How to Spot Medical Identity Theft on Your Records

Medical identity theft doesn't announce itself. Your insurance gets used. Someone else's diagnosis lands in your file. Bills arrive for procedures you never had. By the time you notice, the damage is already spreading through your records.

The theft corrupts your medical history in ways that can deny you coverage, trigger treatment errors, or saddle you with collections debt for care you never received. Finding it requires methodical inspection of documents most people never request.

This is the step-by-step process to spot medical identity theft before it becomes a crisis.

What Medical Identity Theft Actually Looks Like

Medical identity theft is when someone uses your name, insurance number, or Social Security number to obtain medical services, prescription drugs, or medical equipment. The fraud creates false entries in your medical records and generates bills under your identity.

The thief might be a stranger who bought your insurance card number on a criminal forum. They might be a family member who borrowed your insurance card for an emergency room visit. They might be a medical provider billing for services never rendered. The mechanism is the same: your identity gets attached to someone else's care.

The FTC reports that medical identity theft is one of the most damaging forms of identity theft because it affects both your finances and your health. Fraudulent diagnoses, procedures, and medications in your records can lead to denied insurance claims, incorrect treatment, or dangerous drug interactions.

Unlike credit card fraud, where you dispute a charge and move on, medical identity theft requires correcting records across multiple providers, insurance companies, and billing systems. Each correction is a separate process. Each delay extends your exposure.

Where to Start: Your Explanation of Benefits Statements

Your Explanation of Benefits (EOB) statements are the first place medical fraud becomes visible. Insurance companies send EOBs after processing claims, showing what services were billed, what the insurer paid, and what you owe.

Most people glance at the balance due and file the statement. That's the mistake. The EOB contains the details that reveal fraud.

Here's what to check on every EOB:

Provider name and location. If you see a provider you've never visited or a location you've never been to, that's a red flag. Medical identity thieves often use clinics far from your home, assuming you won't notice.

Date of service. Compare the date to your calendar. If the EOB shows a visit on a day you were at work, on vacation, or otherwise occupied, someone else used your insurance.

Services rendered. Read the procedure codes and descriptions. If you see treatments you didn't receive, tests you didn't take, or medications you've never been prescribed, your insurance has been used fraudulently.

Provider specialty. If you see claims from a cardiologist and you've never had heart problems, or an orthopedic surgeon when you haven't had an injury, investigate immediately.

Keep every EOB for at least three years. File them chronologically so you can spot patterns. If you receive EOBs for services you didn't authorize, contact your insurance company the same day.

Requesting Your Medical Records from Every Provider

Your medical records contain the detailed entries that EOBs summarize. To spot identity theft, you need to see what's actually in your file.

Under HIPAA, you have the right to request copies of your medical records from any provider who has treated you. The process is straightforward but requires persistence.

Contact each provider's medical records department. Many hospitals and clinics have online portals where you can submit a records request. If not, call or send a written request. Ask for a complete copy of your medical records, not just a summary.

Providers can charge a reasonable fee for copying records, typically around $20 to $50 depending on the volume. Some states cap these fees. The provider must respond within 30 days.

When the records arrive, review every page. Look for:

Dates you didn't visit. Any entry dated on a day you weren't at that facility is fraudulent.

Diagnoses you don't have. If your records show conditions you've never been diagnosed with, someone else's information has been merged into your file.

Medications you've never taken. Prescription records should match what you've actually been prescribed. Unfamiliar drugs indicate fraud or a records error.

Procedures you didn't undergo. Surgeries, tests, imaging, lab work, if it's in your file and you didn't have it done, it's either fraud or a clerical error that needs immediate correction.

Incorrect demographic information. Check your birth date, address, phone number, and emergency contacts. Identity thieves sometimes alter this information to avoid detection.

If you find discrepancies, document them. Highlight the fraudulent entries. Take photos or make copies. You'll need this evidence when you report the theft.

Checking Your Credit Reports for Medical Collections

Medical identity theft often surfaces on your credit report before you notice it in your medical records. Fraudulent medical bills go to collections, and those collections get reported to the credit bureaus.

You're entitled to one free credit report per year from each of the three major bureaus: Equifax, Experian, and TransUnion. Request all three at AnnualCreditReport.com.

