Medical Identity Theft After Death: How It Happens and What Executors Can Do

Most executors focus on freezing credit cards and monitoring bank accounts after a death. Medical identity theft flies under the radar because it doesn't show up on a credit report — and it can continue for years before anyone notices.

How Medical Identity Theft Works

A fraudster using a deceased person's identity to obtain healthcare typically has the person's name, date of birth, and Social Security Number — the same details that appear in obituaries, probate filings, and data broker databases. With those three data points, they can present at emergency rooms, urgent care clinics, and pharmacies, particularly when the death has not yet been reflected in the records used to verify identity or coverage.

The fraud takes several forms:

• Direct service fraud. Someone uses the deceased's insurance information to receive treatment, fill prescriptions (including controlled substances), or undergo procedures. The bills go to the estate or the insurer.
• Insurance claim fraud. A provider or third party submits claims under the deceased's policy for services never rendered. This can also occur with Medicare and Medicaid.
• Prescription drug diversion. Someone may use the deceased's identity to obtain opioids or other controlled medications that are then resold. Notify the insurer and pharmacy if you find suspicious prescriptions.

Why It's Hard to Detect

Credit monitoring catches financial identity theft because new accounts generate credit inquiries and appear on bureau reports. Medical records exist in a completely separate system. HIPAA regulations make it difficult even for authorized executors to access the deceased's medical records without specific documentation, and there's no centralized "medical credit report" to check.

The FTC reported over 1.35 million identity theft complaints in 2025, but medical identity theft is widely considered underreported because the victims — in this case, deceased individuals — never experience the consequences personally.

What Executors Should Do

Notify health insurers immediately. Contact every health insurance provider the deceased had — employer-sponsored plans, Medicare, Medicaid, and any supplemental policies. Request that the account be flagged as deceased and ask for an Explanation of Benefits (EOB) summary covering the six months before and after death. Claims for services dated after death should be investigated; a claim may be submitted after death for care provided before death.

Contact Social Security and Medicare. In most cases, the funeral home reports the death of a Medicare beneficiary to Social Security. To report or verify the death, call SSA at 1-800-772-1213. For suspicious Medicare charges or help requesting the deceased's Medicare Summary Notice, call 1-800-MEDICARE (1-800-633-4227); CMS requires proof of authority to request a deceased beneficiary's health information. Report suspected Medicare fraud to the HHS Office of Inspector General at 1-800-HHS-TIPS (1-800-447-8477).

Notify the deceased's primary care provider and pharmacies. Ask each provider to flag the patient record as deceased. This can help prevent prescriptions from being filled and appointments from being scheduled under the deceased's name. Pharmacies linked to the deceased through insurance should be notified so they can screen new prescriptions against the record.

Request medical records before closing the estate. Under HIPAA, a personal representative with legal authority (Letters Testamentary or Letters of Administration) can request the deceased's medical records. Review them for treatments, diagnoses, or prescriptions that don't match the deceased's known medical history — entries made after death are obvious fraud, but pre-death entries by unknown providers may indicate the fraud started earlier.

File reports. If you find evidence of medical identity theft, file with the FTC at IdentityTheft.gov, report to the insurer's fraud division, and file a police report in the jurisdiction where the fraudulent services were obtained. For Medicare fraud specifically, the HHS OIG handles investigations.

The Long Tail of Medical Identity Fraud

Medical identity theft can leave incorrect diagnoses, prescriptions, or treatment entries in the deceased's medical record. If you find entries that do not belong to the deceased, flag them with the provider or insurer.

The Identity Theft Prevention After Death toolkit includes an agency communication log and notification templates for health insurers, Medicare, and pharmacy chains — the same documents executors use for credit bureaus, adapted for the medical system's separate requirements.