Sources of insurability and HIPAA privacy disclosures

Where an underwriter gets the facts

Underwriting is only as good as the information behind it. For life and health insurance, the insurer builds a picture of the applicant's insurability from several sources, and the producer is the first link in that chain -- which is why this work is called field underwriting.

The main sources of insurability information

1. The application. The primary source. It carries the applicant's statements about age,

health history, occupation, habits and hobbies, and other coverage. It becomes part of the contract, so its accuracy matters for the life of the policy.

1. The producer's report (agent's statement). The producer's own first-hand observations:

how long they have known the applicant, the applicant's apparent health, finances and purpose for the coverage, and anything that looks inconsistent with the application.

1. Medical examinations and tests. Depending on the amount of coverage and the applicant's

age, the insurer may order a paramedical exam, a full physician exam, or blood and urine tests.

1. Attending physician statement (APS). A report from a doctor who has actually treated the

applicant, describing diagnoses, treatment and prognosis.

1. MIB (Medical Information Bureau). A membership organization through which insurers share

coded information about medical conditions and other risk factors found on earlier applications. It helps catch omissions and misstatements. The applicant must be told the insurer may report to MIB, and an MIB report alone is not a basis for declining coverage; it is a lead the underwriter must follow up.

1. Inspection and consumer reports. Reports from outside agencies about the applicant's

character, finances, lifestyle and reputation. These are governed by the federal Fair Credit Reporting Act: the applicant must be notified that a report may be requested, and if coverage is declined or rated because of it, the insurer must tell the applicant and identify the reporting agency.

1. Other records. Motor vehicle records and prescription-history databases are also

commonly checked.

Why HIPAA controls the health information

Much of this information is protected health information -- health data that identifies a person. The HIPAA Privacy Rule limits how covered entities (health plans, health care providers and health care clearinghouses) may use and disclose it.

• A doctor or hospital may not simply hand an applicant's records to an insurer. The applicant

must sign a written authorization that says what may be released, to whom, for what purpose, and when the permission expires. That is why every life and health application includes an authorization form.

• Health plans give members a Notice of Privacy Practices explaining how their information

is used and what rights they have.

• Only the information needed for the purpose should be requested or shared.
• Producers who handle this information must protect it: no casual sharing, secure storage and

secure disposal.

The federal crime of wrongful disclosure

HIPAA is not only a civil rule. Under 42 U.S.C. § 1320d-6, a person who knowingly, and in violation of the law, obtains individually identifiable health information, discloses it to another person, or uses a unique health identifier commits a federal offense. An employee who obtains or discloses information held by a covered entity without authorization is covered too. The penalties rise with intent:

• Basic offense: fine up to $50,000, up to 1 year in prison, or both.
• Under false pretenses: fine up to $100,000, up to 5 years, or both.
• **With intent to sell, transfer or use the information for commercial advantage, personal gain

or malicious harm: fine up to $250,000, up to 10 years**, or both.

The exam pattern: the more deliberate and profit-driven the misuse, the higher the tier.