🎯 In 30 seconds: Medical identity theft is when someone uses your name or insurance to get care, drugs or equipment. It drains benefits, can land bills in collections, and can put wrong information in your health record. The early warning is the Explanation of Benefits (EOB) your insurer sends. Read every one, and use your federal rights to get records and fix them.
Why this kind is different
A stolen card costs money. A stolen medical identity can also cost accuracy: the thief’s diagnoses, allergies or blood type can end up in your file. Fixing it means dealing with each provider and insurer separately, and privacy rules mean they may not freely share the thief’s records with you. The good news is that federal law gives you clear rights to see and correct your own record.
Reading an Explanation of Benefits
An EOB is not a bill. It is your insurer’s note of a claim it received. Check each line against your calendar.
| Field | What to check |
|---|---|
| Patient | Is it you, or the right family member? |
| Provider | Do you know this doctor, lab, clinic or supplier? |
| Date of service | Were you there that day? Compare with your calendar or phone photos. |
| Service or code description | Did you get that test, scan, drug or device? |
| Amount billed and paid | Large charges for things you never got are the clearest sign. |
| Your share | What you may owe. Don’t pay for anything you can’t confirm. |
Sign up for electronic EOBs in your insurer’s app so they arrive as claims are processed. The FTC also lists these signs: a collector calling about medical debt you don’t owe, unknown medical collections on your credit report, and an insurer saying you have hit a benefit limit.
If you have Medicare
- Original Medicare: you get a Medicare Summary Notice (MSN) by mail about every 6 months, but only for periods when claims were processed. Choose electronic MSNs at Medicare.gov and you get an email each month with a processed claim.
- Medicare Advantage or Part D: your plan sends its own EOBs.
- Help: the Senior Medicare Patrol (877-808-2468) helps people spot and report Medicare billing errors and fraud, free. You can also call 1-800-MEDICARE.
- Never give your Medicare number to a caller offering free braces, tests or equipment.
A worked example: Luis’s EOB
Luis, 47, gets an EOB listing an MRI on March 3 at a clinic across town. He was at work that day.
| Amount billed | $1,260 |
| Plan paid | $980 |
| Shown as Luis’s share | $1,260 − $980 = $280 |
| Deductible already used | $280 of his $1,500 deductible now counted against a scan he never had |
Luis calls the insurer’s fraud line (number on his member card) and reports the claim. He asks the clinic in writing for his records and a correction. He files at IdentityTheft.gov and asks whether he can get a new member ID. He tells the clinic not to send the $280 to collections while the dispute is open, and keeps copies of everything.
Your record rights, with the clocks
The HIPAA Privacy Rule gives you these rights with doctors, hospitals, pharmacies and health plans:
| Copy of your records | The provider must act within 30 days, with one extension of up to 30 more days if it tells you why in writing. Fees must be reasonable and cost-based. |
| Correction (amendment) | The provider must act within 60 days, with one extension of up to 30 days. |
| If it refuses to correct | You can file a written statement of disagreement, which must be kept with the record and sent with future disclosures of that information. |
| Who saw your record | An “accounting of disclosures” covering up to 6 years; the first one in any 12 months is free. It leaves out routine treatment, payment and operations uses, so it is most useful for unusual releases. |
The correction letter, step by step
- Request your records from each provider and insurer involved. Use their records-request form; keep a dated copy.
- Mark every entry that is not yours: dates, diagnoses, prescriptions, allergies, blood type.
- Write one letter per provider: “I am a victim of medical identity theft. Please correct or remove the entries listed below.” Attach copies of the marked pages and your FTC Identity Theft Report.
- Ask them to notify other providers or labs that received the wrong information.
- Send it in a way you can track, such as certified mail, and note the 60-day date.
- Dispute any medical collections on your credit reports with the bureaus (see Money Theft & Forensics).
If your insurance or health data showed up in a breach notice, start with After a data breach.
- Is an EOB a bill? Answer: No. It is the insurer’s record of a claim; check it against what you actually received.
- How long does a provider have to act on your correction request? Answer: 60 days, plus one extension of up to 30 days.
- The provider refuses to change a record. What can you do? Answer: File a written statement of disagreement, which stays with the record.
- Who helps people on Medicare review suspicious claims, free? Answer: The Senior Medicare Patrol, 877-808-2468.