Myths about who can see your health data when you apply

When you apply for life insurance, you sign a form that lets the insurer look into your health history. People react to that form in two opposite ways. Some assume the insurer sees everything and shares it with anyone. Others assume that medical privacy law protects the information exactly as it does at the doctor's office. Both are partly wrong, and the errors cost people: applicants skip questions out of fear, or share more than they needed to, or miss a chance to fix a wrong record.

This post takes eight common claims one at a time. For each, it states the claim, tests it against how the application process and the law work, and gives the nuance. Privacy rules differ by state and change, so the points below are general, and your state insurance department is the place to confirm specifics.

Myth 1: "The insurer can see my whole medical history"

What is true. An insurer can ask for a lot, but it does not automatically see everything. It gets what you authorize and what it can buy from the data companies it works with. In a fully underwritten application the sources typically include:

• your answers on the life insurance application;
• an exam and lab results, if one is ordered;
• records from your doctors, requested with your signed authorization, sometimes through an attending physician statement;
• the MIB file, which holds coded entries from past applications;
• a prescription database check;
• a motor vehicle record.

What is not true. There is no single database of everything about you. The prescription report generally does not include a diagnosis; the insurer infers it from the drug. It leaves out drugs paid for in cash outside the data network, samples and many over-the-counter purchases, as how insurers check your prescription history explains. The MIB file holds codes, not charts, and it does not record how you were rated or whether you were accepted.

The nuance. The access that does exist is broad. If an underwriter wants more detail, they can ask for full records from the doctors named in your authorization, and the authorization typically covers a wide range of health information. A more useful way to see it: the insurer sees what it asks for, within the limits you sign, and an underwriter asks for more when the first sources raise a question. Simplified-issue and guaranteed-issue products use fewer sources, which is part of why they cost more or cap the amount (simplified issue life insurance).

Myth 2: "Insurers have to follow the medical privacy law the way my doctor does"

What is true. The federal health privacy rule, HIPAA, applies to health plans, health care providers and clearinghouses. A life insurer is not a health plan under that rule, so it is generally not a covered entity. That is why your doctor needs your signed authorization to send records to a life insurer in the first place.

What is not true. It does not follow that nothing protects the data once the insurer has it. Other laws apply. Insurers are treated as financial institutions under the Gramm-Leach-Bliley Act, which requires a privacy notice and limits disclosure of nonpublic personal information to outside parties. The NAIC's privacy model regulation, which many states use to apply those principles to insurers, generally requires your authorization before an insurer discloses health information in most situations. Many states also have an insurance information and privacy act based on the NAIC's Model 670, which gives applicants rights to see recorded personal information, request corrections and learn the reasons for an adverse decision. Consumer reports like the MIB file and prescription history are covered by the Fair Credit Reporting Act.

The nuance. The protections are real, but they are a different set from HIPAA's, and they vary by state. One example of the difference: in many states a comprehensive consumer privacy law passed in recent years exempts financial institutions or data already covered by Gramm-Leach-Bliley, so those newer laws often do little for life insurance data. The practical point is that your state insurance regulator, not a general privacy agency, is usually the right place to complain. The whole map is laid out in privacy and your life insurance data: who sees it and your rights.

Myth 3: "My information is never shared with anyone"

What is true. Insurers are limited in what they can share, and the privacy notice that must be given to you describes the categories. Disclosure of health information generally needs your authorization, with exceptions that the law spells out, such as disclosures needed to process a claim or required by law.

What is not true. The authorization you sign often allows more than people expect. It can permit the insurer to send information to the MIB, to reinsurers who share the risk on a policy, and to service vendors who process the data. Reinsurance is how most insurers manage risk on larger policies. A reinsurer that backs your policy may see parts of your file.

The nuance. Read the authorization. It states who may disclose information, to whom, for what purpose and for how long it remains valid. The insurer's privacy notice lists what it collects and with whom it shares, and often describes whether you can opt out of certain sharing. Ask the agent for both before you sign. If you do not understand a sentence, ask what it permits and what would happen if you struck it out. Insurers generally will not issue a standard fully underwritten policy without the authorizations they need.

Myth 4: "If I refuse the database check, the insurer cannot hold it against me"

What is true. You are free to say no to a check. Nothing forces you to apply.

What is not true. The check is part of how a fully underwritten policy is priced. An insurer that cannot compare your answers with the MIB file and the prescription history cannot price the risk in the usual way, and the most likely outcome of refusing is that the insurer will not issue that kind of policy, not that it ignores the gap. how insurers check your prescription history makes the point directly: you cannot opt out of the check and still get a standard fully underwritten policy.

The nuance. There are routes that use fewer checks. Simplified-issue policies ask a short list of health questions and may still run a prescription check. Guaranteed-issue policies ask no health questions and use no medical underwriting, but they are limited in amount, cost more per $1,000 and usually pay a reduced benefit for natural death in the first two years (graded death benefits: why the first two years matter). Group coverage through an employer usually needs no individual health review at all. Choosing among these is a trade between privacy and price. It is a legitimate trade, and the right answer depends on how much coverage you need.

