Medical Identity Theft in Kentucky: Removing Fraudulent Charges from Health Records

Opening a mailbox in Louisville, Lexington, Bowling Green, or Covington to find a past-due hospital statement or debt collection notice for a surgery, emergency room visit, or addiction treatment program you never attended is more than just a billing error. Unlike credit card fraud-where federal law caps your out-of-pocket loss at $50 and banks quickly cancel the compromised plastic-medical identity theft in Kentucky corrupts your permanent clinical history and can place your physical life in danger.

When an impostor uses your Social Security number, driver's license, or health insurance card to obtain care, hospital Electronic Health Record (EHR) systems merge the impostor's clinical data with yours. If you are later rushed into an emergency room unconscious, doctors relying on a commingled chart could transfuse the wrong blood type, overlook a lethal penicillin allergy overwritten by the thief's profile, or deny pain relief because the thief was flagged as a narcotics seeker. Removing fraudulent charges and untangling mixed health records requires a coordinated legal strategy under both federal health privacy rules and Kentucky statutes.

Accessing and Correcting Mixed Medical Records Without Violating HIPAA

One of the most frustrating roadblocks Kentucky victims face occurs when a hospital billing department refuses to release the records of a fraudulent admission, claiming that showing you the file would "violate the impostor's HIPAA privacy rights." That excuse is legally incorrect. Under federal and Kentucky law, you have the right to inspect, obtain, and correct any record maintained under your identity:

• Your Right to Inspect Records Tied to Your Identity: Under the federal Health Insurance Portability and Accountability Act (HIPAA) Right of Access regulation (45 C.F.R. § 164.524), you have an enforceable right to inspect and obtain a copy of all protected health information and billing ledgers inside a provider's Designated Record Set linked to your name, date of birth, or Social Security number, within 30 calendar days of a written request.
• Kentucky's Free Medical Record Mandate: Under the Kentucky medical record access statute (Ky. Rev. Stat. § 422.317(1)), upon a patient's written request, any hospital, clinic, or physician in Kentucky must provide one (1) complete copy of the patient's medical record free of charge (any subsequent copies are capped at no more than $1.00 per page). As the Kentucky Court of Appeals confirmed in William C. Eriksen, P.S.C. v. Gruner & Simms, PLLC, 400 S.W.3d 290 (KY Court of Appeals 2013), healthcare providers must provide this free copy even when the request is submitted through the patient's retained attorney as their authorized agent.
• Forcing a 60-Day Chart Amendment and Record Segregation: Under the federal HIPAA Right to Amend rule (45 C.F.R. § 164.526), once you identify false diagnoses, lab values, blood types, or surgical notes created by an impostor, you can submit a written Request for Amendment to the provider's Privacy Officer. The hospital must act on your request within 60 calendar days (with at most one 30-day written extension) and notify all business associates, health information exchanges, and insurers to purge or unmerge the impostor's clinical entries from your chart.

Targeted Recovery Protocols by Healthcare Sector

Medicare and Kentucky Medicaid Fraud Recovery

Medical identity thieves-and occasionally unscrupulous clinics or durable medical equipment (DME) telemarketers-target seniors and low-income residents by billing Medicare or Kentucky Medicaid Managed Care Organizations (such as Passport by Molina, Humana Healthy Horizons, WellCare, or Anthem) for phantom wheelchairs, genetic testing swabs, home health visits, or sober-living services never rendered.

Fraudulent claims can exhaust your annual benefit limits or block pre-authorization for legitimate medical equipment you actually need. To clear government insurance records in Kentucky:

1. Audit Your MSN and Medicaid EOB Statements: Review every Medicare Summary Notice (MSN) or Kentucky Medicaid Explanation of Benefits (EOB) for unfamiliar physician names, diagnostic codes, or out-of-city clinics.
2. Request a New Medicare Beneficiary Identifier (MBI): Call 1-800-MEDICARE to report the compromised number and request a replacement MBI card.
3. File Formal State Fraud Reports: Report fraudulent Kentucky Medicaid billing under the state healthcare fraud statute (Ky. Rev. Stat. § 205.8463) to the Office of the Kentucky Attorney General Office of Medicaid Fraud and Abuse Control, Frankfort and the Kentucky Cabinet for Health and Family Services Office of Inspector General, Frankfort.

Prescription Drug Identity Theft (Doctor Shopping and KASPER)

In Kentucky, prescription drug identity theft is particularly dangerous because every Schedule II through Schedule V controlled substance dispensed in the Commonwealth is logged in the Kentucky All Schedule Prescription Electronic Reporting (KASPER) database pursuant to Ky. Rev. Stat. § 218A.202. When an acquaintance, relative, or rogue clinic employee steals your driver's license details or Social Security number to obtain opioids, stimulants, or benzodiazepines-a felony offense under the Kentucky controlled substance fraud and doctor-shopping statute (Ky. Rev. Stat. § 218A.140)-those prescriptions appear directly on your permanent KASPER history.

A corrupted KASPER report can cause your primary care doctor to fire you as a patient for violating a pain-management contract or even trigger a criminal narcotics investigation, since law enforcement officers can access KASPER records during drug investigations as upheld by the Kentucky Supreme Court in Williams v. Commonwealth, 213 S.W.3d 671 (KY Supreme Court 2006).

