Medical identity theft is when someone uses your name, Social Security number, health insurance number or Medicare number to get medical care, prescriptions or devices, or to bill your insurer, as the Federal Trade Commission describes it. It often shows up on paper: an Explanation of Benefits (EOB) or a bill for care you never got, a collector chasing a medical debt you don’t owe, an unfamiliar medical collection on your credit report, or a notice that you’ve hit a benefit limit. If you spot one, call the provider and your health plan (or 1-800-MEDICARE), report it at IdentityTheft.gov, then use your federal rights to get and correct your records.
Act even when the amount is small. If a thief’s health information gets mixed with yours, the FTC warns, it could affect the care and benefits you can get and hurt your credit. Medical records are also harder to clean than a credit report.
This guide covers the medical side. For other identity checks, see how to check for identity theft; for credit freezes and the general recovery plan, see what to do if your identity is stolen.
Warning signs of medical identity theft
Any of these can be an honest billing mistake, so the HHS Office of Inspector General suggests calling the provider first. Watch for:
- A bill, EOB or Medicare statement for care, equipment or a prescription you didn’t get.
- A collector call or a credit report entry for a medical debt you don’t recognize.
- A notice that you’ve reached a benefit limit.
- Front-desk staff reading back the wrong address or birth date, or asking about a surgery you never had, an example from the California Attorney General.
- A breach letter saying your insurance or plan number was exposed. The HIPAA breach notification rule generally requires a health plan or provider to send that letter without unreasonable delay and no later than 60 calendar days after discovering the breach.
How to check an EOB or Medicare statement line by line
An EOB is a statement from your health plan. It shows the doctor, the date and the services, the FTC says. It often says “This is not a bill,” the California Attorney General notes. Original Medicare sends a Medicare Summary Notice instead, listing what providers billed, what Medicare paid and the most you may owe; it isn’t a bill either.
Check every line against your calendar, receipts and pharmacy history, including family members’ lines.
| Line on the statement | Compare it with | Red flag |
|---|---|---|
| Patient name and member number | Who on your plan actually had care | A claim for you or a family member when nobody had care |
| Provider, facility or supplier | The doctors, labs, pharmacies and suppliers you use | A practice, lab or equipment supplier you’ve never dealt with |
| Date of service | Your calendar and appointment reminders | A visit on a day you were somewhere else |
| Service, item or drug | What happened at the visit, and your pharmacy receipts | Tests, procedures, equipment or prescriptions you never got |
| Amount paid and what you may owe | The provider’s bills and your receipts | Payments or a balance for care you didn’t get; call the provider and plan before paying |
Where to find your statements. A Medicare.gov account shows Original Medicare claims as soon as they’re processed; paper notices come at least twice a year if you had services, or by email for any month with a processed claim. Part D plans send an EOB each month you fill a prescription, and Medicare Advantage plans send their own.
If a notice says you’ve hit a benefit limit, ask your plan for a listing of all benefits paid in your name, as the California Attorney General suggests. Medicare’s fraud prevention booklet adds that 1-800-MEDICARE can tell you about Original Medicare claims processed in the past 12 months.
What to do first when someone used your medical identity
Confirm the problem, then put it on record. Log each call with the date, the person’s name and what was promised, and keep copies of what you send.
- Call the provider’s billing office on the number from the bill, not one from an unexpected call or text, and ask whether it’s a billing error. At the front desk, ask the billing supervisor to flag your account as possible identity theft.
- Call your health plan on the number on your EOB or card, name the claims that aren’t yours, and ask it to investigate and send the related records. If your card was lost or stolen, ask about a new member number.
- With Medicare, call 1-800-MEDICARE (1-800-633-4227) if the provider can’t explain the charge, then see the Medicare steps.
- Report the theft at IdentityTheft.gov to get a recovery plan and an FTC Identity Theft Report, which you’ll need to block related debts on your credit reports. To report in another language, the FTC says to call 877-438-4338 and press 3.
- Pull your credit reports, free every week at AnnualCreditReport.com, and look for medical collections you don’t recognize.
- Request your records in writing from every doctor, clinic, hospital, pharmacy, lab and insurer the thief may have used.
A police report usually isn’t the first step. The FTC’s recovery guide says to file one if you have information about a suspect or a company asks for one as part of its dispute process, and the California Attorney General notes that some offices want one with a correction request.
