What medical identity theft looks like, nine warning signs to watch for, how to tell theft from an ordinary billing mix-up, and the steps that get your records and bills corrected.
In February 2026, a Reddit user opened their health insurance app and found a claim for gallbladder surgery. The first claim, for $100,000, had been denied. Ten days later a second claim for $110,000 went through. The plan paid about $45,000 and the app said they owed roughly $8,000. They had not had surgery, and they only spotted the claims about eight months after the fact. That is how medical identity theft usually surfaces: not with an alert, but with paperwork nobody reads until it costs money.
The Short Version
Medical identity theft is when someone uses your name, insurance or Medicare number to get care, prescriptions or equipment, or to bill your plan. The clearest warning signs are bills or Explanation of Benefits statements for care you never got, debt collectors chasing medical debt you do not owe and notices that you have hit a benefit limit. If you see one, call your insurer, request your records and file a report at IdentityTheft.gov.
Table of Contents
What medical identity theft is, and what it is not
The Federal Trade Commission’s guide to medical identity theft defines it as someone using your personal information to see a doctor, get prescription drugs or medical devices, or submit claims. That information can include your Social Security number, health insurance account number or Medicare number. The FTC warns that if a thief’s health information gets mixed with yours, it can affect the care and benefits you are able to get.
Not every strange claim is theft, though. In the February thread, several commenters who work in claims said hospitals sometimes use coverage-lookup tools that match patients on name and date of birth, which can attach someone else’s visit to your plan. In a January 2026 case, a member who called about an Explanation of Benefits (EOB) for care they never received heard back within two hours that it was a billing error. One claims worker summed up the difference: true medical identity theft tends to show a pattern, with repeat claims, multiple services or pharmacy activity.
Medical identity theft by the numbers
There is no reliable national count of medical identity theft victims, because many cases are never reported as theft. What is measurable is how much health data gets exposed and how much fraud gets billed.
- A record year for breaches. According to a HIPAA Journal analysis of federal breach reports, 772 healthcare data breaches affecting 500 or more people were reported in 2025, the most on record, and about 138.5 million individuals were affected.
- Mega breaches drive the totals. The same analysis lists Conduent Business Services (62.2 million people) and Aflac (13.9 million) as 2025’s largest. The 2024 Change Healthcare attack affected an estimated 192.7 million people, according to the Department of Health and Human Services.
- Billing for care never provided. The Justice Department’s June 2026 health care fraud takedown charged 455 defendants in schemes involving more than $6.5 billion in alleged false claims. Several cases involved clinics that billed Medicare for wound allografts that were never provided to patients.
A breach letter does not mean your identity was used. It does mean your details may be circulating, which makes the warning signs below worth checking more often.
9 warning signs of medical identity theft
1. An EOB or bill for care you did not get
This is the most common first clue. The FTC lists a bill or EOB “for services you didn’t get or prescription medications you don’t take” as a top warning sign. Check the provider name, date and service against your own calendar.
2. A procedure you could not have had
Some claims are impossible on their face, such as a surgery for an organ you still have or a visit in a state you have never been to. One commenter in a January thread said their own case began with a letter approving surgery five states away.
3. Prescriptions you do not take
Pharmacy claims for drugs you have never been prescribed are a strong sign of misuse, because they tend to repeat. Review the pharmacy section of your plan’s claims history along with the doctor visits.
4. A debt collector calling about medical debt
The FTC lists contact from a debt collector about medical debt you do not owe as a warning sign. Ask for the provider name and date of service in writing before you discuss or pay anything.
5. Medical collections on your credit report
Unfamiliar medical collection accounts can mean someone ran up bills in your name. You can pull free reports from all three bureaus at AnnualCreditReport.com.
6. A notice that you hit a benefit limit
If your insurer says you have used up a benefit you barely touched, such as physical therapy visits, someone else may be using your coverage. Ask the plan for the claims that counted toward the limit.
7. Someone else’s details in your chart
Wrong allergies, blood type, diagnoses or aliases in your patient portal can signal mixed records. In May 2026, a patient on Reddit said a nurse at check-in found another person with the same first name but a different birthday linked to their chart as an alias. Mixed records are a safety issue as well as a billing one, so ask the provider to review them.
