What Is Medical Canvassing? Process, HIPAA, and Your Options

Medical canvassing is an investigative technique in which an insurer, or an investigator working for one, systematically contacts healthcare providers in a geographic area to find out whether you have been treated there. It is used most often in personal injury, workers’ compensation, and disability claims. The point is not to pull your records. The point is to build a map of where you have received care, so the insurer can compare that map against what you disclosed on your claim.

What the Investigator Is Actually Asking

A canvasser typically calls facilities and asks a narrow question: has this person been seen here, and if so, when. They are looking for yes-or-no confirmation along with dates of service and basic visit types. They are not requesting charts or clinical notes at this stage.

The output is a list. It shows every facility contacted, whether treatment was confirmed, and whatever limited details the facility was willing to share. From that list, the insurer or its attorneys decide which providers to pursue for full records through a proper authorization or, if litigation is underway, a subpoena.

The kinds of facilities contacted depend on what you claimed. A soft tissue injury steers investigators toward chiropractors, physical therapists, and urgent care. A fracture claim points to orthopedic clinics and imaging centers. Head, back, or neck claims lead to neurologists and neurosurgeons. Psychological injury claims trigger contact with psychiatrists, psychologists, and pharmacies that fill psychiatric medications.

Why an Insurer Canvasses a Claim

Canvassing costs time and money, so insurers don’t do it on every file. It tends to appear when something in the claim doesn’t line up. Common triggers include gaps or inconsistencies in the treatment history you reported, soft tissue injuries that are hard to verify through imaging, unusually large claim amounts, a history of prior claims for similar injuries, and early involvement of an attorney. Social media activity that seems to contradict claimed limitations can also push an insurer to investigate further.

The practical threshold is suspicion backed by economics. A modest claim rarely justifies the effort. A six-figure disability claim with thin documentation is a different matter.

Canvassing is especially useful for surfacing pre-existing conditions that might explain symptoms you are attributing to a recent incident. If you filed a workers’ compensation claim for a back injury and canvassing turns up chiropractic visits for back pain six months earlier, that finding can change the value of the claim and, in some cases, its validity. Canvassing can also reveal patterns of similar claims filed across different insurers, which insurers treat as a strong indicator of fraud.

The Authorization You Signed Controls a Lot of This

Medical canvassing doesn’t happen in a legal vacuum. When you filed your claim, the insurer almost certainly asked you to sign a medical authorization. That form permits the insurer, or its agents, to contact providers and obtain information related to your claim. The scope of what you signed usually determines how far the canvass can go.

A broad authorization can allow contact with any provider you have ever seen, for any condition, with no time limit. A narrow one can be restricted to specific providers or a defined window around the incident. Under HIPAA, a valid authorization has to describe the information to be disclosed, identify who may disclose it, identify who will receive it, state the purpose, carry an expiration date, and bear your signature. It also has to inform you that you can revoke it in writing.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required

If you signed something open-ended, you handed the insurer a key to your entire medical history. If the authorization is limited, the insurer may have to come back and ask for a broader one, or wait until litigation to pursue records by subpoena.

What HIPAA Lets a Provider Confirm

The general HIPAA rule is that a provider cannot use or disclose your protected health information unless a specific exception applies.2eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules The exceptions that matter for canvassing are patient authorization, court orders, and subpoenas with proper safeguards.

Protected health information is broader than most people expect. It covers any individually identifiable information relating to your health, the care you received, or payment for that care.3eCFR. 45 CFR 160.103 – Definitions A receptionist confirming that you were seen on a particular date is disclosing PHI, because it links you to the provision of healthcare. Facilities that understand the rule will not answer canvassing calls without seeing a valid authorization or another legal basis first.

Even when disclosure is permitted, HIPAA’s minimum necessary standard limits what a provider can share to what is needed for the stated purpose.4U.S. Department of Health and Human Services. Minimum Necessary For canvassing, that generally means dates of service and visit types rather than clinical detail.

When no authorization exists, HIPAA still allows disclosure under a court order or a subpoena. A subpoena that is not accompanied by a court order requires satisfactory assurance that you were notified and given a chance to object, or that the requesting party has sought a qualified protective order.5eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required Subpoenas typically come into play once canvassing has identified where you were treated and litigation is underway to get the full records.

What You Can Do if You’re Being Canvassed

Read the authorization form before you sign it. This is the single most useful step. A broad, open-ended release gives the insurer wide latitude across your medical history. You can often negotiate the scope so it is limited to specific providers, conditions related to your claim, or a defined time window around the incident.

You can also revoke a HIPAA authorization in writing at any time. Revocation does not reach back to information already disclosed before the provider received it.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Revoking mid-claim will likely slow or complicate the claim, but it is a real tool, particularly if you believe the insurer is digging into treatment unrelated to what you claimed.

If a provider disclosed your information without a valid authorization and without a court order or subpoena, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces HIPAA. In litigation, improper canvassing practices can also be raised to challenge how the insurer obtained what it is trying to use.

What Canvassing Doesn’t Capture

Canvassing is useful, but it is not comprehensive. It is geographic, so treatment you received while traveling, at facilities near a friend’s home, or through telehealth may never surface. Name-matching produces both false positives and false negatives, especially for common names or after a name change. Facilities that have closed, merged, or changed records systems may not respond at all.

The technique is also shallow by design. A canvass confirms where and roughly when. It does not reveal diagnoses, treatment notes, or outcomes. Those require full records obtained through authorization or legal process. An insurer that treats canvassing results as proof of anything on their own is drawing conclusions the data can’t support. For you, that means a canvass hit is a lead the insurer will follow, not a finding you have to accept at face value.