Can a scammer misuse my medical records or health insurance information?
Yes — medical identity theft involves fraudsters using your insurance details to receive healthcare services or file false claims; it can corrupt your medical records and result in bills for treatment you never received.
Last reviewed: 10 June 2026
Explanation
Medical identity theft is among the most complex and damaging forms of identity fraud to resolve. Healthcare data is valuable on dark web markets because it can be used to obtain prescription drugs, medical equipment, or healthcare services billed to your insurance. Unlike financial fraud, medical fraud can corrupt your medical records — an attacker who receives treatment under your identity may introduce their blood type, allergies, medications, or diagnoses into your records, creating a patient safety risk if you later need emergency care.
Health insurance credentials — insurer name, policy number, and group number — are the primary target. These are obtained through insurer data breaches, healthcare provider breaches, or phishing attacks targeting healthcare portals. Fraudulent claims filed against your policy may exhaust your lifetime benefit limits or trigger audits that delay legitimate care.
Signs are often delayed: you may receive an Explanation of Benefits (EOB) from your insurer for services you never received, get a bill from a provider you've never visited, or only discover the fraud when your insurer flags unusual claim patterns. Some victims only discover medical identity theft when a debt collector contacts them or when a provider refuses care because 'your insurance was already used today'.
Actions: review every EOB from your insurer promptly and question any service you don't recognise. Request your medical records from providers annually to check for unfamiliar treatments. Contact your insurer's fraud department immediately if you spot suspicious claims. As a precaution after a healthcare data breach, request that your insurer add a note to your account requiring additional verification before processing claims.
Common red flags
- An Explanation of Benefits arrives for a medical service or prescription you didn't receive
- A bill arrives from a healthcare provider you've never visited
- Your insurer contacts you about a claim for a date when you weren't receiving care
- A provider tells you your insurance was already used today for a different patient
- Your medical records include treatments, medications, or diagnoses you don't recognise
What to do now
- Review your EOBs each time they arrive and question anything unfamiliar
- Request your medical records from providers you regularly use and review for inaccuracies
- Contact your insurer's fraud department immediately if you find suspicious claims
- File a report with the FTC and with the US Department of Health and Human Services (OCR) if your health data was part of a HIPAA breach
- Request that your insurer add extra verification steps before processing future claims under your policy
- Correct fraudulent entries in your medical records by submitting a written amendment request to each provider
Frequently asked questions
How do I get my medical records to check for fraudulent entries?
Under HIPAA (US) you have the right to request copies of your medical records from any provider. Most providers allow requests online or by form. There may be a copying fee but it is often waived for an initial records request.
Can medical identity theft affect my future healthcare?
Yes — fraudulent diagnoses, medications, or blood type entries can affect treatment decisions in emergencies. This is why correcting medical records promptly is as important as resolving the financial aspects.