/workshops/idtheft/comments/weaverlind.htm>. August 18, 2000.
 U.S. v. Dzugha, Case 5:05-cr-00589-JF (N. Cal). Indictment, pages 4 –7.
 Interviews with hospital staff members, also see University of Connecticut Advance, “Steps taken to stem healthcare identity theft,” September 7, 2005. <http://www.advance.uconn.edu/2005/050907/05090711.htm>.
 “FBI announces indictment and arrest in a case of identity theft,” Federal Bureau of Investigation San Diego Division press release, March 8, 2000. < http://sandiego.fbi.gov/pressrel/2000/berend.htm>.
 “Arrests made in $6.5 million Health Care Fraud Scheme,” Office of the Attorney General of Florida press release, November 23, 1999.
 Rozanna m. Martinez, “Ex-Deputy Is Indicted On Charges of Fraud” 5 April 2006, Albuquerque Journal..
 45 C.F.R. §164.526(a)(2)(i). Some state laws may allow a right of amendment that does not include the HIPAA exclusion for third party records.
 The World Privacy Forum is aware of two instances where this has occurred. See Littleton Police Department Inclusive Case Report, March 25, 2004 (Case 2004001789) and “Medical identity theft:What’s the Deal?” March 21, 2003. NBC13, Birmingham, Alabama. <http://www.nbc13.com/nbc13investigators/2057120/detail.html>.
 2006 State of HIPAA Compliance, p. 14. Available from < http://www.ahima.org/index.asp>.
 For example, at the September 2005 HIT/HIPAA summit in Washington DC, a representative from the Office of Civil Rights made such a statement in a panel discussion on the topic.
 A national campaign toward modernizing, digitizing and automating health care records is currently underway, as are plans for the creation of a national networked architecture to manage those records (the NHIN.) See, for example, Executive Order 13335, “Incentives for the Use of Health Information Technology and Establishing the Position of the National Health Information Technology Coordinator” (Washington, D.C.: Apr. 27, 2004). Also see the Office of the National Coordinator for Health Information Technology (ONC) <http://www.hhs.gov/healthit/`>.
 For a more detailed discussion of these issues, see the World Privacy Forum testimony on Electronic Health Records (EHRs) and the National Health Information Network before the Privacy and Confidentiality subcommittee of the NCVHS. See in particular the discussion of medical identity theft and the security issues related to the NHIN. <http://www.worldprivacyforum.org/testimony/NCVHStestimony_092005.html>.
 Many tools have become available to facilitate HIPAA compliance, including software and enterprise systems designed specifically for the automating of accounting of disclosures. See among many examples, HIPAA Guard by Integritas < http://www.integritas.com/>, which is a paperless accounting of disclosures system, Etrack Disclosure Tracking System. < http://www.hipaarx.net/products_disclosures.htm >, Cortrak http://www.cortrak.com/, HPATS by IO Datasphere, among many others.
 Joe Rojas-Burke, “Providence critics push for safer records.” The Oregonian, January 27, 2006.
 Government Accountability Office, INFORMATION SECURITY: Department of Health and Human Services Needs to Fully Implement Its Program at 5 (GAO-06-267), (2006).
 The Office of the National Coordinator is part of the Department of Health and Human Services. See < http://www.hhs.gov/healthit/>.
 Nikki Swartz, “E-Records May End Fraud.” 1 January 2006. Information Management Journal.
 Lawrence O. Gostin, James G. Hodge, Jr , Modern Studies in Privacy Law: National health information Privacy regulations under HIPAA: Personal Privacy and Common Goods: A Framework for Balancing Under the National Health Information Privacy Rule, 86 Minn. L. Rev. 1439 (2002).
 Business Wire. February 9, 2005 Wednesday 5:07 PM GMT. “University of Chicago Comer Children’s Hospital Selects Mobile Aspects.” Also see “System targets blood-type mix-ups,” The Boston Globe, 24 February 2005. Scott Allen. Also see “Ubisense Ultrawideband Location Devices Certified by US FCC Approval Opens U.S. Market for Location Aware ‘Smart Space’ Platform, Ubisense one of the First Companies to Receive Certification.” PR Newswire (U.S.) 06 December 2004.
 See: “Company receives product leadership award for patient ID wristband.” Biotech Business Week, 20 December 2004. Also see “AXCESS ActiveTag Product Tapped for Patient ID System.” 17 February 2005, Wireless News.
 HHS Awards Contracts to Advance Nationwide Interoperable Health Information Technology – Strategic Partnerships with Public-Private Groups Will Spur Health IT Efforts. 6 October 2005, U.S. Health & Human Services Documents.
 “HHS Awards Contracts to Advance Nationwide Interoperable Health Information Technology – Strategic Partnerships with Public-Private Groups Will Spur Health IT Efforts.” 6 October 2005, U.S. Health & Human Services Documents. See also Robin Blair, RHIO Nation, 1 February 2006, Health Management Technology.
Todd Milbourn , “Stolen laptop contains files on HIV patients”, 23 February 2006. The Sacramento Bee.
 Government Accountability Office, INFORMATION SECURITY: Department of Health and Human Services Needs to Fully Implement Its Program at 12 (GAO-06-267), (2006)..
 See discussion of cases in this report for examples.
Attorney Northern District of Texas. August 19, 2002. < http://www.usdoj.gov/usao/txn/PressRel02/thompson_cynthia_sen_pr.html >.
 News Release. U.S. Department of Justice. United States Attorney Eastern District of Virginia, July 21, 2005.
 Robert Charette, “What Happened to Do No Harm?” 1 April 2006. CIO Magazine..
 Thomas J. Sheeran, “Volunteers sought to aid medical studies.” April 7, 2006. Associated Press.
 Victims of medical identity theft who also experience financial consequences should see the following thorough resources for dealing with this aspect of the crime: Federal Trade Commission <http://www.ftc.gov>; Privacy Rights Clearinghouse <http://privacyrights.org>; Identity Theft Resource Center <http://www.idtheftcenter.org>.

References: v. 
 v. 
 v. 
 v. 
 § 164
 v. 
 v. 
 v. 
 v. 
 §164