Someone used your identity for medical care: what to do
The envelope looked routine until you read it. An explanation of benefits for a knee MRI you never had. A bill from an emergency room in a city you haven’t visited. A collection notice for an ambulance ride. Or your insurer tells you that you’ve hit a benefit limit you couldn’t possibly have reached. Somewhere, someone has been getting care under your name.
That is medical identity theft: someone using your name, insurance member ID, Medicare number, or Social Security number to see a doctor, fill prescriptions, or file claims. It is unsettling in a way other identity theft isn’t, because it touches your health record, not just your money. The good news is that it can be untangled, and you have more rights here than most people realize.
Why this one needs more care than a bad credit card
When a thief runs up a credit card, the damage is financial and it stays on paper. When a thief is treated under your name, their details can end up in your medical file — a blood type, an allergy, a diagnosis, a medication you don’t take. A future doctor could rely on that. That is why the goal is not only to stop paying for someone else’s care, but to get your records corrected so they describe you again.
It helps to know how it usually happens. Insurance and Medicare numbers show up in data breaches, on stolen mail, in lost wallets, and through calls pretending to offer free medical equipment or genetic tests. Sometimes it is someone close to you who had access to your cards. None of that is a failing on your part. If a company recently told you your data was exposed, our guide to what to do after a data breach notification letter covers the broader lockdown steps.
Start with the paperwork you already have
Gather every explanation of benefits, bill, and collection notice that doesn’t fit. Then log in to your health plan’s member portal (or call the number on the back of your card, not any number printed on the suspicious letter) and pull your full claims history. Look for providers you don’t know, dates you were elsewhere, and prescriptions you never filled. If you are on Medicare, your Medicare Summary Notices and your account at Medicare.gov show the same history.
Write down each claim that isn’t yours, with the provider name, date of service, and claim number. That list becomes the spine of everything that follows.
Tell your insurer and ask for a new member number
Call your health plan’s fraud department, explain that claims on your account were not for you, and send them your list. Ask whether they can issue you a new member ID so the old one stops working. Medicare beneficiaries can report suspected fraud at 1-800-MEDICARE and, where a number has clearly been misused, ask about getting a new Medicare card number.
Get your records, then ask for corrections
Under HIPAA, you have the right to request copies of your medical and billing records from each provider and pharmacy that treated someone under your name. Put the request in writing and keep a copy. Some offices will hesitate, worried about releasing what they see as the thief’s information; an FTC Identity Theft Report and a calm explanation usually helps.
Once you have the records, send each provider a written request to correct or amend the entries that aren’t yours, and to notify anyone they shared that information with, such as labs or other insurers. Keep it simple: what is wrong, why, and what you want changed. Providers can’t always delete entries outright, but they can flag them and add your statement so the next clinician knows.
Report it and deal with any debt
File a report at IdentityTheft.gov. It generates an FTC Identity Theft Report and a recovery plan, and that report is the document insurers, providers, and collectors respond to. A police report can help too, especially if you know or suspect who did it. The FTC’s own guidance on medical identity theft is a good checklist to keep open alongside this post.
Then pull your free credit reports at AnnualCreditReport.com. If medical collections you don’t owe appear, dispute them with each bureau and with the collector in writing, including your FTC report. If the thief also used your Social Security number, a credit freeze is worth doing now; our guide to what to do when someone opens accounts in your name walks through freezes and disputes step by step.
Keep watching quietly for a while
Medical identity theft tends to surface slowly, because claims and bills trail the actual visit by weeks or months. For the next year, read every explanation of benefits when it arrives rather than filing it away, and glance at your claims history every couple of months. If the same person keeps using your identity across benefits, it can also show up with tax records; our tax identity theft guide covers that side.
If you suspect someone specific, or the claims point to a pattern you can’t make sense of, that is where an investigation can help connect the dots. But most people get through this with the steps above, some patience, and a folder of copies. You are not responsible for someone else’s care, and you are allowed to insist your records say so.
— Gus