Medical Identity Theft:Past, Present, and Future…

Alaska Bar AssociationHealth Law SectionNovember 1, 2007

Presented by:Dawn Carman, Esq., RHIA, FACHEChief Risk & Compliance OfficerAlaska Native Tribal Health Consortium

Goals

Overview of identity theft? How do thieves steal your identity? Ramifications Safeguards

What is medical identity theft? How do thieves steal your medical identity? Duties of health organizations Ramifications Safeguards

Federal and state laws Q&A

Who is Frank W. Abagnale?

What Is Identity Theft?

Identity theft occurs when someone uses your personally identifying information, like your name, Social Security number, or credit card number, without your permission, to commit fraud or other crimes

Federal Trade Commission The fastest growing crime in the US Occurs every 3-79 seconds

IDProtect.Com Identity Theft Resource Center

How Much Do You Know AboutIdentity Theft?

Take a quiz http://onguardonline.gov/quiz/

idtheft_quiz.html http://www.idtheftcenter.org/artman2/

publish/c_theft_test/Fact_Sheet_102_Consumer_Risk_Test.shtml

What Are The Numbers?

8.4M identity theft victims per year down from 10.1M in 2003

Mean fraud per victim $5720 Mean resolution time per victim 25

hours Javelin Strategy & Research Survey Feb

2007

How Do Thieves Steal Your Identity?

Dumpster Diving Rummaging through trash looking for

documents with your personal information Skimming

Stealing credit/debit card numbers using a special storage device when swiping your card

Phishing Pretending to be financial institutions or

companies and send spam or pop-up messages to get you to reveal your personal information

How Do Thieves Steal Your Identity?

Changing Your Address Diverting your billing statements to another

location by completing a change of address form

Old-Fashioned Stealing Stealing wallets, purses, and mail Stealing personnel records Bribing employees who have access

Pretexting Using false pretenses to obtain your personal

information from financial institutions, telephone companies, and other sources 

Identity Theft Ramifications

Credit card fraud Phone or utilities fraud Bank/finance fraud Government documents fraud Use your SSN to get a job Rent a house in your name Use your info during an arrest Get medical services using your name

Federal Trade Commission

WHAT CAN YOU DO?

DETER Deter identity thieves by safeguarding your information

DETECT Detect suspicious activity by routinely monitoring your financial

accounts and billing statements

DEFEND Defend against identity theft as soon as you suspect a problem

What Is Medical Identity Theft?

Someone uses a person's name and other parts of their identity without the person's knowledge or consent to Obtain medical services Obtain prescription drugs and medical equipment Make false claims to insurance

companies

What is Medical Identity Theft?

The least understood and most poorly documented identity theft crime Takes a financial toll Takes an emotional toll Can kill you!

Medical Identity Is

A doctor falsifies medical records of patient claiming that they have received medical treatments that they never did and submits false claims

A nurse at a physician's office calls in prescription for a patient, but picks up the prescriptions for herself.

Someone walks into the emergency department at a hospital claiming to be someone else (without that person's permission) so that they can receive emergency medical care

A woman gets surgery claiming to be someone else Presented medical insurance information and an altered

driver's license to impersonate a friend without that friends permission

Did not have medical insurance of her own B. Koerner, Medical Identity Theft: What It Is and Is Not,

About.com

Medical Identity Theft Is Not

A lab tech uses personal information in your medical record to open up a credit card account in your name

Someone walks into the emergency department at a hospital claiming to be someone else, with that persons permission, so that they can receive emergency medical care

A patient is faking a medical condition and gets a doctor to collaborate with them and falsify medical records

B. Koerner, Medical Identity Theft: What It Is and Is Not, About.com

Medical Identity Theft Example 1

A CO flightseeing business owner got a hospital bill for $41,188

He called the hospital and realized that someone had stolen his personal information to pay for a surgery

Investigators traced the crime to a former newspaper clerk at a newspaper in which the man had placed an ad for his business.

"He asked for my Social Security number, and I now realize I shouldn't have given it to him.”

The hospital would not let the man see his medical records because the signature on his driver’s license did not match that of the medical identity thief

The hospital wrote off the loss, but the man has not been able to erase unpaid debt from his credit record, affecting his business loans

Medical Identity Theft Example 2

A Boston psychiatrist made false entries in medical records for individuals who were not his patients

He gave diagnoses such as drug addiction and severe depression

He used their personal information to submit false bills to insurance companies

Victims had difficulty getting the information removed from their real medical records

Victims were concerned about future health care coverage and employment

How Much Do You Know About Medical Identity Theft?

Medical Identity Theft: The Information Crime That Can Kill You http://www.worldprivacyforum.org/medi

calidentitytheft.html

What Are The Numbers?

$49.3B per year Javelin Strategy & Research Survey Feb

2007

20,000 reported cases 1992-2006 Federal Trade Commission 2006

Estimated 250,000- 500,000 cases of medical identity theft per year

World Privacy Forum

Can Health Care Fight Fraud?

