MEDICAL IDENTITY THEFT Presented by: Tami Flemmer, Risk Management Director Melissa Hauer, Corporate Counsel Ernie Thurman, Security Coordinator October 8, 2014
Medical Identity Theft OVERVIEW OF PRESENTATION 1. What Is Medical Identity Theft? 2. The role of Security and Risk Management 3. Case Study. 4. What Can Be Done To Avoid Or Correct It?
Medical Identity Theft In the U.S., an estimated 1.5 million people have their medical identity stolen each year.
Medical Identity Theft A recent survey showed that medical identity theft accounted for 43 percent of all identity thefts reported in the United States in 2013. - Identity Theft Resource Center
Medical Identity Theft It is a far greater percentage than identity thefts involving banking and finance, the government and military, or education. The U.S. Department of Health and Human Services says that since 2009 the medical records of between 27.8 million and 67.7 million people have been breached.
What Is It? Medical identity theft occurs when someone steals your personal information, such as your name, Social Security number, or Medicare number, to obtain medical care, buy drugs, or submit fake billings to Medicare in your name. - Office of Inspector General, U.S. Department of Health & Human Services
What Is It? A thief may use this information to: see a doctor, get narcotic prescription drugs, file claims with your insurance provider, get hospital or other care.
What Is It? Some thieves are involved in organized theft rings that buy stolen patient information on the black market and set up fake clinics to make bogus claims against the health policies of patients who aren t even involved in the scam.
Examples A Massachusetts psychiatrist created false diagnoses of drug addiction and depression for people who were not his patients to submit medical insurance claims for psychiatric sessions that never occurred. One victim, who had never even been a patient, discovered the false diagnoses when he applied for a job.
Examples An identity thief in Missouri used the information of actual people to create false driver s licenses in their names. Using one of them, she was able to enter a clinic, obtain the health records of the woman she was impersonating, and leave with a prescription in the woman s name.
Examples A woman working in a dental office gained access to protected information of Medicaid patients in order to illegally obtain prescription drugs.
Examples A Pennsylvania man found that an imposter had used his identity at five different hospitals in order to receive more than $100,000 in treatment. At each health care provider, the thief left behind his medical history in the victim s name.
Examples In Colorado, a man whose Social Security number, name and address had been stolen received a bill for $44,000 for a surgery he had not undergone.
Examples When a 17 year old girl tried to donate blood for the first time, she was denied without explanation. She called Red Cross headquarters and found that her Social Security number had been used to receive treatment at a free AIDS clinic, rendering her ineligible to donate blood.
Why Medical Identity Theft? Thieves have learned that using your medical credentials your name, Social Security Number and health insurance numbers to order goods and services that are never delivered and billing organizations like Medicare and Medicaid, are more profitable than drugs, prostitution, and other crimes.
Why Medical Identity Theft? Thieves have quickly learned that medical identities are 20 to 50 times more valuable than financial identities.
Medical Identity Theft Effects Medical identity theft damage can be financial and medical. It can cause serious damage to a victim s credit rating which may take months or years to correct. If the thief s health information is mixed with yours, your treatment, insurance and payment records may also be affected.
Medical Identity Theft Effects Inaccurate medical records. A thief s treatment history can end up in your medical records. This can include the wrong blood type, or medicine to which you re allergic. Your records can reflect damaging and inaccurate diagnoses such as drug seeking behavior or mental illness.
Medical Identity Theft Effects Bad Credit. Thieves often ring up large hospital bills and then don t pay. The victim may be hassled by bill collectors, rejected for loans, or faced with paying a higher interest rate. He or she could also lose a job or be turned down for housing.
Medical Identity Theft Effects Legal problems. A pregnant woman stole the medical identity of a mother and delivered a baby who tested positive for illegal drugs. Child Protective Services tried to take away the identity theft victim s four children because they mistakenly believed she was the addict.
Case Review Situation Actions Lessons learned
Awareness What can we do? Educate leaders, staff and patients. Carefully review EOBs Closely review medical record / electronic access Secure personal information even when hospitalized Shred confidential documents Seek providers with good privacy / security practices Be safe with internet transactions involving PHI.
Prevention Create medical identity theft response team and program administration, privacy / security officer, IT, corporate compliance, registration, HIM, risk mangement. Develop clear program for identifying and responding to allegations Prehire background checks
Policies and procedures to protect information Release of PHI or billing information Flagging records Correction of records Cybersecurity Regular password changes Remote device wiping capability Use of cell phones, notebooks for PHI
Addressing Medical Identity Theft Take each incident seriously Law enforcement is your friend! Alert your response team Flag records Place account on hold Error vs actual theft Registration error Operational error Legitimate change, i.e. marriage / divorce
Confirmed theft. Now what? Connect victim with privacy officer to review records. Connect victim with attorney general s office Encourage victim to notify insurance company Separate thief s medical record from victim s record Send corrected medical records to anyone who may have received incorrect records.
QUESTIONS?