Medical Identity Theft: EOB Review, HIPAA Rights, and Fixing Your Records

Medical identity theft happens when someone uses your name, insurance ID, or Social Security number to get medical care, prescriptions, or equipment, or to bill a health plan, leaving false information mixed into your own medical and billing records. Unlike a fraudulent credit card charge, which you can dispute and walk away from, a false medical record can affect the care you receive later, since a treating provider may rely on an entry describing a condition, allergy, or medication that was never actually yours.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

This page covers how to spot medical identity theft using your own paperwork, the two HIPAA rights that do the heaviest lifting once you've found it, and how to notify every provider and insurer that received the false records. It does not cover freezing your credit, which is a separate step covered at Credit Freeze vs. Fraud Alert, or the general FTC reporting process, covered at How to Report Identity Theft.

Warning Signs of Medical Identity Theft

IdentityTheft.gov lists three medical-specific entries among its identity-theft warning signs:

• A medical provider bills you for services or equipment you never received.
• Your health plan rejects a legitimate claim because its records show you've already reached a benefits limit you haven't actually reached.
• Your health plan won't cover you because its records show a health condition you don't actually have.

Source: IdentityTheft.gov, Warning Signs of Identity Theft (verified 2026-08-13)

Reviewing Your Explanation of Benefits (EOB)

The HHS Office of Inspector General, the federal watchdog for Medicare and Medicaid fraud, recommends reading every Explanation of Benefits statement your health plan sends, not just the ones tied to a bill you actually owe, as one of its core "Defend" steps against medical identity theft:

"Check All Your Medical Bills, Medicare Summary Notices, Explanation Of Benefits, and Credit Reports: Were you charged for any medical services or equipment that you didn't get? Do the dates of services and charges look unfamiliar? Were you billed for the same thing twice? Does your credit report show any unpaid bills for medical services or equipment you didn't receive? Have you received any collection notices for medical services or equipment you didn't receive?" Source: HHS Office of Inspector General, FIGHT BACK! Medical Identity Theft & Medicare Fraud (verified 2026-08-13)

An EOB lists the provider, the date of service, and what was billed to your plan for a specific visit or procedure, even when your plan paid the claim in full and you owe nothing. If a listed provider, date, or service does not match care you actually received, or a claim gets denied because your plan's records show you've used up a benefit you haven't touched, that is exactly the pattern IdentityTheft.gov flags as a warning sign above. Save every EOB you receive; you will need copies to show a provider or insurer which specific claims are fraudulent once you start the correction process below.

Your HIPAA Right to Get a Copy of Your Records

Before you can prove which entries are fraudulent, you need the actual records. HIPAA's Privacy Rule gives you a broad right to see them:

"The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule." Source: HHS, Your Medical Records, 45 CFR §164.524 (verified 2026-08-13)

A provider cannot deny you a copy for nonpayment of services. It can charge a reasonable fee for copying and mailing, but it cannot charge a separate fee just to search for or retrieve the records.

Your HIPAA Right to Correct Fraudulent Entries

Once you've found entries created by whoever used your identity, HIPAA gives you a direct mechanism to request a correction, called an amendment:

"An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set." Source: 45 CFR §164.526(a)(1), eCFR (verified 2026-08-13)

A provider can deny your amendment request, but only on one of four specific grounds: the information wasn't created by that provider, unless the original creator is no longer available to act on it; it isn't part of your designated record set; it wouldn't be available for you to inspect under the access right above; or the provider determines the record "is accurate and complete." That last ground matters most for a medical identity theft case: if a provider's system genuinely believes the impostor's visit was yours, it may deny the amendment on exactly that basis. You will typically need documentation, an EOB that doesn't match, a police report, or an FTC Identity Theft Report, to make your case.

Two things HIPAA does not do here. It does not let a provider erase the fraudulent entry outright; a granted amendment is an addition or a flag linked to the original record, not a deletion. And it is not unconditional; a denial has to be pushed further rather than simply accepted, which the section below covers.

If Your Amendment Request Is Denied

A denial is not the end of the process, and an OCR complaint is not your only move. Under 45 CFR §164.526(d)(1)(ii), the written denial itself has to tell you that you may submit a statement disagreeing with it and how to file one. Under §164.526(d)(2), the covered entity must permit you to submit a written statement disagreeing with the denial and stating the basis of that disagreement.

That statement does real work. The covered entity appends it to the disputed information, along with its own written rebuttal if it prepares one under §164.526(d)(3), and under §164.526(d)(5) it must include that appended material, or an accurate summary of it, with any subsequent disclosure of the protected health information you disputed. In practice, the next provider or plan that receives the record also receives your account of why the entry is not yours.

