CUMMING, Ga. — A family spent five months trying to figure out who got an MRI and stuck them with a $3,700.00 bill.

Investigative reporter Bill McGinty discovered it's up to you to clear those bad medical bills, and that could take months of frustrating work.

“I was just shocked," said Cathy James. “What we thought was going to take a week at most to fix, took five months.”

Cathy James showed the hospital bill for her husband's MRI of the spine. But her husband wasn't at Northside Hospital in Georgia on that date. He was 40 miles away, and the family was on the hook for the $1,500 deductible for a stranger's MRI.

​“It’s not ours," James said. "I don’t have $1,500 to pay you. I can’t pay you. Somebody needs to fix this and make it right and find out what actually happened."

She said Northside Hospital insisted her husband had the procedure. The family immediately called the Forsyth County Sheriff's Office.

The police report says Mr. James "was out of town" and it "appears that his I.D. and insurance information were used to receive a medical procedure" and the hospital "had not taken any I.D."

"I asked the lady behind the counter, ‘Just out of curiosity do you have to have a photo I.D.? If someone comes in for a procedure and they don’t have a photo I.D., will you still preform the procedure?’ She said yes. They don’t have to have a photo I.D., they don’t have to have an insurance card," James said.

Northside Hospital said: "We always ask for identification. However, there are legal requirements that prevent us from refusing patient care on the basis patients have no identification.”

“How do you prove a negative? How do you prove you weren’t somewhere?" James was asked.

“You can’t," she replied, "and that’s the worst feeling in the world. That no one believes you."

Eighty million Americans were exposed to a massive data breach when Anthem Inc., the nation's second-largest insurance company, became a victim of a "very sophisticated" cyber attack. And last month, the health information of another 150,000 Georgians was lost by a state contractor that has six missing hard drives. With rising medical costs, there's a huge incentive for a thief to use someone else's insurance to bypass paying for co-pays and deductibles.

According to a study published last year by ID Experts, 65 percent of medical identity theft victims has to pay an average of $13,500 to resolve their case. Even if you do avoid becoming a victim of fraud, so called "keystroke errors" are among the top medical mistakes in both treatment and billing.

James said from August through December, the hospital was claiming the bill belonged to her husband. A letter sent from the insurance company to Georgia's insurance commissioner said Northside Hospital "had a signed form" with Mr. James' signature. Finally, in January, the insurance company pulled back its payment and the hospital canceled the debt. It only happened after a long fight.

“It took five months, easily three or four dozen phone calls, a police report, a complaint with the Georgia Insurance Commissioner’s office, a complaint with the Georgia Hospital Association," Cathy James said.

Northside Hospital responded with a written statement:

The billing issues with Mr. James have been resolved properly. These issues absolutely did not involve fraud. They resulted from human error in the billing process, during which incorrect patient data was entered. Northside Hospital constantly reviews our billing procedures to ensure accuracy and compliance. This was an unfortunate procedural error, and we apologize for the inconvenience it caused.

“Everything about the bill said that it was ours, other than the fact that we weren’t there," James said.

The state is offering free medical identity monitoring for those affected by its breach, but there's no way to prevent someone from using your medical information, or a hospital punching in the wrong data. The Federal Trade Commission says you do have a right to see medical records in your name, even if someone else impersonates you. The FTC suggests closely checking your insurer's explanation of benefits that comes in the mail before the bill arrives. They also suggest keeping an eye out for other signs of medical identity fraud:

  • A bill for medical services you did not receive
  • A call from a debt collector about a medical debt you don't owe
  • Medical collection notices on your credit card that you don't recognize
  • A notice from your health plan saying you reached your benefit limit
  • A denial of insurance because your medical records show a condition you don't have