Your rights to your medical records, and the deadlines
HIPAA, the federal health privacy law, gives you four tools. They apply to health plans and HIPAA-covered providers, and they reach beyond your chart: billing records and a plan’s enrollment, payment and claims records are part of your designated record set.
| Right | What you get | Deadline | Good to know |
|---|---|---|---|
| Access (45 CFR 164.524) | Copies of medical and billing records, or a plan’s claims records | 30 calendar days, plus one extension of up to 30 days with a written reason | A written request can be required if they’ve told you. Fees must be reasonable and cost-based, with no charge for searching or retrieval, and an unpaid bill doesn’t justify withholding copies. |
| Amendment (45 CFR 164.526) | A correction linked to the wrong entries, and efforts to notify people who got them | 60 days, plus one extension of up to 30 days with a written reason | They can require a written request with a reason, and can refuse on limited grounds, such as finding the record accurate and complete or not having created it. |
| Accounting of disclosures (45 CFR 164.528) | A list of certain disclosures from the past six years: date, recipient, what was shared and why | 60 days, plus one extension of up to 30 days with a written reason | The first one in any 12 months is free. It skips disclosures for treatment, payment and health care operations, so routine claims to your insurer won’t appear. |
| Complaint to HHS | A complaint the HHS Office for Civil Rights can investigate if a provider or plan breaks these rules | Within 180 days of when you knew, or should have known, of the problem, unless OCR extends it for good cause | Online through the OCR Complaint Portal, or by mail, fax or email. |
You may see 30 days quoted for corrections. Under the HIPAA rule, 30 days is the deadline for copies; amendment requests get 60 days, plus one 30-day extension.
How to ask. Write to the contact named in each office’s Notice of Privacy Practices, list the dates, providers and claim numbers from your EOB, and ask for medical and billing records. For electronic records, you can ask for an electronic copy in the form you choose, if it’s readily producible.
How to correct your medical records and bills
Mark every entry that isn’t yours, from visits and diagnoses to prescriptions, allergies and bills. Then, for each office:
- Write to each provider and plan. The FTC says to report errors in writing with a copy of the record, explain why it’s wrong and send it in a way you can track, such as certified mail. Request an amendment under HIPAA and include your Identity Theft Report.
- Name who else needs the fix. If they agree, they must at least identify the affected records and attach or link the amendment, and make reasonable efforts to notify people you name and others they know may rely on the error, such as labs, pharmacies and insurers.
- Dispute the bills. Tell the billing office and any collector that you didn’t receive the care and aren’t responsible for it, and ask your plan to investigate, as the California Attorney General advises. A plan’s claims records can be amended too.
- Track day 60. If there’s no answer and no extension letter by then, call, then follow up in writing.
If a provider or insurer won’t fix the record
A denial must come in writing, in plain language, with the reason and your options.
If they won’t release your records. Some providers refuse to give copies, saying they must protect the thief’s privacy. The FTC says to appeal to the person named in the provider’s Notice of Privacy Practices, the patient representative or the ombudsman, explain the situation and ask again.
File a statement of disagreement. The office must accept it, though it may limit the length, and may write a rebuttal, which it must give you. It must link your request, its denial, your statement and any rebuttal to the record, and send them, or an accurate summary, with later disclosures of that information. Without a statement, you can still ask that your request and the denial travel with the record.
Complain. Go to the complaint contact named in the denial, the HHS Office for Civil Rights within 180 days, or both.
Why medical records are harder to clean than a credit report
Credit reports have a fast, specific fix for identity theft. Medical records don’t.
- There’s no central file
- Credit files sit with three nationwide bureaus. Medical files sit with every office that treated or billed someone under your name, and the FTC tells victims to request records from each one.
- The clock is slower, and “no” is easier
- A bureau must block identity theft items within four business days of a complete request under FCRA section 605B and may decline only on grounds the law lists, such as an error or a misrepresentation. A provider gets 60 days, plus a possible 30, and may refuse if it believes the record is accurate and complete.
- Fixes are added, not erased
- Blocked items stop appearing in what a bureau reports. A medical correction is, at a minimum, attached or linked to the wrong entries, and while a thief’s information stays mixed with yours, it could affect your care, the FTC warns.
Medical debt from identity theft and your credit report
Federal rules as of October 2026. Apart from limits on certain veterans’ medical debt, no federal rule keeps medical debt off credit reports. The CFPB’s January 2025 rule would have kept it off the reports lenders see, but a federal court in Texas vacated it on July 11, 2025, at the joint request of the CFPB and the groups that sued, the CFPB’s rule page notes.
What the bureaus do voluntarily. Since July 2022, Equifax, Experian and TransUnion have left off paid medical collections and waited a year, up from six months, before unpaid ones can appear. Since April 2023 they’ve also left off medical collections with an initial reported balance under $500, according to Equifax and the bureaus’ joint announcement.