When you review your credit reports, look for:

Medical collections you don't recognize. If you see a debt from a hospital, clinic, or medical billing company you've never done business with, investigate immediately.

Incorrect amounts. If you know you owe a medical bill but the amount on your credit report is wrong, it could indicate fraudulent charges added to legitimate care.

Unfamiliar collection agencies. Medical debt is often sold to third-party collectors. If you see a collection account from a company you don't recognize, request validation of the debt before paying anything.

Dispute fraudulent medical collections with the credit bureau and the collection agency. Under the Fair Credit Reporting Act, they must investigate your dispute within 30 days. If they can't verify the debt, they must remove it from your report.

Place a fraud alert or credit freeze with all three bureaus to prevent new fraudulent accounts. A fraud alert requires creditors to verify your identity before opening accounts. A freeze blocks access to your credit report entirely until you lift it.

What to Do When You Find Medical Identity Theft

Finding fraudulent entries in your medical records requires immediate action. The longer fraud sits in your file, the harder it becomes to correct.

Step 1: Contact your insurance company. Call the fraud department and report the theft. Provide the specific EOBs, dates of service, and providers involved. Ask them to flag your account for fraud monitoring and to reject future claims from the fraudulent provider.

Step 2: File a report with the FTC. Go to IdentityTheft.gov and complete an identity theft report. The FTC will generate a personalized recovery plan and provide an official Identity Theft Report you can use when dealing with creditors, insurers, and providers.

Step 3: Request corrections to your medical records. Contact each provider where fraudulent entries appear. Submit a written request to amend your records, citing the specific entries that are incorrect. Include a copy of your FTC Identity Theft Report as supporting documentation.

Providers are required under HIPAA to consider your amendment request, but they can deny it if they believe the information is accurate. If they deny your request, you have the right to submit a statement of disagreement that becomes part of your permanent record.

Step 4: File a police report. Some states require a police report to dispute fraudulent medical debt or to correct medical records. Even if it's not required, a police report creates an official record of the theft that strengthens your case with creditors and insurers.

Step 5: Place fraud alerts with the credit bureaus. Contact Equifax, Experian, and TransUnion to place a fraud alert on your credit file. This requires creditors to verify your identity before opening new accounts. Consider a credit freeze for stronger protection.

Step 6: Monitor your accounts. Check your EOBs, credit reports, and medical records regularly for at least a year after discovering the theft. Medical identity theft often involves multiple fraudulent claims over time.

The Sherlock Holmes Problem

In A Scandal in Bohemia, Sherlock Holmes tells Watson, "You see, but you do not observe." Watson looks at the same evidence Holmes does, but he doesn't notice what matters.

Medical identity theft works the same way. The evidence sits in your EOBs, your medical records, and your credit reports. Most people see the documents but don't observe the discrepancies. A date that doesn't match. A provider you've never heard of. A diagnosis that makes no sense.

The difference between seeing and observing is attention. Holmes trains himself to notice details others miss. You do the same thing when you review your medical records methodically, line by line, looking for entries that don't belong.

The fraud is there. You just have to look for it.

Preventing Future Medical Identity Theft

Once you've cleaned up existing fraud, the next step is prevention. Medical identity theft often happens because insurance cards and personal information are too easy to steal or share.

Guard your insurance card. Don't carry it unless you're going to a medical appointment. Don't share your insurance number over the phone unless you initiated the call and verified the recipient's identity. Don't post photos of your insurance card on social media.

Review EOBs immediately. Don't wait until the end of the year to check your statements. Review each EOB as it arrives. The faster you catch fraud, the easier it is to correct.

Request medical records annually. Make it a routine to request your complete medical records from all providers once a year. Schedule it like a dental cleaning or an oil change. Regular inspection catches fraud before it spreads.

Monitor your credit reports. Check all three credit bureaus at least once a year for medical collections. If you have complex health needs or high-value insurance, consider more frequent monitoring.

Use strong passwords for patient portals. Many providers offer online portals where you can view your medical records, lab results, and billing information. Secure these accounts with unique passwords and two-factor authentication. If someone gains access to your portal, they can see your insurance information and potentially use it for fraud.

Be cautious with medical billing calls. Scammers impersonate medical billing departments to collect insurance information. If you receive a call about a medical bill, hang up and call the provider directly using a number from their official website or your insurance card.

