Thought that little problem was just between you and your
doctor? In the insurance world, more than a few sets of
eyes may have access to your medical information. Here's
how to find out what they're saying about you.
The right to privacy is one of the bedrocks of the American
value system -- right up there with the right to free
speech and the right to watch lots of television. But
when it comes to your medical records, there are questions
about how far that privacy really extends. Who has access
to your medical records? Do they stay in your doctor's
office? Do they stay in your health insurance company's
files? Do insurance companies share that information with
There is no blanket answer to those questions. Like
health care regulation itself, the confidentiality of
your medical records depends a great deal on the people
who handle them.
Patchwork of privacy
Health care regulation is a hodgepodge of federal and
state laws. The kind of benefits you receive and the way
they're funded determine where your medical records are
kept and who gets to look at them.
Whether you get your insurance coverage through a group,
such as your employer, or individually will also determine
how much information an insurance company has about you.
While employers are most likely to offer group health
insurance, some also offer life insurance, disability
insurance and, more recently, auto insurance or long-term
care coverage. Insurance companies tend to ask more questions
of people applying for individual coverage than of people
who are part of a group. In other words, you're more likely
to be grilled if you try to buy coverage on your own than
if you get it through your employer or a trade association.
Insurance companies use "underwriting standards"
to decide whether to cover certain people. Life insurance
underwriting standards might deal with your age, height,
weight and use of tobacco. Underwriting standards for
members of a group will be less stringent than for someone
who wants to buy coverage as an individual. That's because
it's less likely that an insurance company will have to
pay out a big claim on all the members of a group than
for one individual policyholder.
The Medical Information
If you have ever applied as an individual for life, health
or disability insurance, then chances are you're in a
database at the Medical Information Bureau (MIB). Established
in 1902, this Boston-based company provides about 600
life insurance companies -- many of which also offer health
or disability coverage -- with medical information about
individuals. In return, member companies report information
to the MIB. It's a way for insurers to compare notes on
applicants without having to contact one another directly.
The MIB says it was established to combat fraud by providing
a place where insurance companies can double-check the
information provided by people applying for coverage.
For example, a man with high blood pressure may want
to buy a life insurance policy, but he's aware that mentioning
his medical condition means his application will be denied.
By checking with the MIB, a life insurance company can
make sure that the information provided on the application
is accurate. If the MIB files show he has high blood pressure,
then the life insurance company can dig deeper before
issuing a policy.
Insurance companies pay a fee to become members of the
MIB, and they also pay a fee every time they request information
from the MIB's databases. Member companies agree to report
to the MIB any medical conditions that might be of interest
to other insurance company underwriters. What kinds of
medical conditions? "Almost any medical condition
you could think of," says Terry Philbrook, underwriting
manager for UNUM Insurance Co., one of the largest disability
insurers in the country. Common colds are out, but high
blood pressure, back strain and abnormal lab results --
about 230 different conditions and test results -- could
end up in the MIB database. Having a record in the MIB
doesn't necessarily mean that you'll be denied coverage,
but it could mean you'll pay higher rates.
You're supposed to be notified when you apply that the
insurance company plans to check the MIB for any record
of you, but that notification may be buried in fine print.
If you want to know for sure, ask the agent when you fill
out the application. And if you know you have a medical
condition that might nix your application, think long
and hard before applying for individual coverage. Once
the database has a record showing you've been denied,
it'll be harder for you to get any kind of individual
life, health or disability coverage.
In certain circumstances, you could end up with an MIB
record even if you have group coverage. Members of very
small groups (less than 10 people, say), late
enrollees and people who request more coverage than usual
may all end up being treated as though they were applying
for individual coverage. Hence, any information about
medical conditions on your group application could be
reported to the MIB.
Getting your hands on
your MIB records
The MIB database may keep people honest when they're filling
out their applications, but it is far from fail-safe.
According to the MIB, it has records on only one or two
out of every 10 people who apply for individual insurance.
Nonetheless, its database does contain files on about
16 million individuals. How many of those records are
inaccurate? The exact number is hard to determine, but
the MIB estimates that about 3% of its records contain
mistakes. "We had 650 people last year who sought
corrections," says Jim Corbett, vice president of
"One of the best ways to ensure the accuracy of
our database is to encourage disclosure, and to correct
it where information is wrong," says Corbett. About
150,000 people request their MIB records every year, a
rather paltry number when you consider the total size
of the database. While the MIB has made efforts to raise
awareness about its existence among consumers, it's still
a little-known entity.
The MIB is similar to consumer credit reporting services.
For instance, it purges records that have been in the
system for more than seven years. Under the Fair Credit
Reporting Act, you have a right to see and correct the
information the MIB has on you. Some states have also
adopted laws specifically dealing with the confidentiality
of medical records; the MIB and member companies doing
business in those states would also be subject to those
laws. "Most companies will comply with both laws,"
says Corbett. "It's easier to have one standard."
