(Source) Brandon Sharp managed a gas company in East Texas. Healthy, in his thirties, Sharp rarely saw a doctor. And yet he owed thousands of dollars in medical bills. Sharp was the target of medical identity theft, which victimizes tens of thousands of people each year. Thieves steal patient information, including names, Social Security numbers, addresses, and medical histories, and then submit fraudulent insurance claims for surgery and prescriptions. Victims, like Sharp, face more than inconvenience: sometimes police arrest them instead of the thief for insurance fraud, or their information is conflated with the thief’s, leading to misdiagnosis. Contrary to popular opinion, the most common mode of theft is not computer hacking or breaking and entering but unauthorized disclosure by providers. Section 33.13 of New York’s Mental Hygiene Law aims to prevent unauthorized disclosure. It prohibits providers from releasing patient information, specifically mental health records, absent an exception. A mental health record includes “all pertinent documents relating to the patient” about legal status, examination, care, and treatment. However, New York state courts routinely violate Section 33.13. Claimants often sue New York when a patient in a state hospital injures them. In these cases, New York courts have ordered hospitals to [read more]