Medical Identity Theft: Signs and What to Do
When someone uses your insurance to get care, their health information can end up in your records. Fixing it takes paperwork, so start early.
By Siddharth ShankarUpdated October 19, 2026Medical identity theft means someone uses your name, Social Security number or insurance number to get medical care, prescriptions or devices, or to file claims. Signs include bills for care you never had, debt collectors calling about medical debt you do not owe, and an insurer saying you hit your benefit limit. Get your records, report errors in writing, check your credit reports and make a recovery plan at IdentityTheft.gov.
Scammers start with details that have already leaked. Is your email one of them?
Free · About 30 seconds · No sign-up · Email not stored
Most people think of identity theft as fake credit cards. Medical identity theft is quieter and can be more damaging, because it can put someone else’s health information into your file.
What it is
The US Federal Trade Commission describes medical identity theft as someone using your personal information, such as your name, Social Security number, or health insurance or Medicare number, to get medical care, prescription drugs or medical devices, or to file claims with your insurer. It can mix the thief’s health information with yours, which can affect your care and your benefits, and it can hurt your credit.
Warning signs
- You get a bill or an Explanation of Benefits (EOB) for services or prescriptions you did not receive.
- A debt collector contacts you about medical debt you do not owe.
- Your credit report shows medical collection notices you do not recognise.
- Your insurer says you have reached your benefit limit.
How it happens
Breaches of health data are a common source. A leaked name, date of birth and insurance number can be enough. See the Change Healthcare breach and the LifeLabs breach for large examples. Lost insurance cards and shared cards can also be misused.
Your best defence is knowing what scammers may already have. Check your email free.
Free · About 30 seconds · No sign-up · Email not stored
What to do, step by step
The FTC’s steps are the backbone of the plan:
1Get your medical records
Request copies from each doctor, clinic, hospital, pharmacy, lab and insurer where your details may have been used. You may need to fill in forms and pay fees. If a provider refuses, appeal to the contact in its Notice of Privacy Practices, its patient representative or its ombudsman.
2Review them for errors
Look for visits, diagnoses or prescriptions that are not yours.
3Report errors in writing
Send the provider a copy of the incorrect record and explain the problem, using a trackable method such as certified mail. The FTC says the provider must respond within 30 days and notify other providers that may have the same error.
4Check your credit reports
Get your free reports at AnnualCreditReport.com and look for medical billing errors. Report them to all three credit bureaus. Consider a credit freeze too.
5Make a recovery plan
Use IdentityTheft.gov to create a personal recovery plan, because the thief may have used your information in other ways.
If a family member is affected
Older relatives and children are often targets because nobody checks their statements. Help them read their EOBs and check their credit file or freeze it. Children’s records are rarely checked, so ask the insurer to confirm which services have been billed.
Prevent it from happening again
Treat your insurance number like a Social Security number. Read every EOB, do not share cards, and be wary of calls offering free medical equipment. If you suspect wider misuse of your identity, read what to do if your identity is stolen and how to prevent identity theft. Run the free check on this page to see whether your email has appeared in known breaches.
Sources
- FTC: What to know about medical identity theft (definition, warning signs, steps to request records, report errors, check credit, recovery plan)
Frequently asked questions
What is medical identity theft?
It is when someone uses your name, Social Security number or insurance number to get care, prescriptions or devices, or to file insurance claims.
How do I know if it has happened to me?
Look for bills or EOBs for care you did not get, collection calls for medical debt you do not owe, unknown medical collections on your credit report, or an insurer saying you reached your benefit limit.
Can medical identity theft affect my health records?
Yes. The thief’s health information can get mixed with yours, which can affect your care and benefits.
How do I fix errors in my medical records?
Request your records, review them and report errors in writing to the provider. The FTC says providers must respond within 30 days.
Where do I report it?
Create a personal recovery plan and report at IdentityTheft.gov, and tell your insurer and the providers involved.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Get alerted when your email leaks
Every NordVPN plan includes Dark Web Monitor, which alerts you if your email appears in new leaks.
See NordVPN →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.