Medical Identity Theft: Warning Signs and How to Fix It

A statement arrives from your health insurer listing an MRI in a city you have never visited. Or a collector calls about an emergency room bill you know nothing about. It is easy to assume it is a billing glitch and toss it. Sometimes it is. Sometimes it is medical identity theft, and ignoring it can leave false diagnoses in your records, debts on your credit report and a drained insurance benefit.

This guide shows you where the warning signs hide, how to confirm what happened and the exact steps to correct your medical records and dispute fraudulent claims.

What medical identity theft is

Medical identity theft is when someone uses your personal information, such as your name, Social Security number, health insurance member ID or Medicare number, to get medical care, buy prescription drugs or submit fake claims to your insurer or Medicare.

It usually happens in 1 of 3 ways:

• A thief gets treated as you. They show up at a clinic or ER with your insurance details, and their visit, diagnoses and test results land in your file.
• A dishonest provider bills for care that never happened. Your member ID is used to submit claims for equipment, tests or services you never received.
• Your data leaks in a breach or scam. Hospital, insurer and billing company breaches, phishing calls offering “free” genetic tests or braces, and stolen wallets all expose insurance numbers.

The money is only part of the damage. If someone else’s blood type, allergies or diagnoses get mixed into your chart, a future doctor could make decisions based on the wrong information.

Key takeaway: Medical identity theft is both a financial problem and a safety problem. Fixing your bills is not enough; you also need to correct your medical records.

Warning signs to look for

The Federal Trade Commission lists 4 classic warning signs:

1. A bill or Explanation of Benefits (EOB) for services you did not get or drugs you do not take.
2. A debt collector contacting you about medical debt you do not owe.
3. Medical collection accounts on your credit report that you do not recognize.
4. Your health insurer saying you have reached a benefit limit.

Other red flags include being denied coverage for a condition you do not have, a pharmacy saying a prescription was already filled, an unfamiliar provider in your patient portal, or a breach notice from a hospital, lab or insurer.

How to read your EOB for fraud

Your Explanation of Benefits is not a bill. It is your insurer’s record of every claim submitted under your name, which makes it the best early warning system you have. Medicare beneficiaries get a Medicare Summary Notice that does the same job, and Medicare Advantage and Part D plans send their own EOBs.

Check every EOB line against this list:

Turn on electronic EOBs in your insurer’s app or website so you see claims within days instead of weeks. If you already use a patient portal, check the visit history there too. Our guide to reading a medical bill explains the codes and terms.

Step-by-step: what to do if you find fraud

Work through these steps in order and keep a log of every call, letter and reference number.

Step 1: Call the provider and your insurer

Start with the billing office of the provider on the claim. HHS’s Office of Inspector General advises contacting the provider first to see if the charge is a mistake, since coding and name-matching errors happen. If it is not a simple error, call your insurer’s fraud line, explain that you did not receive the service and ask them to flag your account, investigate the claim and issue you a new member ID if needed.

Step 2: Report it at IdentityTheft.gov

Create an identity theft report and recovery plan at IdentityTheft.gov, the FTC’s official site. The FTC report is often what providers, insurers and credit bureaus ask for as proof. Some people also file a police report, which can help if a provider or collector requires one.

Step 3: Get copies of your medical records

Ask every doctor, hospital, lab, pharmacy and insurer the thief may have used for copies of your records. Under HIPAA you have a right to access your records, though forms and reasonable fees may apply. Our guide to getting your medical records online walks through the request process.

Also ask for an accounting of disclosures, a list of certain disclosures of your health information made by the provider or insurer. It can show who received your information.

Providers sometimes hesitate to share records that contain a thief’s information. If that happens, use the privacy contact listed in the provider’s Notice of Privacy Practices or ask for the patient representative.

Step 4: Ask for corrections in writing

Review each record for visits, diagnoses, test results, allergies, blood type and prescriptions that are not yours. Then send a written amendment request to each provider and insurer:

• Identify each incorrect entry and explain why it is wrong.
• Attach a copy of your FTC identity theft report.
• Ask them to correct the record and notify anyone they shared the wrong information with.
• Send it in a way you can track, such as certified mail or the portal’s secure messaging.

Under the HIPAA Privacy Rule, a covered provider or plan must act on an amendment request within 60 days, with one possible 30-day extension if it explains the delay in writing. If it denies your request, it must explain why in writing, and you can file a statement of disagreement that stays attached to your record. This is not legal advice.

Step 5: Dispute bills and collection accounts

Write to the provider’s billing office and any debt collector stating that you did not receive the services and that you are a victim of identity theft. Include your FTC report. Do not pay a bill you do not owe just to make collection calls stop.

Step 6: Check and fix your credit reports

Get your free credit reports from Equifax, Experian and TransUnion through AnnualCreditReport.com and look for unfamiliar medical collections. Dispute fraudulent entries with each bureau using your identity theft report. Our guide to disputing a credit report error covers the process.

How medical debt shows up on reports has changed. In 2023 the 3 bureaus said they would stop reporting paid medical collections and medical collections under $500. A CFPB rule that would have removed most medical debt from credit reports was vacated by a federal court in Texas in July 2025, so check each bureau’s current policy. Consider a credit freeze if your Social Security number was exposed.

If you have Medicare or Medicaid

Medicare numbers are a common target. If you see services you did not get on a Medicare Summary Notice:

1. Call the provider first to rule out a billing mistake.
2. If that does not resolve it, call 1-800-MEDICARE or your local Senior Medicare Patrol at 1-877-808-2468.
3. Report suspected fraud to the HHS Office of Inspector General hotline at 1-800-HHS-TIPS (1-800-447-8477) or online at oig.hhs.gov.

Medicare Advantage and Part D members should also contact their plan’s fraud line. For Medicaid, report to your state Medicaid agency or its fraud control unit. Never give your Medicare number to callers offering free equipment, tests or gifts. If you help an older relative with this, our guide to protecting aging parents from fraud is a good companion.

How to prevent medical identity theft

You cannot control every breach, but you can make your information harder to use:

• Read every EOB and Medicare Summary Notice, even when it says “This is not a bill.”
• Guard your insurance card like a credit card. Do not post photos of it or share your member ID with unsolicited callers.
• Shred old EOBs, prescription labels and medical paperwork.
• Lock down portals with strong passwords and two-factor authentication.
• Act on breach letters. Our health data breach guide explains what to do after a notice.
• Ask why when a provider requests your Social Security number. Many do not need it.

The bottom line

Medical identity theft is fixable, but it takes persistence. Catch it early by reading your EOBs, report it at IdentityTheft.gov, and correct your records in writing with each provider and insurer. Keep copies of everything. If you are dealing with other fraud too, our guide on what to do if you got scammed can help you cover the rest.

Sources

• FTC: What to know about medical identity theft — warning signs and recovery steps
• HHS Office of Inspector General: Medical identity theft consumer alert — Medicare reporting steps and hotline numbers
• 45 CFR 164.526: Amendment of protected health information — 60-day deadline and statement of disagreement rights
• IdentityTheft.gov — official FTC identity theft reporting and recovery plans
• CFPB: Rule to remove medical bills from credit reports (archived) — background on the medical debt rule later vacated in 2025