Medical Identity Theft:
Past, Present, and Future…
Alaska Bar Association
Health Law Section
November 1, 2007
Presented by:
Dawn Carman, Esq., RHIA, FACHE
Chief Risk & Compliance Officer
Alaska Native Tribal Health Consortium
Goals

Overview of identity theft?




What is medical identity theft?






How do thieves steal your identity?
Ramifications
Safeguards
How do thieves steal your medical identity?
Duties of health organizations
Ramifications
Safeguards
Federal and state laws
Q&A
Who is Frank W. Abagnale?
What Is Identity Theft?

Identity theft occurs when someone uses
your personally identifying information,
like your name, Social Security number,
or credit card number, without your
permission, to commit fraud or other
crimes



Federal Trade Commission
The fastest growing crime in the US
Occurs every 3-79 seconds


IDProtect.Com
Identity Theft Resource Center
How Much Do You Know About
Identity Theft?

Take a quiz


http://onguardonline.gov/quiz/idtheft_
quiz.html
http://www.idtheftcenter.org/artman2/
publish/c_theft_test/Fact_Sheet_102_C
onsumer_Risk_Test.shtml
What Are The Numbers?



8.4M identity theft victims per
year down from 10.1M in 2003
Mean fraud per victim $5720
Mean resolution time per victim 25
hours

Javelin Strategy & Research Survey Feb
2007
How Do Thieves Steal
Your Identity?

Dumpster Diving


Skimming


Rummaging through trash looking for
documents with your personal information
Stealing credit/debit card numbers using a
special storage device when swiping your card
Phishing

Pretending to be financial institutions or
companies and send spam or pop-up
messages to get you to reveal your personal
information
How Do Thieves Steal
Your Identity?

Changing Your Address


Old-Fashioned Stealing




Diverting your billing statements to another
location by completing a change of address
form
Stealing wallets, purses, and mail
Stealing personnel records
Bribing employees who have access
Pretexting

Using false pretenses to obtain your personal
information from financial institutions,
telephone companies, and other sources
Identity Theft Ramifications








Credit card fraud
Phone or utilities fraud
Bank/finance fraud
Government documents fraud
Use your SSN to get a job
Rent a house in your name
Use your info during an arrest
Get medical services using your name

Federal Trade Commission
WHAT CAN YOU DO?
DETER
 Deter identity thieves by safeguarding your information
DETECT
 Detect suspicious activity by routinely monitoring your financial
accounts and billing statements
DEFEND
 Defend against identity theft as soon as you suspect a problem
What Is Medical Identity Theft?

Someone uses a person's name and
other parts of their identity without
the person's knowledge or consent
to



Obtain medical services
Obtain prescription drugs and
medical equipment
Make false claims to insurance
companies
What is Medical Identity Theft?

The least understood and most
poorly documented identity theft
crime



Takes a financial toll
Takes an emotional toll
Can kill you!
Medical Identity Is




A doctor falsifies medical records of patient claiming
that they have received medical treatments that they
never did and submits false claims
A nurse at a physician's office calls in prescription for a
patient, but picks up the prescriptions for herself.
Someone walks into the emergency department at a
hospital claiming to be someone else (without that
person's permission) so that they can receive
emergency medical care
A woman gets surgery claiming to be someone else


Presented medical insurance information and an altered
driver's license to impersonate a friend without that
friends permission
Did not have medical insurance of her own

B. Koerner, Medical Identity Theft: What It Is and Is Not,
About.com
Medical Identity Theft Is Not



A lab tech uses personal information in
your medical record to open up a credit
card account in your name
Someone walks into the emergency
department at a hospital claiming to be
someone else, with that persons
permission, so that they can receive
emergency medical care
A patient is faking a medical condition
and gets a doctor to collaborate with
them and falsify medical records

B. Koerner, Medical Identity Theft: What It Is
and Is Not, About.com
Medical Identity Theft Example 1

A CO flightseeing business owner got a hospital bill for
$41,188
He called the hospital and realized that someone had
stolen his personal information to pay for a surgery
 Investigators traced the crime to a former newspaper
clerk at a newspaper in which the man had placed an ad
for his business.
"He asked for my Social Security number, and I now realize I
shouldn't have given it to him.”




The hospital would not let the man see his medical
records because the signature on his driver’s license
did not match that of the medical identity thief
The hospital wrote off the loss, but the man has not
been able to erase unpaid debt from his credit record,
affecting his business loans
Medical Identity Theft Example 2





A Boston psychiatrist made false entries
in medical records for individuals who
were not his patients
He gave diagnoses such as drug addiction
and severe depression
He used their personal information to
submit false bills to insurance companies
Victims had difficulty getting the
information removed from their real
medical records
Victims were concerned about future
health care coverage and employment
How Much Do You Know About
Medical Identity Theft?

Medical Identity Theft: The
Information Crime That Can Kill You

http://www.worldprivacyforum.org/me
dicalidentitytheft.html
What Are The Numbers?

$49.3B per year


20,000 reported cases 1992-2006


Javelin Strategy & Research Survey Feb
2007
Federal Trade Commission 2006
Estimated 250,000- 500,000 cases
of medical identity theft per year

World Privacy Forum
Can Health Care Fight Fraud?


