ITRC Solution 31

You have the right to see a consumer report under the Fair Credit Reporting Act.  Under the FCRA, a “consumer report” may include information other than that which is provided by the credit reporting agencies (CRAs). Additionally, anyone suspecting a problem with fraud or identity theft is entitled to a free report from the CRAs and other agencies which provide rating information about consumers.

Medical Insurance Industry Records

The Medical Information Bureau (MIB) report is used by nearly 500 insurance companies in the United States and Canada. It lets insurers share health medical history to verify medical profiles, including pre-existing conditions, details of medical history and a list of all insurers that received a copy of your file during the last 12 months.  This should be checked by anyone dealing with medical identity theft. MIB’s toll-free number for disclosure is 866-692-6901 (TTY 866-346-3642 for hearing impaired).

Additional Resources

Medpoint
(888) 206-0335
MedPoint Compliance, OptumInsight
2525 Lake Park Blvd,
West Valley City Utah 84120.
http://www.optuminsight.com/

Request a copy of your IntelliScript drug history report:
IntelliScript
Phone: (877) 211-4816
www.rxhistories.com/how_it_works.html

Request a copy of your insurance claims history:
Blue Cross Blue Shield
Find your local BCBS member company
http://www.bcbs.com/contact-us/

 

Utilities and Telephone Records

The National Consumer Telecom and Utilities Exchange, Inc. (NCTUE) collects negative information from many telecommunication and utility companies.  The NCTUE provides a database (managed by Equifax) which is shared by member companies.  Because this information is shared with other companies, it is a consumer report. Therefore, your information must be made available to you for free under the FCRA. You should also be able to correct and delete fraudulent information, and access a list of any entities that accessed this database.

NACM Southwest
P.O. Box 167688
Irving TX 75016-7688
Telephone 972-518-0019
email: nctue@equifax.com

 

This solution sheet should not be used in lieu of legal advice. Any requests to reproduce this material, other than by individual victims for their own use, should be directed to itrc@idtheftcenter.org.

ITRC Letter Form 130A

ITRC Letter Form 130A – Request for Medical Records, is for use by victims of medical identity theft.  This sample letter uses language that may be useful in making a case for removing incorrect information from a health provider’s record:

For additional information, please refer to ITRC Fact Sheet FS 130 –  Correcting Misinformation on Medical Records

Click to download the form:

LF 130a Form

This letter form should not be used in lieu of legal advice. Any requests to reproduce this material, other than by individual victims for their own use, should be directed to itrc@idtheftcenter.org. ITRC thanks the CRA’s in providing material for this guide.

Copyright, Identity Theft Resource Center®, all rights reserved. Created by ITRC

ITRC Fact Sheet 130A

Misinformation on medical records may be caused by human error or identity theft. It can lead to an inaccurate diagnosis of a condition and could be fatal if the information causes a drug interaction, allergic reaction or inappropriate diagnoses.

You should be able to fully correct medical records created in your name. HIPAA, the Health Insurance Portability and Accountability Act, is a federal law that protects patients from unauthorized access to personal medical information and addresses the problem of errors in medical records.

Health care providers are often unwilling to remove any information from your medical record because it may simply be a case of mixing two patients’ records and they don’t want to lose any information regarding either patient. Outlined below are steps that you can take to rectify mistakes in your medical records and protect yourself from the consequences associated with erroneous health records.

For the purpose of this information guide, all information provided is per HIPAA regulations. We suggest that you also check your state laws about any additional rules or regulations regarding healthcare privacy and record correction.

How to correct errors in your medical and insurance records

  • Request copies of your medical records from any health care provider where you feel your records may contain errors. If you are denied copies of your medical records, you have a right to appeal their decision. You are entitled to knowing what is in your medical records. If the provider still denies you access to your medical records after 30 days of your written request, you have the right to file a complaint with the Office for Civil Rights in the U.S. Department of Health and Human Services.
  • HIPAA does not prohibit providers from charging a reasonable cost-based fee for copying records. The healthcare provider may allow you to read your records in-house and avoid those costs.
  • HIPAA requires that each hospital and health care provider post a notice of its privacy practices. You may also request a copy, as it describes your rights, including your right to ask for an “amendment,” or correction, to a medical record. This may also provide information about which department you need to talk with, or to write to, if you have questions or complaints.
  • Make notes about, or mark, any erroneous information you find on your medical records while you are reading the file. Ask the provider if you may write on the file or if you need to write down notes. Be specific as to the location of the misinformation, so you can find it again for the correction.
  • Speak with your individual healthcare provider or doctor. HIPAA does not require they remove the erroneous information but they must mark it and record a correction, called an amendment. You can request that the provider RED FLAG your file so other readers know there are at least two different patient records merged in the one file.
  • Per HIPAA they must make amendments within 60 days. They can take an additional 30 days to act if they provide you with a written explanation of the delay.
  • Make sure any information about your medical condition that has been shared with other parties is also tracked down and notified about the correction. This list, or accounting of disclosures, includes other health care providers, insurance and pharmaceutical companies, benefits agencies, or employers that may have requested medical information with written approval by the employee. Health providers should have a list of the groups with whom they have shared your information. You may also have to request that list of other parties and to send out corrective letters yourself.
  • If an entire medical file is not yours, you may try to have your name and SSN or medical record number removed from that file. There is no federal law that states they must do so, other than note that it is “in error.” You will need to sit down with the legal department, compliance officer, or patient records manager and negotiate a resolution.
  • If the file is not amended, you have the right to request a “statement of disagreement” placed in your file, written by you explaining the situation and itemizing the erroneous information. A “bullet format” works best for the itemizing misinformation. HIPAA does not address the length of your statement. Some states do, however. For ease in reading, ITRC recommends that you limit your statement to 250 words or less. If your statement is lengthy, people might be reluctant to take the time to read it.
  • Review every EOB, “Explanation of Benefits,” that you receive as well as medical bills for any possible use of your medical insurance by another person.
  • ITRC Letter Form 130A is a sample letter you may wish to use to make requests of the medical agency. Be sure to mail the letter “certified, return receipt requested.” Enclose identifying documents such as copies of your driver’s license and health insurance card. You may want to check with your provider to see if you need to include any additional information.

