How to Tell If a Doctor’s Note Is Fake: Red Flags and Verification

To tell if a doctor’s note is fake, compare it against what a real note contains, look for a short list of concrete red flags on the page, and then confirm it with an independent phone call to the medical office listed. Visual inspection catches the obvious forgeries. A phone call and a provider lookup catch almost everything else.

What a Real Doctor’s Note Contains

You can’t spot a fake without knowing what the genuine article looks like. A legitimate note is printed on official letterhead showing the practice or hospital name, full street address, phone number, and often a fax number. The provider’s full name appears with credentials (M.D., D.O., N.P., P.A.), and the note carries an actual signature rather than a typed name or a pasted image.

The patient is identified by full legal name, and the date of the visit is stated. If the note excuses an absence, it usually spells out the specific dates the patient should be away from work or school and any activity restrictions. Return-to-work or return-to-school instructions are common after injuries or procedures. The language is concise, clinical, and free of spelling errors.

One detail most people miss is the provider’s National Provider Identifier, a unique 10-digit number assigned to every healthcare provider in the United States. Many legitimate notes include it, and you can verify it for free through the CMS National Plan and Provider Enumeration System registry, which shows the provider’s name, specialty, and practice address.¹ An NPI confirms the person is a registered provider but does not guarantee the license is currently active. For that, use a state medical board lookup, which most states offer as a free online search.

Red Flags on the Page

The easiest fakes to catch come from template websites that sell fill-in-the-blank notes for a few dollars. They share telltale problems: the “clinic” listed doesn’t exist, the phone number is disconnected or answers with no practice name, and the formatting looks like it came out of a word processor rather than a medical records system. If the practice name doesn’t turn up in a basic internet search or a phone directory, that alone is a serious warning sign.

Beyond outright fakes, watch for these:

Vague language. Phrases like “patient was seen” or “medical reason” with no dates, restrictions, or return instructions. Real notes get specific about when the patient can come back, even without disclosing a diagnosis.
Spelling and grammar errors. Medical offices use standardized templates built into their electronic health record systems. Typos in a doctor’s name, the practice address, or basic medical terms are unusual.
Mismatched fonts or inconsistent formatting. A patient’s name in a different font than the rest of the document, or letterhead at a lower resolution than the body text, suggests someone layered information onto a template.
Dates that don’t add up. A note dated on a Sunday or a federal holiday, or a claimed visit on a date the employee was known to be elsewhere, warrants a closer look.
An overly dramatic diagnosis for a routine excuse. Someone calling in with a cold who returns with a note referencing an exotic condition or unusually specific medical jargon may have a note written by someone trying too hard to sound medical.

For notes submitted as digital files, the document’s metadata is worth a look. PDF files store hidden properties including the software used to create them, the author name, and the creation date. A note supposedly from a medical office but created in Microsoft Word or an online PDF editor is suspicious. Most legitimate offices generate documents through their electronic health record software, and the metadata reflects that. Free online metadata viewers surface this information in seconds.

How to Verify the Note

The most reliable step is a phone call to the medical office. Find the office’s contact information independently rather than trusting the number printed on the note. Search for the practice online, check its website, or look it up through a provider directory. If the number on the note doesn’t match what you find independently, that discrepancy is itself a red flag worth documenting.

Keep your questions narrow when you call. Privacy laws prevent the office from telling you what the patient was treated for, but most offices will confirm whether they issued a note for the named patient on the specified date. Ask exactly that. If the office has no record of the patient or the visit, you have your answer.

Cross-check the provider’s credentials as well. The NPI registry confirms whether the named doctor is a registered provider and shows the listed practice address and specialty.¹ State medical board websites go a step further and show whether the license is active, suspended, or revoked. If the doctor named on the note doesn’t appear in either database, the note is almost certainly fabricated.

Document every step: the date and time you called, who you spoke with, and what they confirmed or denied. That paper trail matters if the situation escalates to discipline or a legal dispute.

