Medical identity theft happens when someone uses your name or insurance information to get medical treatment, prescription drugs, or surgery, or when someone working in a medical or billing setting uses your information to submit false claims to your insurer. The fastest way to catch it is to read your bills, your insurance statements, and your medical records the same way you’d check a bank statement.
Warning Signs to Watch For First
Check for these signs before anything else. If you notice any of them, treat it as a possible case of medical identity theft and start documenting right away.
- A bill or collection notice for medical care, tests, or equipment you never received
- A call from a debt collector about a medical debt that isn’t yours
- An unfamiliar medical collection account on your credit report
- A notice from your health plan saying you’ve reached a benefit limit you never used
- Being turned down for insurance because your file shows a condition you don’t have
Step 1: Review Your Explanation of Benefits (EOB)
Your health plan sends an Explanation of Benefits, or EOB, after most visits or claims. It is not a bill, but it lists what was billed, what your plan paid, and what you may owe. Read every EOB, even for a plan you rarely use.
- Check the date of service against your own calendar or memory
- Check the provider name against who you actually saw
- Check the type of service or equipment listed
- Check your annual or lifetime benefit totals for unexpected activity
If your plan offers a member portal, you can usually pull older EOBs there instead of waiting for paper copies in the mail.
Step 2: Check Your Actual Medical Bills
Compare each bill against the matching EOB. A bill that doesn’t match any EOB, or that bills you directly for something your insurance was never told about, deserves a closer look. Call the provider’s billing office and ask them to walk through the charge before you pay anything you don’t recognize.
Step 3: Request and Review Your Medical Records
Under the HIPAA Privacy Rule, you have the right to see and get copies of your medical records, and to ask a provider to correct information you believe is wrong. Request records from any provider listed on a bill or EOB you don’t recognize, and look for diagnoses, visits, or prescriptions that aren’t yours. If you find an error caused by fraud, ask the provider in writing to correct it. Providers generally have 30 days to respond to that kind of written request.
Step 4: Check Account Access on Patient Portals and Insurance Logins
Log in to every patient portal and insurance account tied to your name. Look for:
- Login activity or password resets you didn’t make
- A mailing address, email, or phone number that isn’t yours
- Messages, refill requests, or appointment history you don’t recognize
If anything looks off, change your password immediately and turn on two-factor authentication if the portal offers it.
Step 5: Check Your Credit Report for Medical Debt
Medical billing errors caused by identity theft can end up on your credit report as collection accounts. Pull your credit reports from the three nationwide credit bureaus and look specifically for medical collection entries you don’t recognize.
Decision Path: What to Do If You Find Something Wrong
- Confirm it’s actually an error. Rule out simple mix-ups, like a shared name with a family member on the same plan, before assuming fraud.
- Report it at IdentityTheft.gov. This creates an Identity Theft Report and a personalized recovery plan with pre-filled letters you can send.
- Send your report to the health plan’s fraud department and to any provider involved.
- Ask the provider in writing to correct your medical record and to notify any other providers who may have received the same wrong information.
- Dispute medical collection accounts with all three credit bureaus if the error shows up on your credit report.
- File a complaint with the FTC, as described at consumer.ftc.gov, and consider a police report if you want a full Identity Theft Report.
Do not try to change or delete anything in your own medical history yourself. Correcting fraudulent entries is the provider’s job, and going through official channels protects the accuracy of your real medical record.
Practical Checklist
- Read every EOB, not just the bills
- Match bills to EOBs before paying
- Request medical records from any provider on a suspicious bill
- Check patient portal login history and contact info
- Pull your credit report and scan for medical collections
- Keep copies of every bill, EOB, and letter you send or receive
- Report suspected fraud at IdentityTheft.gov before contacting individual businesses
Who Should Be Extra Careful
Some groups face higher stakes from medical identity theft and benefit from checking records more often: people on Medicare or Medicaid, since those numbers are frequently targeted by scammers; people managing chronic conditions who rely on accurate records for ongoing care; older adults living alone who may not immediately notice unfamiliar mail or calls; and parents monitoring a child’s health information, since errors on a child’s record can go unnoticed for years.
Scammers impersonating Medicare, Social Security, or an insurance company by phone or text are a common way medical identity theft starts. If you get a suspicious call or message claiming to be from a government agency or your health plan, our guide to verifying government imposter contact walks through how to confirm it before responding. If the issue instead involves a health product purchase rather than insurance, our refund policy checklist for health purchases covers what to check before you dispute a charge, and our guide on reporting a suspected supplement problem explains the separate process for flagging a product safety concern.
Evidence Limits
This guide reflects general FTC and IdentityTheft.gov consumer guidance current as of this writing. It cannot tell you whether a specific bill, record, or account issue in your situation is fraud. That requires contacting the provider, insurer, or credit bureau directly. Recovery timelines, such as the 30-day response window for medical record correction requests, can vary by provider and by state law. This is not legal or medical advice.
Frequently Asked Questions
Is an Explanation of Benefits the same as a bill?
No. An EOB is a summary from your insurance plan showing what was billed and what it paid. It is not a request for payment, but it’s one of the fastest ways to spot a claim you don’t recognize.
Can I fix an error in my medical record myself?
No. Under HIPAA, you can request a correction, but the provider has to make the change. Contact the provider directly and put your correction request in writing.
Will reporting medical identity theft affect my real medical treatment?
Reporting fraud is meant to separate the fraudulent information from your real record, not change your actual treatment history. If a mixed-up record affects care you’re receiving, tell your treating provider directly so they can flag it in your chart.
Do I need a police report to fix medical identity theft?
Not always. IdentityTheft.gov can generate an Identity Theft Report without a police report in many cases, though some providers or credit bureaus may ask for one for serious or ongoing fraud.
Educational Disclaimer
This article is for general educational purposes only and is not medical, legal, or financial advice. It does not diagnose any condition and does not replace direct contact with your health care provider, insurer, credit bureau, or a qualified attorney. Always verify your specific situation using official government resources, including consumer.ftc.gov and identitytheft.gov.
