Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIf you think your medical records, health-insurance details, or patient account were exposed, first verify the notice using contact information you already trust. Then find out what data was involved, secure any affected account, and watch for signs that someone is using your medical identity. The steps that matter depend on what was exposed and whether there is evidence of misuse.
This guide covers U.S. federal guidance. Privacy protections and complaint routes differ in other countries, and not every health app or online record service is covered by HIPAA.
As an Amazon Associate I earn from qualifying purchases.
1. Verify the notice and contact the organization safely
Do not click links or call numbers in an unexpected email, text, or phone message to investigate a breach. The Federal Trade Commission (FTC) advises people not to give medical information to unexpected callers, emailers, or texters. Instead, use the provider’s or insurer’s official website that you know is genuine, or call a number from a trusted source such as your insurance card or a statement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ask the organization:
- Whether your information or account was affected and when the incident occurred.
- Which information was involved—for example, medical details, insurance identifiers, Social Security information, or login credentials.
- What it has done to investigate and reduce the risk, and whether you need to take any account-security steps.
- Whether it offers free credit monitoring, identity-theft insurance, or another protection, and what the terms are.
If a password may have been exposed, change it through the verified site or app. If you reused that password elsewhere, change it on those accounts too. Use a unique password for each account and enable multifactor authentication if the service offers it. These account steps are especially relevant to suspected credential exposure; they cannot undo disclosure of medical information.
#1 Best Overall
2. Read the notice for the information and protections it describes
For a breach of unsecured protected health information at a HIPAA-covered entity, the organization must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. HHS says that, to the extent possible, the notice should describe the breach and information involved, steps individuals should take, the organization’s investigation and mitigation, and contact information. The 60-day deadline is the covered organization’s notification duty, not a deadline for you to report the incident.
HHS explains that this requirement applies to most doctors, hospitals, other health care providers, and insurers when unsecured information is involved. Information encrypted so unauthorized people cannot read it is considered secure for this purpose. A notice may therefore be limited to certain affected information or explain why an incident does not trigger the same notification requirement. For details, see HHS guidance on the HIPAA Breach Notification Rule.
If you received a notice, keep a copy and note the organization’s contact details, what it says was exposed, and any response deadline or offer terms. If the notice is unclear, contact the organization through a verified channel rather than assuming all your records or accounts were involved.
Recommended Free Tools
3. Watch for medical identity theft
Medical identity theft occurs when someone uses your personal or insurance information to obtain care, prescriptions, or benefits. The FTC identifies these warning signs:
- A bill or Explanation of Benefits (EOB) for care or prescriptions you did not receive.
- A medical debt sent to collections that you do not owe.
- Unfamiliar medical debt on your credit report.
- A notice that you have reached a health-benefit limit when you have not used those benefits.
An EOB is a statement from an insurer describing care billed to your plan; it is not necessarily a bill you owe. Review it for unfamiliar providers, services, dates, or prescriptions. You can also review account activity and statements from your insurer and health providers for charges or records you do not recognize.
4. If you find misuse, review records and dispute errors
- Contact the organizations involved. Reach the doctor, clinic, hospital, pharmacy, laboratory, or insurer named in the unfamiliar bill or record using a verified phone number or website. Explain that you suspect medical identity theft and ask how to report and investigate the activity.
- Request the relevant records. Ask the organization for records connected to the care, prescription, claim, or debt you do not recognize. Keep copies of correspondence and make a note of whom you spoke with and when.
- Report inaccurate billing and records. Tell the relevant provider or insurer which entries are not yours and ask how to correct them. Follow its dispute process, and retain copies of your submission and any response.
- Get a recovery plan. The FTC’s IdentityTheft.gov provides a personal recovery plan for people whose information or health insurance was used to obtain care or prescriptions.
5. Match financial identity steps to the data exposed
Credit-related steps are not a cure for exposed medical records, and they are not necessary in every case. They may be relevant if the exposed information includes identifiers that could be used for financial identity theft, or if you see unfamiliar debt or accounts.
The FTC’s data-breach guidance recommends using free services—such as credit monitoring or identity-theft insurance—if the breach notice offers them. Review the offer’s terms and follow the official enrollment instructions. Depending on what was exposed, you can also check your credit reports and consider a fraud alert or credit freeze. These measures address credit-related risks; they do not correct a false medical record or prevent someone from using health-insurance details to seek care.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →6. Check which privacy rules and complaint routes apply
Doctors, hospitals, insurers, and their business associates
HIPAA applies to covered entities and their business associates; it does not automatically cover every business that handles health-related data. Some personal health records offered by a provider or health plan may be covered by HIPAA, while other stand-alone consumer health-record services may instead fall under the FTC’s Health Breach Notification Rule.
If you suspect a HIPAA violation or a violation involving certain substance-use-disorder records protected under Part 2, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). OCR says complaints generally must be filed within 180 days of when you knew about the alleged violation, though it may extend that period for good cause. See OCR’s complaint process.
Health apps and other online services
A health-related app or online record company may not be a HIPAA-covered entity. If you are concerned about a non-HIPAA-covered online company’s handling of health information, the Office of the National Coordinator for Health Information Technology (ONC) points consumers to the FTC. Do not assume that the same rules or complaint route apply to every service; identify who holds the data and check the organization’s privacy and breach information.
7. Reduce exposure from paper records
For physical documents, ONC recommends: “Safeguard your medical and health insurance information and shred any insurance forms, prescriptions, or physician statements.” A cross-cut shredder can help dispose of papers containing sensitive details. Shredding is a paper-disposal precaution; it does not secure an online account or resolve information already exposed digitally. See ONC’s Take Control. Protect Your Health Information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
