You are not being paranoid. I know a couple of people who have been through identity theft and it will stick with you for LIFE if someone steals your identity. One friend's identity was stolen perhaps 15 years ago now, and she still carries a special letter with her everywhere she goes, testifying to her identity. You already know this brother has a very bad track record and cannot be trusted.
Tell the credit monitoring companies that his wallet was out of his possession for some time and though it was returned, you suspect that his information might have been compromised.
The following should ALL be called now and told to flag his accounts for possible attempts at fraud:
--Health insurance company
--Credit reporting companies
--Bank (all of them, if you use more than one, re: his debit card)
--Credit card companies
--Any other entity from which he has a card. For instance, does he carry any department store credit cards in that wallet? I would notify them as well.
He will be asked, "Do you want us to issue a new card?" I would say definitely yes. You can ask the health insurer for a new personal ID number and new card, and should do so ASAP. Same with credit cards -- tell them you want a new one with a different number and they should flag the old number as defunct as of a certain date. They should all be willing to do this pretty readily! These companies have a strong interest in preventing identity theft because such prevention saves them money. He does not have to say the wallet was in his brother's hands or name his brother; he can just say that on date X he lost his wallet for a long time and someone returned it but now he is concerned that stuff in it was messed with...
Do not just monitor your credit via the reporting agencies; be proactive and get new credit card(s) and a new number from the insurer and tell the insurer to flag your account in case someone tries to get health services on your husband's account.