If you would rather not write a statement, §164.526(d)(5) also lets you request that the covered entity include your amendment request and its denial, or an accurate summary of them, with any future disclosure of the disputed information.

Keep the statement factual and specific: which entries are false, the dates of service, and what documentation you supplied. Filing one does not replace a complaint to the HHS Office for Civil Rights, which enforces HIPAA; it makes sure the dispute travels with the record while everything else plays out.

Tracing Where the Fraudulent Records Went

A correction filed with one provider doesn't automatically reach every other provider, insurer, or employer that already received the impostor's records. HIPAA puts most of that job on the provider that grants the amendment.

Under 45 CFR §164.526(c)(3), a covered entity that accepts an amendment must make reasonable efforts to inform, and provide the amendment to, within a reasonable time: persons the individual identifies as having received the protected health information and needing the amendment, and persons, including business associates, that the covered entity knows have the information and that "may have relied, or could foreseeably rely, on such information to the detriment of the individual."

That first category is why the request itself matters so much. Under §164.526(c)(2), the provider is supposed to obtain your identification of the relevant persons to notify, so name them yourself and in writing: the health plan that paid the impostor's claim, any specialist or hospital the records were sent to, the pharmacy, the lab. A list you supply is the most reliable route a correction has.

The accounting of disclosures under 45 CFR §164.528 helps, but it is not the complete map it is often described as. Section 164.528(a)(1)(i) expressly excepts disclosures made "to carry out treatment, payment and health care operations as provided in §164.506." Those are exactly the disclosures that carry a fraudulent claim to your health plan and a fraudulent chart entry to another treating provider, so those recipients will usually not appear in the accounting at all. Request it for the disclosures it does cover, such as sharing with a public health authority or in response to a subpoena, and build the rest of your recipient list from your own EOBs, referral letters, and pharmacy records.

Under §164.528(c), a covered entity must act on your request no later than 60 days after receiving it, either by providing the accounting or, if it needs more time, by giving you a written explanation and taking one extension of up to 30 days. The first accounting you request in any 12-month period must be provided free of charge; ask the privacy office directly about any fee for an additional request within the same 12 months.

Notifying Providers and Insurers: A Correction Workflow

1. Get copies of the affected records using your access right under §164.524, so you can identify exactly which entries are false.
2. Build your own list of recipients from that paperwork: the health plan that paid the claim, every treating provider named in the file, the pharmacy, the lab, any employer or plan that received a copy. This list is what makes the next two steps work.
3. Submit a written amendment request to each provider or plan under §164.526, describing exactly which entries are fraudulent and why, with supporting documentation such as mismatched EOBs, and identifying the persons you want notified if the amendment is granted, which is what §164.526(c)(2) contemplates.
4. Hold the provider to §164.526(c)(3). A covered entity that accepts an amendment must make reasonable efforts to inform and provide the amendment to the recipients you identified and to anyone it knows holds the information and could foreseeably rely on it to your detriment. Ask for written confirmation, and contact directly any recipient the provider does not reach.
5. Request an accounting of disclosures under §164.528 as a supplement, remembering that it excludes treatment, payment, and health care operations disclosures. Use it to catch recipients your own paperwork missed, not as a complete map.
6. If a request is denied, file a statement of disagreement under §164.526(d)(2) so your objection travels with the record, then escalate. You can file a complaint with the HHS Office for Civil Rights, which enforces HIPAA, and pursue the broader identity-theft remedies at How to Report Identity Theft, including an FTC Identity Theft Report or a police report, particularly if a provider's denial rests on records the impostor created rather than any care you actually received.

Related Resources

• Identity Theft Laws covers victim rights, warning signs, and the federal identity theft statute generally.
• How to Report Identity Theft covers the FTC Identity Theft Report and the FCRA blocking process for fraudulent credit accounts.
• Credit Freeze vs. Fraud Alert covers the separate credit-side protections that do not reach medical records.
• Child Identity Theft covers a related risk when a child's Social Security number is used to obtain medical care.
• Synthetic Identity Theft covers how a stolen identity can be combined with fabricated details to build a new credit profile.
• How to Freeze Your Credit After a Data Breach covers freeze steps if a data breach exposed your information alongside a medical identity theft incident.
• What To Do After a Data Breach covers the broader response checklist for a specific breach notice, including a health-plan breach.

Disclaimer

This article provides general information about medical identity theft and the relevant HIPAA rights. It is not legal advice and does not create an attorney-client relationship. Response deadlines, fees, and procedures can vary by provider and change over time; confirm current figures directly with your provider's or health plan's privacy office, or with the HHS Office for Civil Rights, before relying on anything here.

---

Last updated: 2026-08-13.