When Your Medical Records Become a Liability: What Patients Need to Know After a Healthcare Data Breach
In 2024, the cyberattack on Change Healthcare — a subsidiary of UnitedHealth Group that processes roughly one-third of all US medical claims — disrupted billing operations at hospitals, pharmacies, and physician practices nationwide. It also exposed the protected health information of an estimated 100 million Americans, making it the largest healthcare data breach in US history. The incident was not an anomaly. It was the logical outcome of a decade-long pattern in which hospitals, clinics, insurers, and medical clearinghouses have been systematically targeted by ransomware operators and data thieves who understand, with clinical precision, exactly how valuable a medical record is.
The question for patients is not whether the healthcare sector is vulnerable. It demonstrably is. The question is what you can do about it.
Why Healthcare Data Is a Premium Target
A stolen credit card number sells on criminal forums for a matter of cents once the card is canceled and the fraud is flagged. A comprehensive medical record — containing a Social Security number, date of birth, insurance policy details, prescription history, and billing address — can command prices many times higher because its utility persists long after the initial theft.
Medical identity theft operates differently from financial identity theft in ways that make it both more damaging and harder to detect. A thief who assumes your medical identity can receive treatment billed to your insurance policy, obtain prescription medications in your name, or establish fraudulent provider relationships that generate claims for years. The resulting errors in your medical record — incorrect diagnoses, medications you never took, procedures you never received — can affect future insurance coverage, employment physicals, and, in the most serious cases, the accuracy of care you receive in an emergency.
Healthcare organizations face structural vulnerabilities that make them attractive targets. Legacy software systems, often decades old, remain in operation because replacing them is expensive and disruptive. Clinical staff prioritize patient care over security hygiene, creating phishing susceptibility. The interconnected nature of modern healthcare — the web of billing clearinghouses, insurance portals, laboratory systems, and electronic health record platforms — multiplies the attack surface exponentially.
Your Rights Under Federal Law
The Health Insurance Portability and Accountability Act, universally known as HIPAA, establishes baseline federal protections for patient health information. Under its Breach Notification Rule, covered entities — healthcare providers, health plans, and their business associates — are required to notify affected individuals within 60 days of discovering a breach that compromises unsecured protected health information.
That notification must include a description of what information was involved, what the entity is doing in response, and what steps you can take to protect yourself. Critically, the notification must come directly to you, not merely be posted on a website.
If you believe a covered entity has violated HIPAA, you may file a complaint with the Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr. OCR investigates complaints and can impose civil monetary penalties. While HIPAA does not grant patients a private right of action — meaning you generally cannot sue a provider directly under HIPAA — state consumer protection laws and state data breach statutes may provide additional remedies depending on where you live.
You also have the right under HIPAA to request a copy of your medical records and to request an accounting of disclosures — a record of who has accessed your health information and for what purpose.
Immediate Steps After Receiving a Breach Notice
If you receive notification that your health information has been compromised, the following actions should be taken in roughly this order.
Review the notice carefully. Understand precisely what categories of information were exposed. A breach limited to appointment scheduling data carries different risks than one involving Social Security numbers, insurance policy numbers, or clinical records.
Contact your health insurer. Request a copy of your Explanation of Benefits statements for the past year and review them for services you did not receive. Report any discrepancies immediately. Ask whether the insurer offers a fraud monitoring program for medical identity theft.
Place fraud alerts or credit freezes. Even if financial account numbers were not directly exposed, Social Security numbers and dates of birth from medical records are sufficient to open fraudulent accounts. Contact any one of the three major credit bureaus — Equifax, Experian, or TransUnion — to place a fraud alert, which requires lenders to verify your identity before extending credit. A credit freeze, available free from all three bureaus, provides stronger protection by preventing new accounts from being opened at all without your explicit authorization.
Request your medical records. Under HIPAA, you are entitled to a copy of your records. Review them for unfamiliar diagnoses, medications, or procedures. If you find inaccuracies, submit a written request for amendment.
Monitor the Medicare Beneficiaries portal if applicable. Older Americans on Medicare should regularly review their claims history at mymedicare.gov for fraudulent billing.
The Longer-Term Monitoring Commitment
Medical identity theft rarely manifests immediately. Thieves may sit on stolen data for months or years before exploiting it, waiting for fraud monitoring to lapse. Building sustained monitoring habits is therefore more important than any single reactive step.
AnnualCreditReport.com, the federally mandated free credit report service, allows US consumers to access reports from all three bureaus. Reviewing these reports periodically for unfamiliar accounts or inquiries remains one of the most reliable detection mechanisms available without cost.
Several identity protection services — including those offered by Experian, Aura, and LifeLock — include medical identity monitoring features that scan for your information appearing in insurance claims databases. These services carry subscription costs and vary in the breadth of their monitoring, but for individuals whose Social Security numbers were confirmed as exposed, the additional coverage may be worth evaluating.
A Note on Systemic Accountability
The burden described above — reviewing records, placing freezes, monitoring claims — falls almost entirely on patients who did nothing to create the vulnerability that exposed them. That asymmetry deserves acknowledgment. The healthcare industry's persistent underinvestment in cybersecurity infrastructure, combined with the concentration of extraordinarily sensitive data in systems built before modern threat landscapes existed, has created a structural problem that individual vigilance alone cannot fully solve.
Advocacy organizations including the Electronic Privacy Information Center and the American Civil Liberties Union have called for stronger federal standards governing healthcare data security. Until legislative and regulatory frameworks catch up with the current threat environment, however, patients who understand their rights and act on them are substantially better positioned than those who do not.
