In Illinois, the US Justice Department charged five defendants on 30 June 2025 over a $703 million Medicare scheme. Beneficiaries' identification numbers were allegedly obtained "through theft and deceptive marketing", artificial intelligence (AI) allegedly made fake recordings of their consent, and claims followed for products and services they "did not request, need, or receive" (Justice Department, 30 June 2025). The charges are allegations.
What is know your patient (KYP)?
Know your patient is the healthcare practice of confirming that the person at the desk, on the phone or in a portal is the patient whose record, prescription or claim is at stake. The full form of KYP is know your patient. In banking, customer onboarding matches the applicant to existing records, confirms identity and logs each decision with its evidence; KYP puts the same steps at the points of a patient's journey. In fraud detection and prevention, that identity check at onboarding is one of the controls placed before a payment leaves.
On 28 October 2026, a search for the phrase returned no section in the eCFR, no result on legislation.gov.uk and no hit in four EU data and health acts. Its one Federal Register hit is a pharmacist's testimony in a 2016 DEA decision on dispensing oxycodone.
How is KYP different from KYC and patient identification?
Table 1. Know your patient, know your customer and clinical patient identification compared (as of October 2026).
| Purpose | Who checks | Rule or standard | When | |
|---|---|---|---|---|
| Know your patient | The person is the patient on the record | Front desk, records team, billing | No rule uses the term; HIPAA sets checks at 45 CFR 164.514(h) and 164.312(d) | Registration to billing |
| Know your customer | Identify and verify a customer | Bank onboarding analyst | FATF Recommendation 10; 31 CFR 1020.220 | At onboarding |
| Clinical patient identification | Right patient, right care | Clinician | WHO Patient Safety Solution 2 (May 2007) | Before care |
KYC is a legal duty. Under know your customer, a bank identifies each customer and runs KYC verification against an independent source. Clinical patient identification is a safety practice: WHO asks for at least two identifiers, such as name and date of birth, and never the room number.
What is the importance of KYP in stopping medical identity fraud?
In the national takedown of June 2026, a California hospice owner allegedly paid a funeral home employee $1,000 to $3,000 a person for deceased Medicare beneficiaries' information, then billed Medicare for hospice care those people never received (Justice Department, 23 June 2026). Billing someone else's patient identity is medical identity theft, a healthcare fraud scheme.
A valid Medicare number proves the number, not the person. CMS took Social Security number based claim numbers off Medicare cards, and since 1 January 2020 claims must carry the Medicare Beneficiary Identifier (MBI), with a few exceptions. Both cases allege real beneficiaries' details.
CMS's fact sheet on common fraud types (July 2016) names a second route: an ineligible person receiving services "by impersonating a beneficiary", which is identity fraud at the clinic door.
How does the KYP process work?
Picture a patient who registers at a clinic, is treated and billed, and later asks for their records through the portal. The KYP process checks that patient at six points, each with an owner:
- Registration (front desk). In England a GP surgery asks for name, date of birth and address and needs no ID (nhs.uk).
- Identity check (policy owner). A photo ID or a database match, only where the provider's written policy sets one.
- Record match (records team). Two identifiers tie the patient to one record, so two patients with one name keep separate charts.
- Point of care (clinician). Name and date of birth again before treatment, the WHO safety step.
- Release of records (records team). Under HIPAA, identity and authority are verified before a disclosure when either is not already known.
- Claim and benefit review (billing team and payer). The claim carries the MBI, and the payer checks that the care billed fits the patient.
Can KYP checks be automated or done remotely?
NHS login's top proofing level, P9, needs a physical comparison between the photo ID and the person, online or offline (NHS login). From 26 March 2027, the EU's European Health Data Space Regulation gives a patient who uses a health data access service the right to identify with a recognized eID (Article 16(1)).
Automation of the KYP process borrows from banking: eKYC reads the document and runs a liveness check, and electronic identity verification matches details against databases, the tools banks buy as KYC solutions or AML software. The provider's policy decides where the software checks. A person decides on a failed check.
Are KYP checks a legal requirement in healthcare?
No law requires KYP by name. As of October 2026, identity duties sit at named points of the patient journey.
Table 2. Patient identity rules in the US, the UK and the EU by journey point (as of October 2026).