Report suspicious activity immediately. If you receive an EOB for a service you didn't receive, or if a provider you've never visited contacts you about a bill, report it to your insurance company and the FTC the same day.

What Makes Medical Identity Theft Different

Medical identity theft is harder to detect and harder to correct than other forms of identity fraud. Credit card fraud gets resolved with a dispute and a new card number. Medical identity theft requires correcting records across multiple systems, each with its own process and timeline.

The Identity Theft Resource Center notes that medical identity theft victims spend an average of 200 hours resolving the fraud. That's five full work weeks of phone calls, paperwork, and disputes.

The damage extends beyond the time investment. Fraudulent entries in your medical records can lead to:

Denied insurance claims. If your records show you've already received a treatment or reached a coverage limit, your insurer may deny future claims for legitimate care.

Incorrect treatment. A doctor who relies on fraudulent records might prescribe the wrong medication, order unnecessary tests, or miss a real diagnosis because the records show a condition you don't have.

Higher insurance premiums. Fraudulent claims for expensive procedures can increase your premiums or cause your insurer to drop your coverage.

Collections and credit damage. Bills for fraudulent care go to collections, damaging your credit score and making it harder to get loans, rent an apartment, or pass employment background checks.

The consequences are serious. The solution is vigilance.

When to Consider Professional Help

Some medical identity theft cases are straightforward: a single fraudulent claim, one provider, one corrected record. Others are complex: multiple providers, years of fraudulent entries, insurance denials, and credit damage.

If your case involves extensive fraud, consider professional help. Identity theft recovery services can handle the paperwork, disputes, and follow-up on your behalf. Some services are free through your employer, credit card company, or homeowner's insurance. Others charge a monthly fee.

NordProtect offers identity theft monitoring and recovery support, including assistance with medical identity theft. The service monitors your personal information across dark web forums, data breaches, and public records, alerting you to potential fraud before it spreads.

Legal assistance may be necessary if providers refuse to correct your records, if insurers deny legitimate claims based on fraudulent entries, or if you're facing collections lawsuits for debts you don't owe. An attorney who specializes in identity theft can navigate the legal process and protect your rights.

The Records You Need to Keep

Medical identity theft resolution requires documentation. Keep copies of everything:

All EOBs. File them chronologically. Highlight any that show fraudulent claims.

Medical records requests and responses. Document every request you submit and every response you receive. If a provider refuses to correct your records, you'll need proof of your attempt.

Correspondence with your insurance company. Save emails, letters, and notes from phone calls. Record the date, time, representative's name, and what was discussed.

FTC Identity Theft Report. Print multiple copies. You'll need to provide this to insurers, providers, credit bureaus, and potentially law enforcement.

Police reports. If you filed a police report, keep copies. Some organizations require it before they'll investigate fraud.

Dispute letters to credit bureaus. Save copies of every dispute you file and the responses you receive.

Corrected medical records. Once a provider amends your records, request a new copy to confirm the corrections were made.

Store these documents securely. Use a locked file cabinet or an encrypted digital folder. You may need them for years as you work through the correction process.

The Long-Term Impact on Your Health Records

Even after you correct fraudulent entries, the impact on your medical records can linger. Some providers maintain audit trails that show deleted or amended entries. Insurance companies keep historical claims data. Electronic health record systems may retain traces of fraudulent information even after it's officially removed.

This creates ongoing risk. A new doctor who reviews your records might see the audit trail and question your medical history. An insurer reviewing a claim might flag your account based on past fraud, even if it was corrected.

To manage this risk:

Inform new providers about the identity theft. When you establish care with a new doctor, mention that your records were affected by identity theft and that some entries may be incorrect or show amendment histories. Provide a copy of your FTC Identity Theft Report if they have questions.

Request a letter from your insurance company. After resolving the fraud, ask your insurer to provide a letter confirming that the claims were fraudulent and that your account has been corrected. Keep this letter with your medical records.

Monitor your records indefinitely. Even after the immediate fraud is resolved, continue requesting your medical records annually. Watch for any reappearance of fraudulent entries or new unauthorized claims.

Medical identity theft doesn't always end when you correct the records. It requires ongoing vigilance.