Resources

ITRC Fact Sheet FS 130 – Basic Medical Identity Theft

ITRC Letter Form LF 130A – Request for Medical Records

www.worldprivacyforum.org – a nonprofit organization that studies medical privacy rights

U.S. Department of Health & Human Services – The area of medical privacy is complex. It is guided by HIPAA (U.S. Department of Health and Human Services), and your state laws.

 

This fact sheet should not be used in lieu of legal advice. Any requests to reproduce this material, other than by individual victims for their own use, should be directed to itrc@idtheftcenter.org.

ITRC Fact Sheet 130

In this guide, you will find the beginning steps to take as a victim of medical identity theft.  This is a general guide for remediating medical identity theft. Should your case be complex or if you are having trouble resolving your case, please call our office at our toll-free number, 888-400-5530, for further assistance.

  • Medical Identity Theft:  Someone is fraudulently using your personally identifiable information (PII), such as your name, Social Security number, and medical insurance identity number to obtain medical goods or services, or to fraudulently bill for medical goods or services under your name.nh
  • Government Medical Benefit Identity Theft:  Someone is fraudulently using your (PII) to obtain government medical benefits under your name.

Medical Identity Theft

An example of this type of fraud would be a criminal using your PII to receive surgery under your name. You may detect this medical identity theft by:

  • Carefully reading any Explanation of Benefit letters you receive to make sure that all medical services listed in the letter were actually provided to you.
  • Reviewing your credit reports to see if any delinquent medical bills have been reported to the credit reporting agencies.
  • Receiving a collection letter from a collection agency claiming that you have unpaid medical bills.

What to do when you find that you have become a victim of Medical Identity Theft:

  • Request copies of your medical records from any health care provider where you feel your identity was fraudulently used. If you are denied copies of your medical records, you have a right to appeal their decision. You are entitled to knowing what is in your medical records. If the provider still denies you access to your medical records after 30 days of your written request, you have the right to file a complaint with the Office for Civil Rights in the U.S. Department of Health and Human Services. See ITRC Fact Sheet FS 130A for information on how to correct misinformation in your medical records.
  • Request an accounting of disclosures from your health care provider. This is a list of entities that your health care provider gave your protected health information to and may contain the same errors that exist in the original health care provider’s medical records in your name. The original health care provider must notify the other providers of the mistakes in the records they sent, but you may want to check with them yourself.
  • Contact the billing department of the medical facility or doctor requesting payment.  If you are receiving this notice from a collection agency, then contact the collection agency first.  Explain that this is a case of identity theft or mistaken identity.  If the billing department is reluctant to help, then contact the attending doctor, or the medical facility’s fraud or legal department.
    • Ask what proof they have that this person is you.  There is almost always a physical description of the patient.  Does it match you?  You might be able to show that your height, weight, skin color, age, blood type, or sex is not the same as the “patient.”
    • Ask when the medical service was provided.  You might be able to prove you were somewhere else during that period.
    • What service was provided?  If surgery was done or a condition was diagnosed, you might be able to prove you don’t have a scar or that condition.
    • Ask if your Social Security Number (SSN) was used or just a name and address.  If your SSN was used, you will need to follow the information in ITRC Fact Sheet FS 100 – Financial Identity Theft: the Beginning Steps and check your credit reports.  This thief may be affecting your credit status in other ways.  They may be opening new lines of credit or leaving other collection actions behind.
    • Ask if this person used your medical insurance card or number.  If so, contact your insurance company and report the problem.  Ask for a new number on the replacement card.  They may also have a fraud department that tracks cases.
  • File a police report in your city and state of residence.  You are a victim of a crime.  At your earliest opportunity, obtain a copy of the police report.
  • Send copies of your affidavit of fraud, the police report, any other supporting documentation proving identity theft to the medical billing department and any additional collection agencies which may be involved.  Please remember to mail this documentation certified, return receipt requested.
  • Once the provider agrees this is a case of fraud or identity theft, get that agreement in writing and keep it in a safe place with other important records.
  • If someone is receiving government medical benefits under your name ask to have your benefits temporarily reinstated while the investigation is going on so that you can continue to receive medical help, if necessary.

For more details on various financial identity theft issues, please see our ITRC Fact Sheet FS 100A – More Complex Cases.

Report Medicare Fraud

Department Of Health & Human Services: Office Of Inspector General Hotline

You can also contact your local Senior Medicare Patrol. They work locally to empower seniors to fight health care fraud and resolve errors.

Additional Resource

ITRC Fact Sheet FS 130A – Correcting Misinformation on Medical Records

 

This fact sheet should not be used in lieu of legal advice. Any requests to reproduce this material, other than by individual victims for their own use, should be directed to itrc@idtheftcenter.org.

Click here for FTC Memorandum to Law Enforcement of Identity Theft