Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you received a breach notice—or suspect someone accessed your medical records or patient account—contact the provider or insurer using a phone number or website you already know is official. Ask what information was involved, what the organization has done, and what protections it offers. Then check for signs that your information has been used. The steps that matter depend on what was exposed and whether you see evidence of misuse.
This guidance draws on U.S. federal resources. Privacy protections and reporting routes differ by country, and HIPAA does not cover every health app or company that handles health-related data.
Start by verifying the notice safely
- Do not use contact details in an unexpected message. A breach notice can be imitated by scammers. The FTC advises against giving medical information to unexpected callers, emailers, or texters. Instead, visit a website you know is genuine or call a number you know is accurate. See the FTC’s guidance on medical identity theft.
- Ask the organization what happened. Contact the provider, insurer, or service through that verified channel. Ask which information was involved, whether an account or record was accessed, what steps the organization has taken, and whether it offers free monitoring or other protections.
- Read the notice for its specific instructions and offer terms. If it offers complimentary credit monitoring or identity-theft insurance, the FTC recommends using the offered services. Check the terms and follow the enrollment instructions through a verified route; an offer is not proof that every type of exposed medical information is covered.
Check whether your information has been misused
Review bills and Explanation of Benefits (EOB) statements, which summarize claims submitted to your health plan. Also look for unfamiliar medical debt or collection notices and any warning that you have reached a health-benefit limit. These can be signs of medical identity theft, though an unfamiliar claim may also be an error that needs investigation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- A bill or EOB for care, equipment, or prescriptions you did not receive.
- Collections for medical debt you do not owe, or unfamiliar medical debt on a credit report.
- A notice that you reached a limit on health benefits you do not recognize having used.
Keep copies of the breach notice, bills, EOBs, and messages about the suspected misuse. These records can help you explain the issue to the organizations involved.
#1 Best Overall
If you find medical identity theft, correct the records
If someone appears to have used your information or health insurance to obtain care or prescriptions, use IdentityTheft.gov for a personal recovery plan. Contact the doctors, clinics, hospitals, pharmacies, laboratories, or insurers connected to the unfamiliar care or claim. Ask for the relevant records, explain which service or charge you did not receive, and request that inaccurate billing and records be reviewed and corrected.
Contact each organization whose records may contain the false information; correcting a claim with one provider does not necessarily correct records held by another. Keep a note of whom you contacted and any response or case reference they provide.
Match financial protections to the information exposed
Credit-related steps are conditional, not a cure for exposure of medical details. If the notice says financial identifiers such as your Social Security number were involved, or you see signs of financial identity misuse, follow the FTC’s data-breach recovery guidance. Depending on what was exposed, that may include checking credit reports and considering a fraud alert or credit freeze. A freeze or monitoring service does not correct medical records or prevent someone from using health information within a provider’s system.
Recommended Free Tools
If the breach involved only medical details and there is no sign of financial identity misuse, prioritize checking your health accounts, claims, and records rather than treating a credit freeze as a universal requirement.
Understand who holds the information and where to complain
HIPAA-covered providers, plans, and their business associates
HIPAA applies to covered entities—such as many health care providers and insurers—and their business associates. It does not automatically cover every app or company that collects health-related data. The Office of the National Coordinator for Health Information Technology (ONC) explains that some provider- or plan-offered personal health records may be covered by HIPAA, while stand-alone consumer services may instead fall under other rules. See ONC’s Take Control. Protect Your Health Information.
For unsecured protected health information held by a HIPAA-covered entity, HHS says the affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. That is the covered organization’s deadline, not a deadline for you to take action. To the extent possible, the notice should describe the breach and information involved, steps you should take, the organization’s investigation and mitigation, and contact information. HHS also explains that information encrypted so unauthorized people cannot read it is considered secure for this purpose. Read the HHS HIPAA Breach Notification Rule guidance.
Complaints about a possible HIPAA or Part 2 violation
If you believe a HIPAA or Part 2 violation occurred, you can complain to the HHS Office for Civil Rights (OCR). OCR says complaints generally must be filed within 180 days of when you knew about the alleged violation; it may extend that period for good cause. Details and filing options are on the HHS OCR complaint page.
Consumer health services outside HIPAA
If a stand-alone online health company is not covered by HIPAA, that does not mean no rules apply. Some consumer health-record services may have obligations under the FTC Health Breach Notification Rule. ONC directs people with concerns about a non-HIPAA-covered online company’s handling of health information to the FTC.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Dispose of paper copies securely
ONC recommends safeguarding medical and insurance information and shredding insurance forms, prescriptions, and physician statements. A cross-cut shredder can help with paper documents you no longer need; it does not secure an exposed online account or recover already-accessed records.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