What HIPAA Lets You Ask

Verifying a note puts you inside HIPAA territory. The HIPAA Privacy Rule restricts how covered entities (hospitals, clinics, doctors’ offices) use and disclose protected health information. A covered entity generally cannot share a patient’s health information unless the Privacy Rule permits it or the patient authorizes the disclosure in writing.²

In practice, when you call to verify a note, the office can confirm that the note is authentic and that the patient was seen on the date listed. The office cannot share the diagnosis, the treatment, or details of the patient’s condition. HIPAA’s “minimum necessary” standard requires anyone requesting protected health information to ask only for what’s needed for the specific task. For note verification, that task is confirming the document is real.

A narrow exception applies to workers’ compensation situations. Covered entities may disclose health information to employers when it concerns a work-related illness or injury and the employer needs the information to comply with OSHA or similar workplace safety laws.² Outside that window, stick to basic confirmation.

One practical workaround: ask the employee to sign a HIPAA authorization form permitting the provider to release specific information to you. This is voluntary on the employee’s part, but refusing to cooperate when there’s a legitimate reason to question a note can itself be telling. Keep the authorization narrow, limited to verifying the note rather than requesting complete medical records.

A separate boundary applies if the note supports a request for reasonable accommodation under the Americans with Disabilities Act. There, the employer can ask about the nature, severity, and duration of the impairment and why the accommodation is needed, but cannot demand full medical records.³

Extra Tools When the Note Supports FMLA Leave

If the note is a medical certification supporting Family and Medical Leave Act leave, federal regulations give you two tools before you resort to a second opinion. Authentication means sending the provider a copy of the certification and asking them to verify that they actually completed and signed it. Clarification means contacting the provider to decipher unclear handwriting or ambiguous responses on the form. Neither process allows you to request additional medical information beyond what appears on the certification.⁴

If authentication and clarification don’t resolve the doubt, you can require the employee to get a second opinion from a provider you choose, at your expense. The provider you select cannot be someone who works for you on a regular basis. If the second opinion conflicts with the first, you can require a third opinion from a provider jointly selected by you and the employee, and that third opinion is final and binding. Reasonable travel expenses to attend these appointments must be reimbursed.⁴

While the second or third opinion process plays out, the employee is provisionally entitled to FMLA benefits, including continuation of group health coverage. If the opinions ultimately show the employee doesn’t qualify for FMLA leave, the time off won’t be designated as FMLA leave, and the employer can treat it under its standard attendance policy.⁴

What Happens to Someone Caught Submitting a Fake

For employees, the most common consequence is termination. Employers generally treat a forged document as a serious breach of trust that justifies firing, and courts have upheld these terminations even where other protections existed. An employee who fraudulently obtains FMLA leave loses the right to job restoration that FMLA would otherwise guarantee. Getting references from the former employer becomes difficult, which can affect the person’s career for years.

Criminal charges are possible but less common. Depending on the jurisdiction, submitting a forged note can qualify as forgery, fraud, or uttering a forged instrument. Charges are more likely when the note was used to obtain a financial benefit like paid time off, insurance coverage, or government benefits. Using a real doctor’s name or practice identity without permission raises additional forgery concerns, since the doctor or practice becomes an unwitting party to the deception. When a fake medical document involves a government agency or a government-issued form, federal forgery statutes can apply, carrying penalties of up to five years in prison.⁵

Students face parallel consequences. A fake note used to excuse an absence or extend a deadline typically violates the school’s academic integrity or honor code policy. Penalties range from a failing grade on the assignment to suspension or expulsion, depending on the institution and any prior violations. At the college level, an honor code violation tied to document forgery can appear on a student’s academic record and affect graduate school admissions or professional licensing later.

1
NPPES NPI Registry. NPPES NPI Registry Search
2
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
3
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees Under the ADA
4
eCFR. 29 CFR 825.307 – Authentication and Clarification of Medical Certification
5
Office of the Law Revision Counsel. 18 U.S. Code 1017 – Government Seals Wrongfully Used and Instruments Wrongfully Sealed