In 2006, Blue Cross/Blue Shield, the nation’s largest health care network, pursued 20,000+ cases of health care fraud through identity theft and impersonation

206 convictions

Medical Identity Theft Ramifications

Medical identity theft is a crime that can cause great harm to its victims

Although high risk, it is the least studied and most poorly documented of the cluster of identity theft crimes

It is the most difficult to fix after the fact because victims have limited rights and recourses

It leaves a trail of falsified information in medical records that can plague victims’ medical and financial lives for years

The World Privacy Forum 

Medical Identity Theft Ramifications

Medical record alterations Allergies Medical and surgical history Drug contraindications Blood type Serious injury or death

Medical Identity Theft Ramifications Medical bills Collection agencies Denial of health insurance coverage Denial of employment Impact on legal rights

Medical Identity Theft:The Victim’s Perspective

Lack of recourse Lack of rights Lack of help No blanket rights to correct erroneous

medical records In some cases victims have been denied

access to compromised records No right to prevent providers,

clearinghouses, or insurers from reporting information resulting from identity theft

The World Privacy Forum

Medical Identity Theft:Victims Falling Through Gaps

Financial identity theft experts often knowledgeable of health privacy laws

FTC is not responsible for addressing medical identity theft

DHHS is responsible for medical identity theft No published focused studies No published guidance

The World Privacy Forum

The World Privacy Forum:Medical Identity Theft Findings

Medical identity theft is a separate and distinct crime from other types

Medical identity theft is a serious crime with substantial consequences on patient well-being affecting medical record accuracy and health care financial losses

Medical identity theft is under researched and under reported

Victim recourse is limited

Findings Continued

Medical identity theft can be challenging to uncover

Uncorrected medical record errors have a long-range negative impact on medical research using patient records

The proposed National Health Information Network may increase risks to patient safety, privacy, and security of patient data.

Victims may learn of their identity theft after much damage has been done

The World Privacy Forum:Medical Identity Theft Recommendations

Medical identity theft needs national attention

Medical identity theft victims need expanded accounting of disclosures

Patients must have the right to correct errors in their medical records

DHHS needs to implement victim protections similar to those of the FTC

Health insurers should send each beneficiary a free annual list of all claims

Recommendations Continued

Patients should receive one free copy of their medical records from providers

Patients must be notified of data breaches promptly

Medical identity theft should be considered as part of computer system risk assessments

National Health Information Network prototypes need testing for medical identity theft

Medical Identity Theft inthe Electronic Age

“As the health care system transitions from paper-based to electronic, this crime may become easier to commit and harder to trace. Victims may find it more difficult to recover from medical identity theft as medical errors are disseminated and re-disseminated through computer networks and other medical information-sharing pathways.”

The World Privacy Forum

Health Organizationsand Protecting Data

HIPAA Privacy and Security Rules Hospital privacy policies Consumer protection laws Common law duty of care Medicare Conditions of Participation

Medical Identity Theft Safeguards

Consider requiring picture ID for health care service to protect patient safety and help prevent medical identity theft and fraud

Education the workforce and patients on medical identity theft

Implement a protocol to investigation allegations of medical identity theft

Partner with law enforcement

Medical Identity Theft Safeguards

Be careful to whom you give name, social security number, and date of birth

If you are the victim of identity theft, take all actions you can think of to protect yourself Contact creditors Work with the health care provider Work with insurance companies Request correction of medical records Contact the Social Security Administration

Federal Data Security Laws

Financial, securities, and consumer protection laws Title V of Gramm-Leachy-Bliley Act

15 USC §§ 6801-09 FTC Standards for Safeguarding Customer Information

16 CFR Part 314 SEC Regulations

17 CFR Part 248 Privacy of Consumer Financial Information

16 CFR Part 313 et seq. Fair Credit Reporting Act

15 USC §§ 1681-1681x Identity Theft Red Flags and Address Discrepancy Rule under FACT Act

Pub. L. No. 108-159 Federal Trade Commission Act

15 USC § 45(a) Customer Information Program Rules under the Patriot Act

31 USC § 5318(I) Health Insurance Portability and Accountability Act

42 USC § 1320d et seq. Drivers Privacy Protection Act

18 USC § 2721-2125 Family Education Rights and Privacy Act

20 USC § 1232g Department of Veterans Affairs Information Security Act

38 USC § 5721-28

State Identity TheftCriminal Law Enforcement

All 50 states and DC have some form of legislation that prohibits identity theft

In all states except ME, identity theft can be a felony 11 states uses a narrow approach to criminalization by

focusing on the use of personally identifiable information with intent to defraud

Other states use a broad approach including unauthorized use, possession, creation, recording, obtaining, selling, giving, or transmitting of personally identifiable information

State laws are rapidly changing Trend in making criminal laws more specific

Example: Making it a separate crime to traffic in stolen identities or to engage in phishing

The President’s Identity Theft Task Force Apr 2007 Report

More Info on Identity Theft Javelin Strategy & Research Survey February 2007

http://www.privacyrights.org/ar/idtheftsurveys.htm FTC Deter, Detect, Defend Campaign

http://www.ftc.gov/bcp/edu/microsites/idtheft/ Medical Identity Theft: The Information Crime That Could Kill You

http://www.worldprivacyforum.org/pdf/wpf_medicalidtheft2006.pdf Take Charge: Fighting Back Against Identity Theft

http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt04.shtm US Department of Justice

http://www.usdoj.gov/criminal/fraud/idtheft.html Identity Theft 911

http://www.identitytheft911.org/home.htm US Social Security Administration

http://www.ssa.gov/pubs/idtheft.htm Fight Identity Theft

http://www.fightidentitytheft.com/ Identity Theft Resource Center

http://www.idtheftcenter.org/ The President’s Identity Theft Task Force Apr 2007 Report

http://www.idtheft.gov/reports/VolumeII.pdf

Questions?