Medical Identity Theft in Florida: How It Happens and Your Rights

A bill arrives for a surgery you never had. A collector calls about an emergency room visit in a city you have never been to. You pull your credit report and find a medical account from a provider whose name means nothing to you.

That is medical identity theft, and it is different from the ordinary kind. When someone opens a credit card in your name, one record gets damaged: your credit file. When someone uses your identity to get medical care, three do. Your medical chart now holds a stranger's diagnoses, your insurance history holds their claims, and your credit report holds their unpaid bills.

Most articles on this subject tell you to file a report with the Federal Trade Commission and freeze your credit, then stop. That is roughly where your legal rights begin. If a credit bureau will not remove the fraudulent account, or a collector keeps calling after you have told them the debt is not yours, federal law gives you something to do about it.

How medical identity theft happens

There are five common routes in, and the last one surprises people most.

• A healthcare data breach. Hospitals, insurers and billing companies hold names, dates of birth, Social Security numbers and policy numbers. That combination is enough to impersonate a patient.

• A stolen wallet or insurance card. The card in your wallet is often all a person needs to be seen somewhere that does not check photo identification closely.

• Phishing and phone scams. A caller claiming to be from Medicare, your insurer or a pharmacy asks you to confirm your policy or Social Security number. Medicare does not call and ask for your number.

• A provider billing for care that never happened. Provider-side fraud rather than theft by a stranger. The patient is real, the visit is not, and the paperwork lands on the patient's record anyway.

• A family member using your insurance. People often do not think of this as identity theft, especially when they agreed to it. It is still fraud, the treatment still goes into your file under your name, and the unpaid balance still lands on your credit report.

Why it is worse than ordinary identity theft

Once someone else's care is filed under your name, their blood type, allergies, medications and diagnoses can be commingled with yours, and a future provider reading that chart has no way to tell which entries are yours. That is a safety problem, not a paperwork one, and it is why correcting the medical record matters as much as correcting the credit report.

It also surfaces late. A card issuer flags an unusual purchase within days. A fraudulent hospital bill can move quietly from provider to billing company to collection agency over months, and the first you hear of it is a collector's call or a drop in your credit score.

How to tell it happened to you

Two of these mean it has already reached collections, which is the point at which your rights under federal debt collection law come into play.

• A bill or an explanation of benefits for care you did not receive.

• A collection call about a medical debt you do not recognise.

• A medical collection account on your credit report from a provider you have never used.

• A notice that you have reached your benefit limit when you have barely used your coverage, or a denial of coverage for a condition you do not have.

• Errors in your own medical records: a wrong blood type, a medication you never took, a procedure you never had.

• A data breach notification from a hospital, insurer or medical practice.

What the law actually requires

This is the part the general guides leave out. Three separate laws apply, and each one puts a duty on someone else rather than on you.

The credit bureaus must block fraudulent accounts

Under the Fair Credit Reporting Act, 15 U.S.C. § 1681c-2, a credit bureau must block information that resulted from identity theft, and it has four business days to do it. The clock starts when the bureau receives four things from you: proof of your identity, a copy of an identity theft report, your identification of the specific information that is fraudulent, and your statement that the information does not relate to any transaction of yours. That last item is easy to leave out and a bureau can refuse the block without it. This is a stronger and faster remedy than an ordinary dispute.

Separately, a bureau that receives a dispute must reinvestigate it, and once the bureau passes the dispute on, the furnisher that reported the account must investigate on its side too. That is why the dispute has to go to the credit bureau. Writing to the hospital or the collector directly can still prompt an investigation, but it is the dispute routed through the bureau that creates a claim you can take to court. We cover how that process works, and what happens when a bureau refuses to act, in our guide to identity theft on your credit report. If the fraudulent entry is a collection account specifically, our guide to a wrong collection on your credit report covers the dispute route in detail.

Debt collectors have duties once you tell them the debt is fraudulent

The Fair Debt Collection Practices Act, 15 U.S.C. § 1692, governs third-party collectors chasing a consumer debt, and a medical bill is a consumer debt. A collector has to send you a written validation notice within five days of first contacting you. If you dispute the debt in writing within 30 days of receiving that notice, the collector must stop collection activity until it obtains verification and mails it to you. Count the 30 days from the written notice, not from the first phone call. That is 15 U.S.C. § 1692g.

Continuing to call, continuing to demand payment before verifying, or continuing to report the account to the credit bureaus as valid after being told it is the product of identity theft can each be a violation. Our list of FDCPA violations sets out the conduct the statute prohibits, and a debt validation letter is the document that starts the clock.

