You may think your dermatology office would never be a portal for medical identity theft, but it can happen even with the tightest security measures in place. Therefore it is imperative to understand what medical identity theft is and learn safeguards you can put in place to protect your patients and your practice.
What is medical identity theft?
Medical identity theft is when someone steals or intentionally uses personal information (such as a person’s name, Social Security number or Medicare number) to submit fraudulent claims to Medicare and other health insurers without the person’s authorization. It currently represents the fastest growing form of identity theft, according to the Department of Health & Human Services Office of the Inspector General.
In fact, a person’s Medicare number can be more valuable than a person’s credit card number. It allows uninsured criminals to receive medical treatment under a false identity. Not only is a patient’s personal information valuable – so is yours! Third-parties can use your provider identification to bill for unprovided services. In addition, criminals both inside and outside your practice, within pharmacies, and family members of patients can forge prescriptions. It has happened to countless of practices, including many recently on the west coast.
How can dermatologists prevent medical identity theft?
While physicians often fear audits, they help us see our practice’s blind spots. Preventing medical identity theft starts with having an auditor’s eye. Be proactive and use multiple sets of eyes to conduct an internal review of your practice:
1. Look at the paper trail.
- Are the charts and documents related to your patient care and clinical research programs kept secure in a protected area, are they loose all over the clinic or – gasp – in a doctor’s car?
- Is the insurance and information attached or separate?
2. Watch your digital back.
- Does your EMR vendor provide on-site backup or is backup conducted virtually?
- Are the computers that contain important patient data files backed up and adequately protected from spam, computer viruses and tampering?
- Are the important documents about your practice backed up on memory sticks, a CD-ROM and an external hard drive?
- Who’s in charge of your digital security? Make sure you have more than one person with primary access in case your designated staff member leaves.
3. Keep a close eye on your billing and compliance practices.
- Review the DHS Office of the Inspector General’s compliance guidelines for individual and small group physician practices.
- Always be aware of billings in your name, including billings by physician assistants and nurse practitioners. Make sure the documentation in the chart lines up with the billed services.
4. Limit access to your medical identifiers.
- Consider which staff have access to your medical identifiers.
- Train your staff on when it’s ok and not ok to share your medical identifiers.
- Control your prescription pads! If you write any prescriptions, make sure they include security features and please, please, do not leave any prescription pads sitting around the office or, even worse, in public areas. Lock them up at night and take a count each day. Fill out prescriptions clearly and completely to reduce opportunities for tampering. Some states require special pads for controlled substances, so make sure those are tightly monitored as well.
5. When in doubt, report it.
If you think you have been a victim of medical identity theft, report it to your local law enforcement, as well as any governmental agencies involved, such as Medicare.
While large practice systems are vulnerable to medical identity theft on a bigger level, smaller clinics are often the targets. Medical identity theft is a real threat to dermatology practices, but with proper protocols in place, your practice can reduce its risk. Be aware of your practice’s blind spots – an ounce of prevention can prevent a whole lot of anguish.
