The latest Ponemon Institute Medical Identity Theft survey reflects the classic good news, bad news scenario. The good news is that more consumers understand how medical identity theft happens, and the importance of checking healthcare invoices and records for accuracy. The bad news is that the victim count has hit an all-time high (nearly 2 million annually), while breach frequency and financial damages continue
to rise, unabated.   

Losses up 44% from 2010

Data extrapolated for 2012 reveals that losses from medical identity theft will top $40 billion, up 34% from last year and 44% from 2010. During any given hour thieves using pilfered credentials will steal nearly $5 million worth of medical services, equipment and prescriptions.

The survey also revealed:

• Higher costs for recovery and resolution: victims pay on average $22,346
  (up 10% from 2011) to resolve medical identity theft, including the cost of identity theft protection and retaining legal counsel
• Difficulty knowing when the crime occurred: one quarter of those asked did not know when their medical identity was stolen, while 34% said it took more than a year to find out
• Collection letters still top the list: though more consumers learn of medical identity theft from suspicious statement or invoice entries, nearly 40% of victims first hear of their misfortune through collection letters

In a subtle but potentially instructive revelation, just 4% of survey respondents said a healthcare provider or insurance company notified them of the theft.  

Providers beware

So how is all this flavoring consumers’ attitudes toward healthcare and insurance providers? The biggest non-financial consequence, according to Ponemon, is a loss of trust and confidence. If people perceive a lack of effective data safeguards, most (58%) feel no compunction about going elsewhere for services. If their medical records were ever lost or stolen 56% of respondents would also feel justified making a change.  

Watch the vital signs

The top three actions desired by victims following medical identity theft include: reimbursement for the costs of changing providers; prompt notification of the loss or theft; and free identity theft protection for at least one year. (Hint: Providers can use these survey insights to develop post-breach strategies and programs aimed at reestablishing trust and confidence.)  

Employers can also play a role in medical identity theft awareness by encouraging (and if needed, teaching) employees how to:

• Keep medical information private
• Regularly check medical records for accuracy (57% of those surveyed don’t)
• Be more proactive about monitoring statements and charges
• Review and interpret credit reports
• Engage an identity theft protection service

Bottom line? When it comes to medical identity theft, vigilance is good medicine–for consumers and healthcare providers alike.

Our guest blogger this week is Dr. Larry Ponemon, Chairman and Founder of the Ponemon Institute.

Join us on Tuesday, April 26th for a live webinar with Dr. Larry Ponemon presenting Medical Identity Theft Trends: The Importance of Securing Healthcare Data.

What are some of the dire consequences of medical identity theft? It could be the shock of receiving a collection letter requesting immediate payment for an expensive medical procedure you never had. Or, it might result in a mistake on your healthcare record that could threaten insurance coverage or worse yet cause you to receive the wrong medical treatment.

According to Ponemon Institute’s Second Annual Survey on Medical Identity Theft, we estimate that more than 1.49 million Americans have been targeted by this crime. With an average cost per victim of $20,663 the total national economic impact of medical identity theft crimes is more than $30 billion.

Why is medical identity theft on the rise? First, we found that consumers lack awareness about this crime, which could make them more complacent and more vulnerable. Second, medical identity theft is often a family affair. More than one-third of victims in our study say that it was a family member who took their personal identification credentials. Finally, the victims tend to be older with a greater likelihood of having Medicare and other Social Security benefits. They also may not be as savvy about the need to protect their medical identity.

Consumers can minimize their risk by safeguarding their medical credentials and making sure they provide sensitive information only to appropriate healthcare organizations that take the security of health records seriously. Consumers also should monitor health records and credit reports to make sure that if their identity is stolen the incident can be resolved as soon as possible. In turn, organizations have a responsibility to protect patients’ records from being lost or stolen and to inform consumers of the need to safeguard their medical credentials. Taking such steps is critical to reducing this billion-dollar crime.

Today’s headlines trumpet yet another high-profile medical data breach, this time through Health Net.  The company’s nine missing computer drivers have exposed the records of 2 million policyholders, thus compromising personal information that includes addresses, Social Security numbers, financial data and other information about customers, employees and healthcare providers.  California insurance regulators are conducting multiple probes to determine whether Health Net, which services 6 million policyholders nationwide, “did everything it could have done to avoid and appropriately remedy this security breakdown.”

This corporate catastrophe reminds us of the increasing hazard of medical fraud, which is the most expensive and time consuming to resolve of all types of identity theft[i].  The second annual National Study on Medical Identity Theft, fielded by the Ponemon Institute provides further insight into this pervasive problem and how it affects consumers.

Key finding include:

Recognizing the importance of privacy does not equate to action:

• Nearly 1.5 million Americans have been affected by medical identity theft
• The average cost to resolve a case of medical identity theft is $20,663, up slightly from $20,160 in 2010
• Nearly 70% of total respondents felt it is important to have personal control over medical records
• Nearly 80% felt that healthcare organizations should ensure the privacy of personal medical records
• Nearly half (49%) of past medical identity theft victims took no new steps to protect themselves after their own incident
• 50% of respondents did not report the incident to law enforcement or other legal authorities, up from 46% in 2010

Consumer indifference is fueled by lack of understanding of repercussions

• Of those that failed to report an incident, 43% cited the lack of resulting harm and the desire to “not make it a big deal.” This is up from 37% in 2010
• 37% of respondents fear embarrassment as a result of medical identity theft more than loss of medical coverage (21%) or a diminished credit score (18%)

Consumers are uninformed of new healthcare reform policies

• More than half of respondents (55%) are not familiar or have no knowledge of the new healthcare reform policies
• 79% are not aware of the plan to create a national electronic database of American’s health information
• 33% of respondents believe that a national electronic database will increase the risk of medical ID theft

Medical identity theft is a family affair

• In many cases, the victim discovers the thief to be a relative and the crime is often not reported to authorities
• The leading instance of medical identity theft was at the hands of a family member, accounting for 36% of all victim responses, making it the most common scenario by an overwhelming margin
• According to 51% of respondents, the number one reason for not reporting the incident after discovery is because the victim knew the thief and did not want to report him or her

Health Net is conducting its own investigation into its recent data breach, and regulators have praised the company for acting quickly to alert consumers about the incident.  Healthcare organizations are responsible for protecting consumer privacy and reporting breaches, but the National Study on Medical Identity Theft’s survey confirms that consumers need to play their own part in reporting incidents and helping healthcare companies protect private medical information.

[i]2010 Global Privacy Summit Presentation: The Potential Damages and Consquences of Medical Identity Theft and Healthcare Data Breaches – Dr. Larry Ponemon