Florida adds its own layer. The Florida Consumer Collection Practices Act, Fla. Stat. § 559.72, prohibits similar conduct and reaches some original creditors that the federal statute does not, which matters when the entity chasing you is the hospital itself rather than an outside agency. See our explainer on the FCCPA.

You have a right to correct the medical record itself

Blocking the credit entry does not clean the chart. Under the HIPAA Privacy Rule you may request a copy of your medical records from each provider involved, request an amendment to correct information that is not yours, and request an accounting of disclosures showing who else that information was sent to. Ask for it, but know its limits: the accounting does not have to include disclosures made for treatment, billing or routine operations, which is the path a medical bill usually takes on its way to a collector. It will show you disclosures outside that, such as to other providers or third parties, going back six years.

Medical debt is reported differently from other debt

Equifax, Experian and TransUnion changed their own rules for medical collections in 2022 and 2023. From July 2022, medical collections you have paid in full no longer appear at all, and the wait before an unpaid medical collection can be listed went from six months to a year. From April 2023, medical collections with an initial reported balance under 500 dollars came off entirely. Between them, the bureaus said those changes removed about 70 percent of medical collection entries from credit files. These are the bureaus' own reporting policies rather than a statute, so a listing that breaks them is not itself a violation you can sue over. It is still worth checking, because a fraudulent medical collection that should never have been listed under those policies is easier to argue off your report.

What you can recover

Damages depend on which law was broken.

• FDCPA. Actual damages, plus statutory damages the court may allow up to 1,000 dollars in an individual action, plus attorney's fees and costs. That cap is per action, not per violation. See 15 U.S.C. § 1692k(a)(2)(A).

• FCCPA. Actual damages and statutory damages up to 1,000 dollars, plus fees and costs, under Fla. Stat. § 559.77(2). That cap is also per action, not per violation.

• FCRA. For a willful violation, actual damages or statutory damages of 100 to 1,000 dollars, plus attorney's fees, under 15 U.S.C. § 1681n. For a negligent violation, actual damages and fees under 15 U.S.C. § 1681o.

The fee-shifting provisions matter more than the caps for most people. Because these statutes make a losing defendant pay your attorney's fees when you win, consumer lawyers generally take these cases on contingency, so pursuing a claim does not require paying a lawyer up front.

What to do, in the order that protects a claim

Do these in sequence. Each step creates a record, and a claim is proved on the paper trail rather than on your memory of a phone call.

1. File at IdentityTheft.gov. The identity theft report is what triggers the credit bureau's blocking duty, so it comes first.

2. File a police report. Some providers and insurers will not act without one.

3. Request records from every provider named, in writing: an itemised bill, the full record, and an accounting of disclosures.

4. Dispute in writing with all three credit bureaus. Send the identity theft report, identify each fraudulent item specifically, and use certified mail.

5. Notify the collector in writing that the debt is the product of identity theft, within 30 days of receiving their written validation notice if you can. A phone call is not evidence.

6. Notify the provider and your insurer so the fraudulent claims stop being resubmitted, and keep every letter, call log and voicemail. If a collector keeps calling after your written notice, those records are the violation.

Do not pay a fraudulent medical bill to make it go away. Payment can be treated as acknowledging the debt, and it makes the fraud harder to prove later.

When to talk to a Florida consumer lawyer

Handling the first round yourself is reasonable. Most people can file the FTC report, send the disputes and get some fraudulent entries removed without help.

It is worth talking to a lawyer when the process stops working: the bureau reinvestigates and leaves the account on your report, the collector keeps calling after your written notice, the furnisher keeps reporting the debt as valid, or the account disappears and reappears months later. Those are the points where a violation has usually occurred and where the fee-shifting provisions do their work.

Consumer Law Florida represents consumers statewide under the FDCPA, the FCRA and the TCPA, including in Orlando, Miami, Tampa, Fort Lauderdale, Boynton Beach and Port St. Lucie. You can read more about our work on credit reporting cases and debt collection cases.

You did not create this problem

People who discover medical identity theft often feel they have to prove they are not lying about their own life. You do not have to accept a fraudulent bill because fighting it is exhausting, or a credit report that describes someone else's medical history as yours.

If a collector is chasing you for care you never received, or a credit bureau will not remove a fraudulent medical account, request a free case review and we will tell you whether it is a violation worth pursuing.