What Happens When My Health Data Falls Into the Wrong Hands

Health Information in the Wrong Hands
One of many ways to steal your medical files. Photographer: Anthony Harvie

If a thief wanted to grab your most personal information, he would likely find much of it in your medical records.

Few other types of documents contain as much private data as your health records, which can include your complete name, date of birth, Social Security number, insurance provider name and account number, credit-card numbers, employer information and, perhaps most unsettling, detailed diagnostic descriptions.

That's one reason why medical providers are breached more than any other type of organization, including retailers and government agencies, according to the Privacy Rights Clearinghouse, a nonprofit consumer rights group. It has recorded 690 breaches involving a total of 23 million records from medical providers since 2005.

Insurance fraud is the most common use of stolen health data, as thieves often get medical care and prescriptions in victims' names.

A study by the Ponemon Institute published last year estimated about 1.5 million people in the U.S. were affected by medical identity theft in 2011.

Victims can face potentially grave consequences, according to the World Privacy Forum. When medical identities are stolen, health records are changed to reflect the thieves' blood types, diseases and treatments. Most people find out they're a victim when they get letters from debt collectors.

Doctors and other health-care workers can also be culprits, billing for treatments that never occurred.

Beyond insurance fraud, stolen health data can be used for financial scams, such as opening lines of credit and taking out loans in victims' names.

Blackmail, as well as job and insurance discrimination, are worries, too. Health information could be used to pressure prominent people to pay to avoid the release of the data. The exposure of data on the Internet could lead to discrimination against job candidates or insurance customers.

Because there is no centralized database of health records, there isn't a single easy way to watch for changes in your health files. But the World Privacy Forum recommends that people who are concerned about medical identity theft ask their insurance companies for a copy of their statement of benefits and ask their doctors' offices for a copy of their health files to look for fraudulent procedures. Requesting your personal credit report can also help by identifying any unpaid bills that may have gone to debt collectors.

Before it's here, it's on the Bloomberg Terminal. LEARN MORE