In 2006, Blue Cross/Blue Shield, the
nation’s largest health care
network, pursued 20,000+ cases of
health care fraud through identity
theft and impersonation
206 convictions
Medical Identity Theft Ramifications




Medical identity theft is a crime that can
cause great harm to its victims
Although high risk, it is the least studied
and most poorly documented of the
cluster of identity theft crimes
It is the most difficult to fix after the fact
because victims have limited rights and
recourses
It leaves a trail of falsified information in
medical records that can plague victims’
medical and financial lives for years

The World Privacy Forum
Medical Identity Theft Ramifications

Medical record alterations





Allergies
Medical and surgical history
Drug contraindications
Blood type
Serious injury or death
Medical Identity Theft Ramifications
Medical bills
 Collection agencies
 Denial of health insurance coverage
 Denial of employment
 Impact on legal rights

Medical Identity Theft:
The Victim’s Perspective






Lack of recourse
Lack of rights
Lack of help
No blanket rights to correct erroneous
medical records
In some cases victims have been denied
access to compromised records
No right to prevent providers,
clearinghouses, or insurers from reporting
information resulting from identity theft

The World Privacy Forum
Medical Identity Theft:
Victims Falling Through Gaps



Financial identity theft experts often
knowledgeable of health privacy
laws
FTC is not responsible for
addressing medical identity theft
DHHS is responsible for medical
identity theft


No published focused studies
No published guidance

The World Privacy Forum
The World Privacy Forum:
Medical Identity Theft Findings




Medical identity theft is a separate and
distinct crime from other types
Medical identity theft is a serious crime
with substantial consequences on patient
well-being affecting medical record
accuracy and health care financial losses
Medical identity theft is under researched
and under reported
Victim recourse is limited
Findings Continued




Medical identity theft can be challenging
to uncover
Uncorrected medical record errors have a
long-range negative impact on medical
research using patient records
The proposed National Health Information
Network may increase risks to patient
safety, privacy, and security of patient
data.
Victims may learn of their identity theft
after much damage has been done
The World Privacy Forum:
Medical Identity Theft
Recommendations





Medical identity theft needs national
attention
Medical identity theft victims need
expanded accounting of disclosures
Patients must have the right to correct
errors in their medical records
DHHS needs to implement victim
protections similar to those of the FTC
Health insurers should send each
beneficiary a free annual list of all claims
Recommendations Continued




Patients should receive one free copy of
their medical records from providers
Patients must be notified of data breaches
promptly
Medical identity theft should be
considered as part of computer system
risk assessments
National Health Information Network
prototypes need testing for medical
identity theft
Medical Identity Theft in
the Electronic Age

“As the health care system transitions
from paper-based to electronic, this crime
may become easier to commit and harder
to trace. Victims may find it more difficult
to recover from medical identity theft as
medical errors are disseminated and redisseminated through computer networks
and other medical information-sharing
pathways.”

The World Privacy Forum
Health Organizations
and Protecting Data





HIPAA Privacy and Security Rules
Hospital privacy policies
Consumer protection laws
Common law duty of care
Medicare Conditions of Participation
Medical Identity Theft Safeguards




Consider requiring picture ID for health
care service to protect patient safety and
help prevent medical identity theft and
fraud
Education the workforce and patients on
medical identity theft
Implement a protocol to investigation
allegations of medical identity theft
Partner with law enforcement
Medical Identity Theft Safeguards


Be careful to whom you give name, social
security number, and date of birth
If you are the victim of identity theft, take
all actions you can think of to protect
yourself





Contact creditors
Work with the health care provider
Work with insurance companies
Request correction of medical records
Contact the Social Security Administration
Federal Data Security Laws

Financial, securities, and consumer protection laws












Title V of Gramm-Leachy-Bliley Act

15 USC §§ 6801-09
FTC Standards for Safeguarding Customer Information

16 CFR Part 314
SEC Regulations

17 CFR Part 248
Privacy of Consumer Financial Information

16 CFR Part 313 et seq.
Fair Credit Reporting Act

15 USC §§ 1681-1681x
Identity Theft Red Flags and Address Discrepancy Rule under FACT Act

Pub. L. No. 108-159
Federal Trade Commission Act

15 USC § 45(a)
Customer Information Program Rules under the Patriot Act

31 USC § 5318(I)
Health Insurance Portability and Accountability Act

42 USC § 1320d et seq.
Drivers Privacy Protection Act

18 USC § 2721-2125
Family Education Rights and Privacy Act

20 USC § 1232g
Department of Veterans Affairs Information Security Act

38 USC § 5721-28
State Identity Theft
Criminal Law Enforcement






All 50 states and DC have some form of legislation that
prohibits identity theft
In all states except ME, identity theft can be a felony
11 states uses a narrow approach to criminalization by
focusing on the use of personally identifiable
information with intent to defraud
Other states use a broad approach including
unauthorized use, possession, creation, recording,
obtaining, selling, giving, or transmitting of personally
identifiable information
State laws are rapidly changing
Trend in making criminal laws more specific

Example: Making it a separate crime to traffic in stolen
identities or to engage in phishing

The President’s Identity Theft Task Force Apr 2007 Report
More Info on Identity Theft

Javelin Strategy & Research Survey February 2007


FTC Deter, Detect, Defend Campaign


http://www.privacyrights.org/ar/idtheftsurveys.htm
http://www.ftc.gov/bcp/edu/microsites/idtheft/
Medical Identity Theft: The Information Crime That Could Kill You

http://www.worldprivacyforum.org/pdf/wpf_medicalidtheft2006.pdf

Take Charge: Fighting Back Against Identity Theft

US Department of Justice



http://www.identitytheft911.org/home.htm
US Social Security Administration


http://www.usdoj.gov/criminal/fraud/idtheft.html
Identity Theft 911


http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt04.shtm
http://www.ssa.gov/pubs/idtheft.htm
Fight Identity Theft

http://www.fightidentitytheft.com/

Identity Theft Resource Center

The President’s Identity Theft Task Force Apr 2007 Report


http://www.idtheftcenter.org/
http://www.idtheft.gov/reports/VolumeII.pdf
Questions?