Scam-o-Meter: Medical identity theft can follow you into the emergency room

Key insights

Medical identity theft is more widespread and dangerous than most people realize.

• In 2025, every single day, 379,306 Americans’ health information was breached. In 2024, that number was even higher with 792,226 persons having their medical data breached every day.[2] The main driver was the 2024 Change Healthcare ransomware attack, which affected an estimated 192.7 million people and became the largest healthcare data breach in history so far.[2]
• Medical identity theft can affect your health. Criminals use stolen health information to get medical treatment in your name — or sell it to others who do the same. If a stranger uses your health records to get medical assistance, that person’s blood type, allergies, diagnoses, and treatment history get added to your medical records. So if you ever need emergency care, doctors will rely on those records to treat you. Sometimes this can have dire consequences, for example, if a doctor transfuses the wrong blood type because someone else’s information is on file.[1]
• Your insurance can take a hit too. When a criminal uses your identity to get medical treatment, those treatments get billed to your insurance — and paid. By the time you find out, your annual benefits are already used up by treatments you never had, your legitimate claims are being denied, and in some cases, your policy may be canceled altogether.[1]
• False diagnoses can cost you your job. Records containing fabricated diagnoses, such as substance use disorders or psychiatric conditions, can surface in background checks and cause failed pre-employment physicals and even job losses.[1]
• No industry pays more for a data breach than healthcare. For 14 years in a row, IBM’s Cost of a Data Breach report has ranked it as the most expensive sector — with the average breach costing a healthcare organization $7.42 million. [3]
• Hacking drives most data breaches. More than 80% of large healthcare data breaches reported in 2025 were caused by hacking and other IT incidents — up from 49% in 2019.[2]

The longer medical identity theft goes undetected, the harder it is to fix — which is why catching it early is so important.

What our expert says

Tomas Sinicki, managing director at Coveron, recommends that you:

• Review every medical bill and Explanation of Benefits statement carefully to make sure they are correct. If not, seek to rectify them with each provider. 
• Request copies of your medical records regularly and check for unfamiliar diagnoses.
• Treat unexpected calls or letters from debt collectors about medical bills as an immediate red flag.
• Never provide personal information through unsolicited calls or emails claiming to be from your insurer or a healthcare provider — these might be phone scams.
• Use an identity theft protection service that includes online fraud insurance. That way, you have financial backup and expert support ready when you need it.

Stay on top of it — because medical identity theft can go undetected for years.

Methodology and sources

This article draws on three sources: Shamai Cohen’s article “60+ Medical Identity Theft Statistics in 2026,” published on FaxSIPit; an article by Steve Alder, “Healthcare Data Breach Statistics,” published in HIPAA Journal; and IBM’s 2025 Cost of a Data Breach Report.

What is Scam-o-Meter?

Scam-o-Meter is an ongoing Coveron series where we keep track of online fraud. In each installment, we look at different scam or fraud trends covered by trusted sources and share our expert’s advice on how to protect yourself.

References 

[1] Cohen, S. (2026). “60+ medical identity theft statistics in 2026 (data + trends).” FaxSIPit. https://www.faxsipit.com/blogs/medical-identity-theft-statistics opens in a new tab

[2] Alder, S. (2026, September 4). “Healthcare data breach statistics – updated for 2026.” HIPAA Journal. https://www.hipaajournal.com/healthcare-data-breach-statistics/ opens in a new tab

[3] IBM. (2025). “Cost of a data breach report 2025.” https://www.ibm.com/reports/data-breach opens in a new tab