8. Insurance coverage you never signed up for
Fraudulent coverage in your name can block legitimate care. In August 2026, a family on Reddit described a father with Medicare and Medicaid whose records showed a Blue Cross employer policy he never had, which was disrupting his care. One commenter suggested contacting Medicare’s Benefits Coordination and Recovery Center, which tracks other insurance on Medicare records.
9. A data breach notice from a health company
A letter from a hospital, insurer or health vendor saying your information was exposed is not proof of theft, but it is a reason to read the next few months of EOBs closely and consider freezing your credit.
What to do if someone used your medical identity
- Call your insurer. Report the claims as fraudulent and ask for a case number. For Medicare, call 1-800-MEDICARE, and for Medicare Advantage or drug plans you can also contact the I-MEDIC fraud line at 1-877-7SAFERX.
- Request your records. Ask each provider involved for copies. Under HIPAA, providers generally must act on a records request within 30 days, with one 30-day extension allowed.
- Correct the records in writing. Send a letter by certified mail explaining what is wrong. HIPAA’s amendment rule gives providers up to 60 days to act on your request, plus one 30-day extension.
- File at IdentityTheft.gov. The FTC’s site creates a report and a personal recovery plan you can share with providers and credit bureaus.
- Dispute credit report errors. Report any medical collections you do not recognize to all three bureaus.
- Keep a log. Note dates, names and reference numbers for every call. Commenters in the February thread warned that medical bills can resurface years later, so keep copies indefinitely.
If you need help, the nonprofit Identity Theft Resource Center offers free guidance at 888-400-5530. Our guide to medical bill errors to catch before you pay covers the ordinary mistakes worth ruling out first.
How to protect your medical information
Medicare.gov recommends comparing the dates and services on your statements with your own calendar, and setting up an online account to see Original Medicare claims as soon as they are processed. It also says Medicare will never call to sell you anything or visit your home. The FTC adds a few habits that work for any insurance:
- Switch EOBs and medical bills to online delivery, and shred paper copies.
- Ask whether a doctor’s office can use something other than your full Social Security number.
- Never give your insurance or Medicare number to someone who calls, texts or emails you unexpectedly.
Be careful about what you post during a health crisis, too. Our guide to sharing a loved one’s medical updates online covers the details worth keeping private.
This article is for general information only and is not medical, legal or financial advice. Insurance rules and state laws vary, so contact your insurer, your providers or an attorney about your specific situation.
What Matters Most
- The clearest signs are EOBs or bills for care you never got, medical debt you do not owe and surprise benefit-limit notices.
- Many odd claims are billing mix-ups, so call your insurer first, but treat repeat claims and pharmacy activity as likely theft.
- About 138.5 million people were affected by large healthcare data breaches in 2025, so reading EOBs matters more than ever.
- HIPAA lets you get your records and request corrections, and IdentityTheft.gov builds a recovery plan.
Frequently Asked Questions
What is medical identity theft?
Medical identity theft is when someone uses your personal details, like your insurance or Medicare number, to get medical care or prescriptions or to bill your insurer. It can leave you with false bills and a medical record that mixes in a stranger’s health information.
How do I know if someone is using my health insurance?
Review your Explanation of Benefits statements and your plan’s online claims history for providers, dates or prescriptions you do not recognize. Calls from debt collectors about medical debt and benefit-limit notices are other signs.
What should I do if I get an EOB for services I did not receive?
Call your insurer’s member services line and report the claim as not yours. Many cases turn out to be billing errors, but the insurer will investigate either way. If it is fraud, request your records and file a report at IdentityTheft.gov.
How do I report medical identity theft?
Report it to your insurer and to the FTC at IdentityTheft.gov. For Medicare, call 1-800-MEDICARE or report fraud online through Medicare.gov. You can also contact the providers who billed the claims.
Can medical identity theft hurt my credit?
Medical identity theft can hurt your credit if unpaid bills in your name go to collections. Check your credit reports regularly and dispute any medical collections you do not recognize with all three bureaus.
Final Word
Medical identity theft hides in paperwork, so the best defense is reading it. Open every EOB, set up online access to your claims and compare each visit with your calendar. If something looks wrong, call your insurer the same week, and keep notes from the first call on. The earlier a false claim is caught, the less it takes to undo.