| Jurisdiction | Rule | What it asks | Journey point | Source and date |
|---|---|---|---|---|
| US | 45 CFR 164.514(h), Privacy Rule | A covered entity verifies the identity and authority of a person asking for protected health information (PHI), if not known; disclosures under 164.510 (facility directories, people involved in care) excepted | Release of records | eCFR, current text |
| US | 45 CFR 164.312(d), Security Rule | Procedures to verify that a person seeking electronic PHI "is the one claimed" | Portal sign in | eCFR, current text |
| US | 45 CFR 164.524, with HHS's reading in 86 FR 6446 | Act on an access request within 30 days, or 60 with a written reason for the delay; no particular form of verification, if checks do not bar or unreasonably delay access | Patient's records request | HHS, 21 January 2021, p. 6470 |
| US | Proposed 164.514(h)(2)(v), in 86 FR 6446 | Would ban unreasonable verification, such as notarization or proof in person where a remote check is practicable | Patient's records request | Proposed 21 January 2021; not final as of October 2026 |
| US | 16 CFR part 681, Red Flags Rule | A written identity theft program for financial institutions and creditors with covered accounts; illustrative signs in Supplement A | Billing, if the provider is a creditor | eCFR, current text |
| England | NHS GP registration | Name, date of birth, address; "You do not need ID, proof of address or proof of immigration status" | Registration | nhs.uk, reviewed 28 July 2025 |
| England | NHS login, level P9 | Physical comparison between the photo ID and the person | Remote access | NHS login documentation |
| UK | UK GDPR Article 12(6), read with the Data Protection Act 2018 (DPA 2018) | With reasonable doubts, ask for information to confirm identity; for requests received from 5 February 2026, also delay the request until it is confirmed | Records request | 12(6)(b) in force 5 February 2026 |
| EU | GDPR Article 12(6), recital 64 | With reasonable doubts, ask for more information; "use all reasonable measures to verify the identity" of a requester | Records request | Applies since 25 May 2018 |
| EU | Directive 2012/52/EU, Annex | Surname(s), first name(s) "written out in full", date of birth | Prescription for use in another member state | 20 December 2012 |
| EU | Regulation (EU) 2025/327 (European Health Data Space), Article 16(1) | Right to identify with a recognized eID when using a health data access service | Remote access | Applies from 26 March 2027 |
HHS reads the Privacy Rule as mandating no particular form of verification "(such as viewing an individual's driver's license at the point of service)", if checks "do not create barriers to, or unreasonably delay" access (86 FR 6446, p. 6470). Since 18 December 2010, a provider is a Red Flags Rule creditor if it regularly uses consumer reports or reports to credit bureaus in connection with a credit transaction, or lends money to be repaid; funds advanced for expenses incidental to its own service do not count, and agencies may add other creditors by rule (15 U.S.C. 1681m(e)(4)).
A front desk ID demand is the provider's own policy, not a HIPAA rule: HIPAA's identity duties apply when records leave the provider or someone signs in to them. A KYP policy is a written choice about where the check sits.
How did patient identity rules move in 2026?
- 14 January 2026. HHS gave notice of a Tribal consultation on its 2021 proposal, set for 6 February (91 FR 1481). As of October 2026 the ban on unreasonable identity verification is not final.
- 5 February 2026. Section 76 of the Data (Use and Access) Act 2025 came into force (S.I. 2026/82): for requests received from that day, a UK controller may delay a request until identity is confirmed, and the month runs from the latest of request, identity information and any fee (Article 12A), two more for complex or numerous requests.
- 26 March 2027, next. The European Health Data Space Regulation, Regulation (EU) 2025/327, starts to apply, Article 16(1) included.
What gives away a false patient identity?
Each sign comes from a rule or a charged case; item numbers refer to the Red Flags Rule's Supplement A:
- The photo does not match the person. Someone else's ID is in use (item 6).
- ID details differ from what the patient says or from the record. One is wrong (items 7, 8).
- One identifier, several people. Item 14 flags a Social Security number already given by others; a Medicare number can be used by an ineligible person (CMS) or allegedly sold (2025 charges).
- Claims for products the patient "did not request, need, or receive". The number was billed without the person, as the 2025 charges allege.
- Consent the patient does not recognize. The 2025 charges allege that AI made fake recordings of that consent.
- A claim filed after the patient died. The 2026 hospice charges allege bills and backdated records for recently deceased beneficiaries who never received the care.
- A third party asks for records without shown authority. HIPAA checks authority as well as identity (164.514(h)).
The Illinois charges came more than five years after claims moved to the new Medicare numbers: the card changed, and the identities were allegedly billed anyway. A provider controls where its own checks sit: release of records, portal sign in, billing review and any other point its written policy names.
Related terms
- Healthcare fraud. Deceiving a public or private health program for payment; billing a stolen patient identity is one of its schemes.
- Identity fraud. Using another person's identifying details without permission to obtain money, goods or services.
- Synthetic identity fraud. An identity assembled from real and invented details to open accounts or get credit.
- KYC verification. The step in which a bank checks a customer's identity details against an independent source.
- Know your customer. The bank duty to identify and verify customers, the idea KYP borrows.
- eKYC. Remote identity checks through document reading, liveness checks and database matches.
How this entry was checked. Written from the rule texts by Melis Alparslan, Regional Sales Manager at complead. Fact checked by: Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, 29 October 2026. Last reviewed: 29 October 2026. The definition rests on a search for the phrase in the eCFR, on legislation.gov.uk, in four EU acts and in the Federal Register; the patient in the process section is illustrative, and every charged case is an allegation. Every rule in Tables 1 and 2, the CMS pages and the two Justice Department releases were reopened at their publishers on 28 October 2026, and the 2021 HHS proposal was checked against the Federal Register for a final rule the same day.
