Interesting. So an attacker can just get someone's info, then schedule an appointment and pretend to be that person? Seems like this could be blocked just by having the health companies keep a photo on file and verifying it before anything expensive.

And are there lots of cases of people stealing ID just to get medical care? That's both sad and pretty interesting. Do they catch a lot of people trying this? Even $1200 for a "kitz" sounds like a great deal given the cost of US medical services. I'd guess there's a fairly low risk of getting caught once you leave the hospital.