Medical identity theft is often an "inside job"

Asking patients for photo IDs is one safeguard, but many thefts are also committed by health care employees.

By Beth Wilson, AMNews correspondent. March 3, 2008.

When physicians look to protect their patients from medical identity theft, they may want to start by examining their office staff.

That's because, while patients may try to use another person's identity fraudulently to receive medical care, many thefts happen when a hospital, clinic or practice employee sells patient information to organized crime or gang leaders, experts said. Then the information is used to conduct fake billing or obtain goods such as wheelchairs and prescription drugs to sell on the black market, said Pam Dixon, executive director of the World Privacy Forum, a nonprofit research and consumer education organization.

The forum is conducting its second study of medical identity theft, and the findings will be released later this year. In its first study, issued in 2006, the organization reported that 250,000 to 500,000 people had experienced this form of identity theft.

A 2007 study by the Federal Trade Commission estimated that medical identity theft affected about 250,000 people in 2005.

"We have the anecdotal information that it is increasing," Dixon said, noting that cases involving individuals committing the crime alone are rare. "We do see some of that where someone steals a wallet or they steal someone's name. That does happen. But the preponderance of cases are happening from insider jobs."

Dixon points to a case at the Cleveland Clinic in Weston, Fla., where Isis Machado, a front-desk office coordinator, pled guilty to selling information involving more than 1,000 patients. Although the hospital had browser controls to limit the number of records that employees could view, no one noticed Machado was exceeding that limit regularly, Dixon said. Machado's case resulted in $7 million in Medicare fraud.