Required Disclosures and Privacy Duties

Medical Privacy and Health Disclosures

When individuals apply for life insurance, insurers gather personal background details to evaluate underwriting risk. State law sets when an insurer must provide a notice of its information collection practices; depending on how the information is collected, notice may be due when collection begins or as late as policy delivery. Because life underwriting often requires an evaluation of health history, federal and state statutes strictly regulate how medical records are obtained, stored, and shared.

The Health Insurance Portability and Accountability Act protects individually identifiable protected health information. Protected health information under HIPAA includes medical history, physical condition, and claims records. Before a medical provider covered by HIPAA releases an applicant's medical records to an insurer for underwriting, the provider generally must obtain the applicant's valid HIPAA authorization. A signed HIPAA authorization grants permission for medical providers to release health records to the insurer for underwriting purposes.

A valid HIPAA authorization must satisfy specific legal elements. It must describe the information to be disclosed, identify who may disclose and receive it, and state the purpose of the disclosure. In addition, the document must include an expiration date or an expiration event. An applicant generally may revoke a HIPAA authorization in writing, except to the extent a covered entity has acted in reliance on it or, for an authorization obtained as a condition of insurance coverage, other law preserves the insurer's right to contest a claim or the policy.

Insurers may also request an HIV test for underwriting purposes, subject to applicable state requirements. State law governs whether an insurer must obtain separate, specific informed consent before an applicant's HIV test is conducted. When state law requires an HIV-specific consent form, state law determines what the form must explain about the test and confidentiality. Furthermore, state law sets the specific notification and reporting requirements for positive HIV test results, including who receives a positive result and when public health reporting is required. Insurers must follow applicable state rules against unfair discrimination when requiring HIV tests; sexual orientation or marital status alone does not establish an applicant's HIV risk.