Privacy and your life insurance data: who sees it and your rights

A life insurer collects a lot of sensitive information about you: medical records, prescription history, lab results, driving record, finances and sometimes tobacco or drug test results. Your doctor is bound by HIPAA, but the life insurer that receives your records generally is not; its handling is governed mainly by state insurance privacy laws, the federal Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. You can usually see the reports the insurer relied on, correct errors, and ask why you were turned down.

What gets collected, and from where

During how life insurance underwriting works an insurer may gather:

• your application answers and signed authorizations;
• a paramedical exam, blood and urine results (what a life insurance blood and urine test looks for);
• records from your doctors, through an attending physician statement you authorize;
• your file at the MIB (formerly Medical Information Bureau), which holds coded information from past applications to member insurers (The MIB report: what insurers know about your history);
• a prescription database check from a vendor such as Milliman IntelliScript or other prescription data aggregators (how insurers check your prescription history);
• motor vehicle records, and in some cases credit-based information.

Because you sign an authorization, the insurer may lawfully get this data. Read what you are signing: authorizations often allow disclosure to the MIB, reinsurers, and service vendors.

Which laws apply

Not HIPAA. The HIPAA Privacy Rule covers health plans, health care providers and clearinghouses. Life insurers are not health plans under the rule, so they are generally not covered entities. Your doctor can send records to a life insurer only with your authorization, but after that the records are protected by other laws. (A life insurer can be a business associate when it performs a function for a covered entity.)

Gramm-Leach-Bliley Act (GLBA) and state privacy regulations. Insurers are treated as financial institutions. They must give you a privacy notice describing what they collect and share, and limit disclosure of nonpublic personal information to non-affiliated third parties. The NAIC's Privacy of Consumer Financial and Health Information Regulation (Model 672, adopted 2000) is the model most states use to apply this to insurers, and it requires your authorization before an insurer discloses your health information in most situations.

State insurance information privacy acts. The NAIC's Insurance Information and Privacy Protection Model Act (Model 670, 1992) gives applicants rights to see recorded personal information, request corrections, and learn the specific reasons for an adverse underwriting decision. Not every state has adopted it; the NAIC's state page for the model lists those that have, and the rights vary. If your state has no such act, you still have rights under the Fair Credit Reporting Act when a consumer report was used.

Fair Credit Reporting Act (FCRA). MIB and prescription reports are consumer reports. According to MIB, you can get one free copy of your file each year, and a second free copy after an adverse decision involving an MIB record. You can dispute inaccurate information, and an insurer that takes adverse action based on a report must tell you so. MIB's consumer line is 866-692-6901.

State comprehensive privacy laws. Newer laws in states such as Colorado, Connecticut, Virginia and Utah exempt financial institutions or data covered by GLBA, according to law-firm analyses of the 2021–22 statutes, and insurers are generally treated as financial institutions. In many states this means these laws do little for life insurance data. Check your state's text; some laws exempt data rather than entities.

Genetic information. The federal Genetic Information Nondiscrimination Act does not cover life, long-term care or disability insurance, according to the National Human Genome Research Institute. Some states add protections, for example Florida (section 627.4301, effective July 1, 2020). See genetic testing and life insurance: what insurers can ask.

What the insurer must protect

Most states have adopted some form of the NAIC Insurance Data Security Model Law (#668, 2017), which requires licensed insurers to maintain an information security program, investigate cybersecurity events, and notify the state insurance commissioner and, under separate breach-notification laws, affected consumers. Details such as deadlines differ by state.

Steps: get your data and check it

1. Request your MIB file at mib.com or by phone, even if you were approved. Look for wrong conditions, wrong dates and conditions you never had.
2. Request your prescription history report from the vendor named in your adverse-action letter. If you are not sure, ask the insurer which reports it used.
3. Ask the insurer in writing what recorded personal information it holds, and for the specific reasons for any decline or rating. State acts based on Model 670 give a right to this; others may not.
4. Dispute errors with the reporting company and the insurer, with doctor's letters or pharmacy records as support. A corrected record can support a rate reconsideration.
5. Check the authorization you signed for disclosure to the MIB and others, and ask about opt-outs in the insurer's privacy notice.
6. Complain if stuck. Your state insurance department handles privacy and underwriting-practice complaints (how to file a complaint against a life insurer).

If there is a breach

You may receive a notice that your information was exposed, often through a vendor. Placing a free credit freeze with the credit bureaus is a common precaution. Ask the insurer what was exposed (health data is more consequential than a mailing address), watch for fraudulent use of your policy information, and consult your state attorney general's guidance. A breach does not by itself change your policy or coverage.

Where privacy law is heading

The NAIC's Privacy Protections Working Group has been drafting revisions to the privacy models. NAIC materials for 2026 describe a charge to draft a new or revised privacy protections model to replace or update Models 670 and 672. A model is not law until a state enacts it, so existing state rules apply until then. For AI-driven decisions, see AI regulation in insurance: Colorado, the NAIC bulletin and New York.

Key takeaways

• Life insurers are generally outside HIPAA; the main rules are GLBA, state insurance privacy laws and the FCRA.
• You can get one free MIB file a year and usually see and correct the reports an insurer used; request reasons in writing after an adverse decision.
• GINA does not cover life insurance, so check your state's genetic-information rules.
• Many state comprehensive privacy laws exempt insurers or GLBA data, so insurance regulators are your main recourse.