Insurance companies can see a meaningful slice of your medical history, but what medical records insurance companies have access to depends on the type of insurance and how they’re getting the information. Health insurers automatically receive diagnosis, treatment, and billing details tied to every claim they pay, with no separate permission from you. Life, disability, and long-term care insurers need your signed authorization before pulling records, and when they do, they often reach much further back into your history than a health plan ever would. Federal law sets boundaries on both channels, and certain categories of records sit behind stronger walls than others.
What Health Insurers See Through the Claims Process
Every time your doctor bills your health plan, information flows. Under HIPAA, providers can disclose protected health information for treatment, payment, and healthcare operations without asking you first.1U.S. Department of Health and Human Services. Uses and Disclosures for Treatment, Payment, and Health Care Operations That’s the legal basis for the entire billing system.
What this looks like in practice: your insurer sees the condition you were treated for, the tests ordered, the procedures performed, and what each line item cost. The information arrives claim by claim, tied to the specific service being billed. Your plan doesn’t get a complete download of your chart. It gets what’s needed to decide whether to pay.
The Specific Records Insurers Typically Receive
Whether the records come through a claim or through a signed authorization, the categories tend to look similar:
- Treatment histories, including office visit notes and hospital discharge summaries
- Diagnostic results such as lab work, imaging studies, and pathology reports
- Surgical and procedure reports with follow-up documentation
- Rehabilitation records from physical therapy, occupational therapy, and similar recovery care
- Prescription history, including medications, dosages, and filling records
- Itemized billing records and payment information
Health insurers get this piecemeal, claim by claim. Life and disability underwriters, by contrast, may ask for a sweeping view of your health history at the application stage.
When an Insurer Needs Your Written Authorization
Anything outside the claims channel generally requires your signed permission. This comes up most often when you apply for new life, disability, or long-term care coverage and the company underwrites your health. It can also happen when a health insurer disputes a claim and wants records beyond what was originally submitted.
HIPAA requires authorization forms to be written in plain language and to include specific elements:2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
- A description of the information to be disclosed
- The person or entity authorized to release it
- The person or entity who will receive it
- The purpose of the disclosure
- An expiration date or event
- Your signature and the date
You can push back on scope. If a form asks for records from every provider you’ve ever seen, you can try to narrow it before signing. Refusing to sign during life or disability underwriting usually means the policy won’t be issued, so most applicants agree. But understanding what you’re authorizing matters, because broad language opens doors you may not have meant to open.
Insurers often use third-party retrieval vendors to collect the records after you sign. You’re dealing with the insurer, but your file may pass through an intermediary on its way there.
The Ceiling: Minimum Necessary
Even with the right to disclose, providers and insurers are supposed to limit what they share to the minimum reasonably needed for the purpose at hand.3U.S. Department of Health and Human Services. Minimum Necessary Requirement A claim for knee surgery shouldn’t trigger disclosure of your psychiatric history.
Enforcement is uneven. Some providers send more than they should, and insurer requests aren’t always narrowly tailored. But the obligation exists, and if you believe a provider disclosed far more than the situation required, you can file a complaint with the HHS Office for Civil Rights.
Records That Receive Extra Protection
Some categories of health information sit behind stronger walls, and a general authorization doesn’t unlock them.
Psychotherapy Notes
Notes a therapist takes during counseling sessions, documenting the conversation and clinical analysis, are treated separately from the rest of your medical file. HIPAA requires them to be stored apart, and releasing them requires a specific, standalone authorization. An insurer cannot fold a request for psychotherapy notes into a broader records authorization.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Insurers also cannot deny reimbursement because you refuse to release these notes. A therapy claim gets processed on billing codes and standard clinical information. The session notes stay with the therapist.
Substance Use Disorder Treatment Records
Federal regulations under 42 CFR Part 2 impose stricter confidentiality on substance use disorder treatment records than HIPAA applies to general health information. Any disclosure that could identify someone as having received substance use treatment requires written consent.4eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records Recent updates allow a single consent to cover future disclosures for treatment, payment, and healthcare operations, aligning the framework more closely with HIPAA, but that initial consent is still required.5U.S. Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule
HIV and AIDS Information
HIV status receives extra protection at both federal and state levels. Positive test results reported to state health departments are stripped of personal identifying information before being forwarded to the CDC, and the CDC does not share individual HIV information with insurance companies.6HIV.gov. Limits on Confidentiality Many states go further, requiring specific written consent before HIV status can be disclosed to insurers. Protections vary widely by state.
