<h1>Medical Identity Theft in Healthcare</h1>
<p><em>Publication Date: March 2010<br />
</em><em>Original Appearance: <a href="http://www.smartcardalliance.org/pages/publications-medical-identity-theft-in-healthcare">Medical Identity Theft in Healthcare</a><br />
</em></p>
<p>While identity theft is a global issue that garners much media  attention, most do not realize that medical identity theft is a serious  and growing threat. Many authorities consider medical identity theft one  of the fastest growing crimes in America. With the digital age of  healthcare upon us, the risks are expected to increase as electronic  medical records become more prevalent and the exchange of this data over  expanding networks becomes more pervasive. Heightened concern over  personal data security and privacy highlight the importance of having  secure electronic medical identities.</p>
<h2>1.5 Million Victims of Medical Identity Theft</h2>
<p>According to a recent Ponemon Institute study, nearly 1.5 million  Americans have been victims of medical identity theft with an estimated  total cost of $28.6 billion &ndash; or approximately $20,000 per victim. [1]  Further evidence of the significance of the medical fraud problem is the  allocation of $1.7 billion for fraud detection in the 2011 U.S. Health  and Human Services Department budget. [2] In 2009, 68 reported  healthcare data breaches in the U.S. put over 11.3 million patient  records at risk of exposure. [3] Two notable instances are the Health  Net breach and the Virginia Department of Health Professions breach.</p>
<ul>
    <li>
    <p><em>Health Net</em> (a Connecticut-based health insurance plan)  reported the loss of a hard drive containing seven years of personal and  medical information on about 1.5 million Health Net customers. They  reported the lost drive six months after it disappeared. [4]</p>
    </li>
    <li>
    <p><em>Virginia Department of Health Professions</em> was the victim  of a $10 million extortion plot to expose over 8 million patient  records and 35 million prescriptions. [5]</p>
    </li>
</ul>
<p>Patients whose medical identities are stolen face serious lingering  effects. Fraudulent healthcare events can leave erroneous data in  medical records. This erroneous information &ndash; like information about  tests, diagnoses and procedures &ndash; can greatly affect future healthcare  and insurance coverage and costs. Patients are often unaware of medical  identity theft until a curious bill or a surprising line of questioning  by a doctor exposes the issue. Then, the burden of proof is often with  the patient and it can be difficult to get the patient&rsquo;s legitimate  medical records cleaned up. The consequences can also be life  threatening and can lead to serious medical errors and fatalities.</p>
<p>The American Recovery and Reinvestment Act (ARRA) and the associated  provisions under the Health Information Technology for Economic and  Clinical Health (HITECH) Act have highlighted the need to address  privacy and security across our healthcare system. In fact, HITECH  requires that consumers be notified of healthcare data breaches.  Alerting patients when their personal health information has been  breached is a necessary response, but it is a reactive measure. It does  nothing to prevent the breach or address the subsequent issues patients  face when they are victims of medical identity theft. The healthcare  industry also needs policy that takes a proactive approach&ndash;one that  implements controls and technology that assure patient information is  always protected. It needs to make secure electronic medical identities a  priority.</p>
<p>As the ARRA provides incentives for more and more doctors to adopt  electronic health records (EHRs), and as health information exchanges  (HIEs) becomes more commonplace, consumers are even more at risk of  medical identity theft from an intentional or unintentional breach of  healthcare records, or the &ldquo;loss&rdquo; or theft of a laptop. Right now,  healthcare records are likely to be on paper, and secured by the  physical safeguards and administrative procedures in the doctor&rsquo;s  office. When these records are digitized and accessible via  interconnected EHRs and HIEs, the potential for exposure grows  exponentially.</p>
<p>A related issue to identity theft, and a significant problem for the  healthcare industry, is the problem of mistaken identity, which can be  life threatening. Today most HIEs rely on a record locator service (RLS)  to find where patients&rsquo; data are stored. Many use a &ldquo;probabilistic  match,&rdquo; which depends on various pieces of information such as the  patient&rsquo;s name, address, Social Security number, date of birth and other  personal information. These methods are not 100% accurate and can lead  to potentially fatal errors. For example, in an emergency situation, a  patient who has been incorrectly identified could be given a transfusion  of the wrong blood type. Compounding the issue is the fact that  patients must provide this personal information each time they visit a  provider so that their records can be located. These verbal and  paper-based identification processes are ambiguous and error-prone, as  well as ripe for fraud and abuse.</p>
<p><a href="http://www.smartcardalliance.org/pages/publications-medical-identity-theft-in-healthcare">Read More &gt;&gt;&gt;</a></p>