Medical Identity Theft: Prevention and Reconciliation Initiatives at Massachusetts General Hospital

Abstract

Medical identity theft refers to the misuse of another individual's identifying medical information to receive medical care. Beyond the financial burden on patients, hospitals, health insurance companies, and government insurance programs, undetected cases pose major patient safety challenges. Inaccuracies in the medical record may persist even after the theft has been identified because of restrictions imposed by patient privacy laws. Massachusetts General Hospital (MGH; Boston) has conducted initiatives to prevent medical identity theft and to better identify and respond to cases when they occur. Since 2007, MGH has used a notification tree to standardize reporting of red flag incidents (warning signs of identity theft, such as suspicious personal identifiers or account activity). A Data Integrity Dashboard allows for tracking and reviewing of all potential incidents of medical identity theft to detect trends and targets for mitigation. An identity-checking policy, VERI-(Verify Everyone's Identity) Safe Patient Care, requires photo identification at every visit and follow-up if it is not provided. Data from MGH suggest that an estimated 120 duplicate medical records are created each month, 25 patient encounters are likely tied to identity theft or fraud each quarter, and 14 patients are treated under the wrong medical record number each year. As of December 2013, 80%-85% of patients were showing photo identification at appointments. Although an organization's policy changes and educational campaigns can improve detection and reconciliation of medical identity theft cases, national policies should be implemented to streamline the process of correcting errors in medical records, reduce the financial disincentive for hospitals to detect and report cases, and create a single point of entry to reduce the burden on individuals and providers to reconcile cases.