Member companies of the MIB also have to comply with
the bureau's own privacy standards. "They pledge
to use the information only [within that] member company
and only for the purposes of underwriting an application
or for looking at a claim," says Corbett.
Many eyes mean loose lips
According to industry sources, there is no other database
of individual medical information as comprehensive as
the MIB's. But that doesn't mean your patient information
doesn't travel to other places.
One of the problems with keeping medical records confidential
is the sheer number of people who handle such records.
Every time you go the doctor, you leave a paper trail
that then passes through numerous hands. Have health insurance?
The insurance company has the right to review your records
before it pays for your doctor's appointment. State and
federal privacy laws may require a doctor to keep some
records private, but an insurance company can also demand
that it be able to review all necessary records, sometimes
in direct contradiction to the law. In most states, the
contracts that doctors sign with insurance companies aren't
even reviewed by the insurance department. If the doctor
doesn't like the terms of the contract, too bad; she can't
join the network. And in this growing age of managed care,
that can mean career suicide.
Does your employer administer your benefits in-house?
That means someone in your own company may know the intimate
details of your medical history. If your co-worker is
less than discreet, that trip to the psychiatrist in 1992
could become common knowledge in the lunchroom.
Even if you dig deep into your own pockets for the cost
of health care, eschewing insurance altogether, your medical
records could still end up in the hands of a managed care
company. That's because most doctors are part of a healthcare
network. "The health plan wants to make a judgment
about the doctors and their practice, billing and quality
of care," explains John Conniff, Washington state's
deputy insurance commissioner and health information privacy
guru. "They want access to all records, not just
The plans' motives may be legitimate; they want to see
if doctors recommend more expensive treatments for enrollees
than for uninsured patients, for instance. But that doesn't
change the fact that a company like Aetna could have access
to the medical files of someone who doesn't even have
Aetna health insurance.
Hospitals also keep records on patients they've served.
If you file a claim for an emergency room visit, chances
are your insurance company will also send that information
to the Medical Information Bureau. In one famous case,
an Iowa woman sought treatment in an emergency room after
an incident of domestic violence. Later, she was turned
down for life insurance because of it. Regulators have
since taken steps to protect domestic violence victims,
but protection varies from state to state.
Pharmacies also store information about the kinds of
medication that customers use. Considering the fatal consequences
of certain drug combinations, tracking a patient's medication
can be crucial. But in some states, it is perfectly legal
for pharmacies to sell your information to drug companies,
who can then use it for direct marketing.
The mysterious "third
In this age of outsourcing, insurance companies often
contract with other companies to help with their data
collection. Sometimes, you may not even know that you're
dealing with another company.
About half of all life, health and disability insurance
companies contract with a third party to collect your
medical records. Companies such as Intellisys (a division
of a subsidiary of ChoicePoint, which provides auto insurers
with DMV records) routinely acquire medical records
and physician statements for their insurance company clients.
Intellisys differs from the MIB, though, in that it doesn't
retain any of the data it acquires. However, once your
insurance company gets your records, it may very well
report medical conditions to the MIB.
Rochester, N.Y.-based Patient InfoSystems is another
third-party contractor, but it provides a much different
kind of service. Health insurance companies send Patient
InfoSystems the names and phone numbers of enrollees who
have specific health problems such as asthma or high blood
pressure. Telephone interviewers then call enrollees and
conduct scripted interviews about the condition. The research
is voluntary, and according to one former employee, a
fair number of people called were indignant at what they
considered an invasion of their privacy. But others freely
answered the questions, even after being informed that
the information might be kept and used.
"Disease management" is one service that the
company provides. Depending on its client's wishes, Patient
InfoSystems can red-flag patients who might need a call
from an HMO nurse (this is called "intervention"
by the company). It performs statistical analysis and
insurance companies can request patient-specific information,
to do with as they please.
Patient InfoSystems also conducts surveys for the pharmaceutical
industry, which can use the information to market products
to individual patients. The company keeps a database of
all the information it has compiled over the years, with
the permission of its corporate clients. "Patient
InfoSystems holds onto the data, but most clients retain
the ownership of data," says Marnie LaVigne, vice
president of clinical services. LaVigne says that they
do not sell their data to marketers.
What exactly Patient InfoSystems will do with the results
of all its surveys is unclear. "There's a sense that,
for us, we created this somewhat new application to gather
the information, and we have really just begun to scratch
the surface of how to use it," says LaVigne.
Contacting the MIB
You might have trouble figuring out how to obtain your
MIB record. Your physician may have never heard of the
MIB. Your insurance agent should know about it, since
she's supposed to tell you that the information on your
application can end up there. But if you're part of a
group plan, you may not have dealt with an insurance agent.
The customer service agents at your health plan may not
know where to direct you, either.
Luckily, the MIB's Web site has directions on how to
request your file. If you want it with a minimum of delay,
there's even a PDF document you can print, fill out and
send in. Unless you've been denied insurance coverage
because of your MIB record, you will also need to send
an $8.50 payment with your request. Expect a response
within 30 days.