State laws. New York has barred credit bureaus from reporting medical debt since December 13, 2023, its attorney general says, and California’s ban took effect January 1, 2025. A CFPB interpretive rule from October 2025 says the FCRA generally preempts state laws in broad areas of credit reporting, and it rejects the CFPB’s 2022 view that states can keep categories such as medical debt off reports. It also says it has no force of law and that courts are the ultimate arbiters, and California’s attorney general says the state’s law still applies.
A court ruling in Texas. In August 2026 a federal court in Austin held that the FCRA preempts a Texas law that barred credit bureaus from reporting certain out-of-network medical debts, and it ordered Texas not to enforce that law. The order covers only the Texas law. Ask your state attorney general what holds where you live.
Identity theft debts can be blocked at any size. Send each bureau proof of your identity, your Identity Theft Report, the items to block and a statement that they aren’t yours; the law sets no minimum amount. Once the bureau notifies the company that reported the debt, that company may not sell it, transfer it for payment or place it for collection, under section 615(f). Sent straight to the company at the address it designates for such reports, your report also stops it from reporting the debt to the bureaus unless it later learns the information is correct, under section 623. IdentityTheft.gov’s “What To Do Next” steps walk you through the bureaus.
Collectors. Dispute in writing within the 30 days the collector’s notice gives you, and it can’t contact you to collect until it sends verification, the CFPB says. Say the debt came from identity theft and include your report. Under section 615(g), a collector told that must notify the creditor and, if you ask, give you the information about the debt you’d get in a dispute.
Extra steps if you have Medicare
The HHS Office of Inspector General takes fraud reports about Medicare and Medicaid, and Medicare adds its own lines.
- Open a Medicare.gov account to see Original Medicare claims as soon as they’re processed. It’s free and open around the clock.
- Call the provider first, since it may be an error. If that doesn’t settle it, call 1-800-MEDICARE (1-800-633-4227; TTY 1-877-486-2048).
- Have ready your name and Medicare Number, the provider’s name, the service or item, the date on your notice or claim, and what Medicare approved and paid.
- With Medicare Advantage or Part D, tell your plan too. You can also contact the Investigations Medicare Drug Integrity Contractor (I-MEDIC) at 1-877-7SAFERX (1-877-772-3379).
- Report fraud to the Inspector General at tips.oig.hhs.gov or 1-800-HHS-TIPS (1-800-447-8477).
- Get local help from a Senior Medicare Patrol at 1-877-808-2468. These programs, funded by the federal Administration for Community Living, help people with Medicare prevent, detect and report fraud, errors and abuse.
- Ask about a new Medicare Number if yours was misused. Call 1-800-MEDICARE; CMS says people with Medicare can ask to change it if it’s compromised.
How to make medical identity theft harder
- Treat your insurance and Medicare cards like credit cards. Keep EOBs and medical papers somewhere safe, shred them before you throw them away, and read each statement with the line-by-line check.
- Don’t give medical or insurance details to anyone who calls, emails or texts you out of the blue; the FTC says it could be a scammer. Turn down money or gifts offered for “free” care.
- If a breach letter names your insurance or plan number, ask your plan to note the breach and flag your account.
Shrinking your public profile can help too: the FTC’s 2014 data broker report cautioned that consumer profiles can draw identity thieves trying to guess passwords or security answers. Recordwell’s free self-check shows what our search turns up under your name, and you can remove your listing at no cost; neither involves medical, insurance or credit records. Our digital footprint guide and personal information checklist cover the rest.
Common questions about medical identity theft
What is medical identity theft?
It’s the use of your name, Social Security number, health insurance number or Medicare number to get care, prescriptions or devices, or to bill your insurer. The thief’s health information can also end up in your records.
Do I have to pay medical bills an identity thief ran up?
Don’t pay before disputing them. Tell the provider, your plan and any collector in writing that you didn’t receive the care, and send your FTC Identity Theft Report. Once a bureau blocks the debt and notifies the company that reported it, that company can’t sell it or send it to collections.
How long does a provider have to correct my medical records?
Under HIPAA, a provider or plan has 60 days to act on an amendment request, plus one extension of up to 30 days if it explains the delay in writing. Requests for copies have a 30-day limit, with the same single extension.
Can a hospital remove the thief’s information from my records?
HIPAA doesn’t require it. An accepted amendment must, at a minimum, be attached or linked to the affected records. If the hospital denies your amendment request, file a statement of disagreement, which stays linked to the record and goes out with future disclosures of it.
Will medical identity theft show up on my credit report?
It can, as a medical collection. The three nationwide bureaus voluntarily leave off paid medical collections and those with an initial reported balance under $500, and unpaid ones wait a year before appearing. Identity theft debts can be blocked at any size with an FTC Identity Theft Report.