Medical identity theft is costly for victims