While the news is filled with security breaches of financial data (e.g., Target, Staples, etc.), it is key to remember that identity theft comes in many forms. We’ve explored several types of identity theft this year, from child identity theft to tax identity theft (which will be covered again in a couple weeks), but here’s one we haven’t covered: Medical Identity Theft.
Medical Identity Theft is when “a thief may use your name or health insurance numbers to see a doctor, get prescription drugs, file claims with your insurance provider, or get other care.” (Medical Identity Theft, Federal Trade Commission).
How often does Medical Identity Theft occur? It is the fastest growing type of identity theft. In a recent article by BenefitsPro, author Alan Goforth states, “more than 1.8 million Americans are victims of medical identity theft in 2013, a crime that is increasing at an annual rate of 32 percent” (“Fast-rising medical ID theft hits employers hard,” BenefitsPro). CSID also recently published the infographic to the right. This continued growth is due in part to the value of medical identities. As stated in the recent cyberSAFE Webinar Series, a social security number is worth one dollar on the black market, while a medical ID is worth $50.
Once you are a victim of Medical Identity Theft, it’s a tricky theft to clear up. Hospitals can sue the victim. Your benefits can be all used up by the time you know you are a victim. And worst of all, “If the thief’s health information is mixed with yours, your treatment, insurance and payment records, and credit report may be affected” (Medical Identity Theft, Federal Trade Commission). On average, medical identity theft costs an individual $18,000. 50% percent of victims do nothing to protect themselves from future victimization (cyberSAFE Webinar Series).
So how does medical identity theft happen? As noted in the CSID infographic on the right, there are three ways in which this theft can occur: (1) theft by a family member or friend, (2) a stolen social security number, or (3) a breach of electronic health records. Family and friend theft makes up 58% of the overall thefts, 30% of that total being a Robin Hood theme where the person knowingly gives their Medical ID to a family member to help them out (cyberSAFE Webinar Series). However, the third way, a breach of electronic health records, is a major concern to both Healthcare organizations and Information Security experts. “In fact, by 2015, 50 percent of healthcare organizations will have experienced one to five cyber-attacks in the previous 12 months. Moreover, one out of three of those attacks will be deemed successful, according to the latest health insights prediction report from IDC.” (2015 Healthcare Security Predictions Show Cybersecurity Need, Health IT Security).
So what can you do to protect yourself against medical identity theft? Start with the following tips offered by Everyday Health:
- Take your photo ID to all doctor appointments. Bring an ID along with your insurance information and any other documents, such as a Medicare card, so you can provide it. An FTC law known as the “red flags rule” encourages doctors and other health care providers to require proof of identity before providing services. You can write “See ID” on the signature line of your Medicare card, just as you can on a credit card, so your health care provider will be prompted to verify your identity. Also, when you’re asked to sign any paper at your doctor’s office, review the document first and be sure any erroneous information is corrected immediately.
- Don’t divulge medical or insurance information too freely. Sometimes you’re smart to be suspicious, especially of someone contacting you by phone. If you get a caller asking you to take a health care survey and requesting your health care provider’s name or your insurance information, hang up, and then call to alert your insurance provider. Also, be suspicious of health care providers and equipment suppliers who use telemarketing or door-to-door sales tactics, put the wrong diagnosis on a claim “so Medicare will pay,” or advertise free medical consultations for people with Medicare.
- Report any ID card loss immediately. If you lose your Medicare card or suspect it may have been stolen, call Social Security to get a replacement. Likewise, if you lose your insurance card, let your provider know right away.
- Review all of your insurance documents. Insurance information and statements of benefits can be confusing, and medical identity thieves know that many people don’t read them carefully. However, these documents are one of the first alerts that you may be a victim of medical identity theft. Read your statements and if they don’t seem right, call your insurer’s office. Before you call, verify that the phone number on the documents you have matches the one on your insurance card.
(“How to Protect Yourself From Medical Identity Theft,” Everyday Health).
For more information on Medical Identity Theft, watch the CSID’s cyberSAFE Webinar “Looking for a Cure for Medical Identity Theft.” You can also print the SANS Institute’s STH-Poster-HealthCare-Print poster, which provides information on where healthcare data is located and tips for securing healthcare data.