ID Theft Infects Medical Records

The L.A. Times reports:

Many employers, including more than a third of the Fortune 500 companies, demand access to medical records when making hiring, promotion or benefits decisions, according to the nonprofit Patient Privacy Rights Foundation. Health and life insurance companies routinely scan medical files or payout reports before issuing new policies.

Victims, though, often find that clearing their medical records of bad information is much more difficult than fixing credit reports, which are centralized in three major credit bureaus.

Consumers have the right to obtain one free credit report annually, and to demand an investigation of information they believe is fraudulent or incorrect. Unverified reports must be removed promptly.

Medical records, in contrast, can be scattered across dozens of doctors' offices, hospitals and clinics. And federal privacy rules intended to protect private information can make it difficult for patients to even obtain their own records when identity theft is suspected.

"These privacy rules might put you in a situation where you can't even investigate," said Wilma Kidd, chief privacy officer at WellPoint Inc., the largest U.S. health insurer for employees and other groups.

A big reason most people never find out about erroneous records is the Health Insurance Portability and Accountability Act of 1996. The law can make it difficult for patients to see their own medical records, since the penalties for improper disclosure prompt some hospitals to set up roadblocks including demands for multiple forms of identification.

The bitter twist on medical identity theft is that once a person tells a keeper of records that someone else's data might be intermingled, the file becomes even harder to obtain. Why? Because it includes another person's medical history, which many hospitals argue can't be turned over without consent.

Even when patients do see their records, they have no automatic right to fix errors they find.

A frustrating story.