Fortunately, Kentucky law gives victims strong remedies. First, you have the right to request a copy of your own personal KASPER report directly from the Kentucky Cabinet for Health and Family Services Office of Inspector General, Frankfort to identify every pharmacy and prescriber tied to the fraud. Second, if a healthcare worker or third party misappropriates your identity to write or fill fraudulent prescriptions, you can sue them for substantial civil damages. In Maguire v. Crook, 605 S.W.3d 343 (KY Supreme Court 2020), the Kentucky Supreme Court affirmed a Court of Appeals ruling allowing a Kentucky patient-whose identity was used by a physician to write fraudulent prescriptions in violation of Ky. Rev. Stat. § 218A.140-to sue for statutory identity theft and emotional distress damages under Ky. Rev. Stat. § 411.210 without needing expensive expert psychiatric testimony.

Disputing Charges with Kentucky Hospital Networks and Debt Collectors

Whether the fraudulent treatment occurred at a major academic medical center in Lexington or Louisville or a regional hospital in Paducah or Pikeville, never pay a fraudulent medical bill just to protect your credit score-paying even $10 can be treated by revenue-cycle departments as an admission that the debt is yours. Instead, demand the hospital's Registration Face Sheet, Itemized UB-04 Institutional Claim Form, Intake Photo ID Scan, and Biometric/Timestamped Signature Logs. Comparing the impostor's physical description, emergency contact phone number, or signature against your driver's license quickly proves you were not the patient.

If the hospital has already sent the bill to a third-party debt collector or reported it to Equifax, Experian, or TransUnion, invoke two federal statutes immediately:

• 4-Business-Day Credit Bureau Block (15 U.S.C. § 1681c-2): Under Section 605B of the Fair Credit Reporting Act (FCRA), credit bureaus must block any medical collection resulting from identity theft within 4 business days of receiving your proof of identity, a copy of a police report, and Form FTC-ID-Theft, Federal, Federal Trade Commission, Identity Theft Victim's Complaint and Affidavit.
• Stopping Collection Harassment (15 U.S.C. § 1692g): Under the Fair Debt Collection Practices Act (FDCPA) and FCRA furnisher rules (15 U.S.C. § 1681s-2(a)(6)), once you send a written dispute and an Identity Theft Report to a hospital billing office or collection agency, they are legally barred from selling the debt or continuing to report it as valid.

Step-by-Step Process to Clear Fraudulent Medical Records and Bills in Kentucky

Step 1: Order Your Free Chart Under Ky. Rev. Stat. § 422.317 and Your Personal KASPER Report

Send a signed written request to the hospital's Health Information Management (HIM) department invoking Ky. Rev. Stat. § 422.317(1) and 45 C.F.R. § 164.524 to obtain one free copy of the clinical chart, intake ID scans, and itemized billing ledger for the disputed dates of service. Simultaneously request your personal prescription history from the Kentucky Cabinet for Health and Family Services Office of Inspector General, Frankfort.

Step 2: File a Kentucky Police Report and an FTC Identity Theft Affidavit

File a formal report for felony Theft of Identity (Ky. Rev. Stat. § 514.160) with your local municipal police department or county sheriff in the jurisdiction where you reside, and complete Form FTC-ID-Theft, Federal, Federal Trade Commission, Identity Theft Victim's Complaint and Affidavit. Under Ky. Rev. Stat. § 15.231, the Office of the Kentucky Attorney General, Frankfort holds concurrent jurisdiction with Commonwealth's attorneys and county attorneys to prosecute identity theft statewide.

Step 3: Serve a HIPAA Amendment Demand and FCRA 4-Day Block Notice

Deliver a certified-mail dispute packet containing your police report, FTC Affidavit, driver's license copy, and a written demand under 45 C.F.R. § 164.526 to the hospital's Privacy Officer and Patient Financial Services Director. Send copies to Equifax, Experian, and TransUnion demanding an immediate 4-business-day block under 15 U.S.C. § 1681c-2.

Step 4: Escalate Privacy Violations or Sue Under Ky. Rev. Stat. § 411.210

If a Kentucky hospital refuses to release your chart within 30 days or ignores your 60-day amendment request, file Form HHS-700, Federal, U.S. Department of Health and Human Services, Health Information Privacy Complaint Form with the U.S. Department of Health and Human Services Office for Civil Rights, Washington. If the thief is identified-or if a hospital, debt collector, or credit bureau willfully refuses to remove verified fraudulent charges-you can file a civil lawsuit in the Jefferson Circuit Court, Louisville, the Fayette Circuit Court, Lexington, or your local Circuit Court.

Costs, Deadlines, and Civil Damages in Kentucky

Under the Kentucky civil identity theft statute (Ky. Rev. Stat. § 411.210(1)), any victim of identity theft (Ky. Rev. Stat. § 514.160) or trafficking in stolen identities (Ky. Rev. Stat. § 514.170) may file a civil lawsuit in the county where either the victim or the defendant resides to recover compensatory damages, punitive damages, court costs, and mandatory reasonable attorney fees. Furthermore, under Ky. Rev. Stat. § 514.160(2), any business that violates the identity theft statute on more than one occasion automatically violates the Kentucky Consumer Protection Act (Ky. Rev. Stat. § 367.170).

Because both the FCRA and Ky. Rev. Stat. § 411.210 require losing defendants to pay the victim's reasonable attorney fees and costs, many consumer protection and identity theft lawyers handle medical billing and credit reporting lawsuits on a contingency basis. You can browse our directory of Kentucky consumer law and identity theft attorneys to schedule a case evaluation.

Frequently Asked Questions (FAQ)