Genetic Information
The Genetic Information Nondiscrimination Act flatly prohibits health insurers from using genetic information for underwriting. Health plans cannot require genetic testing, cannot collect genetic information (including family medical history) for enrollment or underwriting, and cannot adjust premiums based on genetic data.7U.S. Department of Labor. FAQs Regarding the Genetic Information Nondiscrimination Act
GINA has a significant gap. It does not cover life, disability, or long-term care insurance. Those insurers may ask about genetic test results and use them in underwriting. A handful of states have extended protections to those lines, but federal law leaves them uncovered.8Genome.gov. Genetic Discrimination Anyone considering genetic testing should weigh this before results land in a medical record a non-health insurer can later access.
How Life and Disability Insurers Dig Deeper
Life, disability, and long-term care insurers evaluate your risk before issuing a policy, so their reach into your medical history goes further than a routine health insurance claim.
Attending Physician Statements
An insurer may ask your doctor to complete an attending physician statement summarizing your medical history, current conditions, medications, and recent test results. If that statement raises questions, the underwriter can request additional records from specialists or order follow-up testing.
The MIB Group
The MIB Group, formerly the Medical Information Bureau, runs a database that life and health insurers use to share underwriting information. When you apply for individual life, health, disability, or long-term care coverage, the insurer may check your MIB file for coded entries about medical conditions and hazardous activities reported by previous insurers. The information is reported with your authorization.9Consumer Financial Protection Bureau. MIB, Inc.
MIB is classified as a consumer reporting agency under the Fair Credit Reporting Act. You can request a free copy of your MIB file once a year, review the information and its sources, and dispute anything inaccurate or incomplete.10Consumer Financial Protection Bureau. Fair Credit Reporting File Disclosure If a life insurance application was denied for reasons you don’t understand, checking your MIB file is a reasonable first step.
Prescription Databases
Insurers can query commercial prescription databases that compile filling history from participating pharmacy benefit managers. These databases show medications prescribed, when prescriptions were filled, and which doctor prescribed them. An underwriter might flag a prescription for insulin or a cardiac medication as relevant to the risk assessment. Access requires your signed authorization.
Your Rights to Control the Flow
You aren’t locked out of this process. HIPAA gives you tools to see what’s in your records, correct errors, limit disclosure, and track where information went.11U.S. Department of Health and Human Services. Your Rights Under HIPAA
Get a Copy of Your Records
You can request a copy of your health records from any provider or health plan. They must respond within 30 calendar days. If records are stored offsite or the request is otherwise complex, they can extend the deadline once by up to 30 additional days, with written notice explaining the delay.12U.S. Department of Health and Human Services. Individuals Right Under HIPAA to Access Their Health Information Reviewing your file before an insurer does matters. Errors are more common than people expect, and correcting them after an insurer has acted on them is harder.
Request a Correction
If you find errors, you can ask the provider to amend the record. They aren’t required to agree, but they must respond in writing and explain any denial. Your request and the provider’s response become part of the file, so later readers can see you contested the information.
Restrict a Disclosure
You can ask your provider to limit how they share your information for treatment, payment, or healthcare operations. Providers generally don’t have to agree, with one important exception. If you pay for a service entirely out of pocket and ask the provider not to share information about that visit with your health insurer, the provider must comply. This is one of the few places where you have an absolute veto over disclosure, and it’s worth knowing about for any visit you’d prefer to keep off your insurer’s records.
Revoke an Authorization
You can revoke a prior authorization in writing at any time. The revocation takes effect when the covered entity receives it, but it doesn’t undo disclosures already made while the authorization was valid.13U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization A narrow exception applies if the authorization was a condition of obtaining coverage and the insurer has a legal right to contest a claim or the policy itself.
Request an Accounting of Disclosures
You can ask your provider or health plan for a log showing who received your protected health information and when. This right covers disclosures made for purposes other than routine treatment, payment, and healthcare operations.14U.S. Department of Health and Human Services. Right to an Accounting of Disclosures If you suspect your records moved somewhere they shouldn’t have, this is the way to trace them.