Those seemingly harmless medical forms everyone fills out before seeing a doctor can lead to identity theft if they get into the wrong hands.

Names, birthdates and—more importantly—Social Security numbers can help hackers open fake credit lines, file false tax returns and create false medical records. And health care businesses can lag far behind banks, credit card companies and retailers in protecting such sensitive information.