Sources of insurability and HIPAA privacy disclosures

Where an insurer learns about the applicant

Underwriting is only as good as the information behind it. A life insurer gathers that information from several sources of insurability, each of which answers a different question about the risk.

• The application. The applicant's own written answers about age, health history, occupation, habits and avocations. It is the foundation of the file, and it becomes part of the contract.
• The producer's report (agent's statement). The producer's first-hand observations: how long the producer has known the applicant, the applicant's apparent health and finances, the purpose of the coverage, and whether the policy will replace existing insurance. It is not part of the contract and is not shown to the applicant, but it is often the underwriter's first look at the risk.
• Medical information. A paramedical exam (height, weight, blood pressure, blood and urine specimens) or a full exam by a physician, used more as age and face amount rise. The underwriter can also request an Attending Physician's Statement (APS) from a doctor who has treated the applicant.
• MIB (Medical Information Bureau). A nonprofit, member-owned database. Member insurers report coded impairments found during underwriting, so another insurer can spot health conditions an applicant omits. MIB data is a red flag for further investigation, never a reason on its own to decline. Consumers may request their MIB file and dispute errors.
• Consumer reports and investigative consumer reports. Credit history, motor vehicle records and prescription-history checks are consumer reports. An investigative consumer report goes further, gathering information on character, general reputation and mode of living through interviews with neighbors, friends or associates.

The Fair Credit Reporting Act

Congress found that consumer reporting agencies hold "grave responsibilities," and the Fair Credit Reporting Act requires them to adopt reasonable procedures for supplying credit, personnel and insurance information fairly, with regard to its confidentiality, accuracy and relevancy. For an insurance applicant that means:

1. Permissible purpose. An insurer may obtain a consumer report to underwrite insurance the consumer applied for.
2. Notice of an investigative report. The applicant must be told in writing, no later than three days after the report is requested, that an investigative consumer report may be made, and may ask for the nature and scope of the investigation.
3. Adverse action notice. If the insurer declines, rates up or limits coverage based in whole or in part on a consumer report, it must tell the applicant, name the reporting agency, and explain the right to a free copy of the report and to dispute its accuracy.

HIPAA and the authorization

Most medical records come from doctors, hospitals, pharmacies and health plans. Health plans, and health care providers that conduct standard electronic transactions such as billing a health plan electronically, are covered entities under the HIPAA Privacy Rule. Except for permitted purposes such as treatment, payment and health care operations, a covered entity may not release protected health information to a life insurer for underwriting without the individual's written authorization. That is why a life insurance application typically includes a signed authorization: it names who may disclose, what may be disclosed, to whom, for what purpose, and when it expires, and it states that the applicant may revoke it in writing.

The application packet also includes a notice of information practices explaining what information the insurer collects, from whom, and to whom it may be disclosed. The producer should deliver these notices and obtain the signatures at the time of application.

HIPAA has criminal teeth. Knowingly obtaining or disclosing individually identifiable health information without authorization is punishable by up to $50,000 and one year in prison, up to $100,000 and five years under false pretenses, and up to $250,000 and ten years when done for commercial advantage, personal gain or malicious harm.