Can Life Insurance Companies Request Medical Records Under HIPAA?

Life insurance companies may request medical records to assess risk, but the Health Insurance Portability and Accountability Act (HIPAA) imposes limits on how those records can be obtained and used. A covered entity—such as a doctor's office—cannot release records without the policyholder's signed authorization, unless an exception applies. The insurer's request must be specific, and the patient can refuse or provide a limited authorization that restricts the scope or duration of the disclosure.

HIPAA's Core Requirements for Medical Record Disclosure

HIPAA's Privacy Rule mandates that any disclosure of protected health information (PHI) be based on a written authorization from the patient. The authorization must:

• Identify the records or category of records to be disclosed.
• Specify the purpose of the disclosure.
• State the name of the recipient.
• Include a statement that the disclosure is voluntary and that the patient can revoke it.

When a life insurer seeks records, the patient must sign such an authorization, or the insurer must rely on an applicable exception, such as the treatment exception (when the insurer is providing treatment or health services) or the public interest exception (rarely applicable to underwriting).

Exceptions That Allow Record Requests Without Authorization

HIPAA includes a few narrow circumstances where a covered entity can disclose PHI without patient consent:

• Medical necessity: When the disclosure is needed for the patient's treatment.
• Public health activities: For disease surveillance or outbreak control.
• Law enforcement: If required by a subpoena, court order, or law.

Under these exceptions, a life insurer would still need a legal basis—often a subpoena or court order—to compel a physician to release records. Direct requests from the insurer to a provider do not, by themselves, trigger an exception.

What the Insurer Must Do Before Requesting Records

Before contacting a provider, the insurer must:

• Obtain the patient's written authorization.
• Use the authorization to request only the records that are relevant to underwriting.
• Ensure the provider follows HIPAA's safeguards when transmitting PHI.

Failing to follow these steps can expose the insurer to HIPAA enforcement actions and civil liability.

Patient Rights and Remedies

Patients can:

• Review the insurer's request and the records they plan to obtain.
• Ask the insurer to limit the scope or duration of the disclosure.
• File a complaint with the Department of Health and Human Services Office for Civil Rights if they believe HIPAA was violated.

In short, while life insurers can request medical records, HIPAA requires a valid, patient‑signed authorization or a legally permissible exception. Insurers must adhere to these rules to avoid privacy violations.