We
all have read about the massive data breaches in the news over the last few
years. The Target breach, the Mapco breach, and the Anthem breach are but a
few. The thought of some far-away computer hacker in a basement in Russia, or
the far-East, is nothing foreign to us these days. Cyber-security systems, no
matter how seemingly airtight, are vulnerable. We are all at risk. It seems
every week, there is a story of another large company that was hacked and our
personal information was stolen.
But
how is your personal information used? A lot of times, your information is sold
on the internet in bulk around the world (see my previous blog post). The purchasers
of stolen information use credit card numbers to buy goods or pay for services.
Sometimes they file false tax returns using your information to steal your
rebate or claim one of your dependents on their return.
However,
an alarming new trend is occurring in the world of identity theft and it is
medical identity theft. Thieves use your personal information to receive
treatment at hospitals and clinics, get prescriptions, or buy medical
equipment. Usually, the health care provider is nowhere in your vicinity or
provides treatment for a condition you do not have.
Victims sometimes only find out when they get a bill or a call
from a debt collector. They can wind up with the thief’s health data and
history in their own medical charts. A patient’s record may show she has
diabetes when she does not, say, or list a different blood type—errors that can
lead to dangerous diagnoses or treatments.
Adding insult to injury, a victim often is not allowed to fully
examine his own records because medical-privacy laws such as HIPPA protect the
thief’s health data. All the while, hospitals sometimes continue to hound victims
for payments they did not incur.
To make the
situation more alarming, medical identity theft is growing. According to a
recently published survey, medical identity theft affected 2.3 million adult
patients in 2014 versus 1.4 million in 2009. Another
report published in February estimated that computer-data breaches of personal
health information affected more than 40 million patients from 2009 through
2014.
Such
identity theft has led about 40 companies, including Blue Cross Blue Shield
Association and Aetna Inc., to form the
Medical Identity Fraud Alliance. Some hospitals have turned to biometric
screening to confirm patient identities. Also, unlike in financial identity
theft, health identity-theft victims have a much more difficult time clearing
the illegal bills because there is no health-care equivalent of the Fair Credit
Reporting Act or the Fair Debt Collection Practices Act, which limits
consumers’ monetary losses if someone uses their credit information.