Myth 5: "A genetic test is private, and the law bans insurers from using it"

What is true. The federal Genetic Information Nondiscrimination Act (GINA) bars discrimination based on genetic information in health insurance and employment.

What is not true. GINA does not cover life insurance, long-term care insurance or disability insurance, according to the National Human Genome Research Institute. A life insurer may ask about genetic test results that you already have in the course of an application in many states, and some states have added limits of their own, such as Florida's statute on the use of genetic information in life and certain other insurance, which took effect on July 1, 2020.

The nuance. The rules differ by state and are changing, and "ask about" is not the same as "require a test". Insurers generally do not require applicants to take a genetic test to buy life insurance, but a result already in your records may be fair game depending on where you live. Before taking a consumer genetic test that you might later have to report, read genetic testing and life insurance: what insurers can ask and check your state's rules.

Myth 6: "The MIB keeps a blacklist of people who were turned down"

What is true. The MIB is a database that member insurers use to cross-check applications. A past application can leave a coded entry.

What is not true. According to MIB's FAQ, the file does not record how an individual was rated or whether an application was accepted or declined. MIB says its member companies cannot make an adverse decision based solely on MIB data without further investigation. It retains information for seven years from the application date. A decline at one insurer is not stamped on your file for others to see.

The nuance. The entries that do exist are consequential, because they are coded observations such as a test result or a condition reported at the time. A later insurer that sees a code you did not mention will ask why, and an omission can look like misrepresentation (what happens if you lie on a life insurance application). Also, an entry can be wrong. You can request your file free once a year, and a second copy at no charge if an insurer tells you an MIB record influenced a decision. The best use of this knowledge is to look at your own file before you apply. The MIB report: what insurers know about your history explains how.

Myth 7: "Mental health care and therapy notes will automatically be seen by the insurer"

What is true. Questions about counseling, depression, anxiety and related medication are on many applications, and a prescription history can show antidepressants or anti-anxiety drugs. These facts do affect underwriting in some cases.

What is not true. It is not accurate that an insurer automatically receives your therapist's notes. Under the federal health privacy rule, psychotherapy notes that a counselor keeps separate from the rest of the record generally get stricter treatment, and a general authorization is typically not enough to release them. Whether and how an insurer obtains mental health records depends on what you sign, what the provider will release, and state law. Most underwriting looks at diagnoses, treatment dates and medications, which come from standard records and prescriptions, rather than the content of counseling sessions.

The nuance. Fear of this topic leads some people to answer a question wrongly, which creates a bigger problem than the underlying fact. Many people with treated, stable depression or anxiety are insurable, and underwriters weigh severity, time since treatment and stability. See life insurance with depression or anxiety for how that works. If you are unsure what an authorization covers, ask the agent to explain it, ask your provider what it would release, and do not guess on the application.

Myth 8: "If my data leaks, my policy is in danger"

What is true. Insurers are hit by data breaches, often through vendors, and health information is sensitive.

What is not true. A breach does not by itself change your policy or your coverage. Most states have adopted some form of the NAIC Insurance Data Security Model Law, which requires licensed insurers to keep an information security program, investigate cybersecurity events and notify the state insurance commissioner. Consumer notification is handled under separate breach-notification laws, and the deadlines differ by state.

The nuance. The risk from a breach is to you personally: fraud or identity misuse. Typical steps are to read the notice, ask what was exposed (health data matters more than a mailing address), place a free credit freeze with the credit bureaus, and watch your policy for changes you did not make. privacy and your life insurance data: who sees it and your rights has the longer list.

A short authorization checklist

Whatever the myths, you can protect yourself with a few habits before you sign:

1. Ask for the authorization in writing and read it, not only the signature line.
2. Note who may receive the information. MIB, reinsurers and vendors are common.
3. Check how long it lasts. Authorizations usually state a period or an event after which they expire.
4. Ask for the insurer's privacy notice and read how it describes sharing.
5. Keep a copy of what you signed, with the date.
6. Request your own records afterward, particularly after an adverse decision; getting your insurance records and fixing errors, questions answered answers the practical questions about how.

Where the myths come from

The beliefs persist for understandable reasons. The authorization form is long and legal, so people assume the worst. Doctors' offices talk constantly about HIPAA, so people assume it follows the data. Stories about data brokers create the picture of a single master file. And when a decline arrives without explanation, it is natural to imagine hidden information at work.

The better picture is plainer. An insurer gathers a defined set of records with your permission, using a few specialized companies. The law surrounding that process is not HIPAA, but it is not empty. It gives you notice, access, the right to dispute errors in consumer reports and a regulator to complain to. The weak points are the ones the myths hide: authorizations that allow broad sharing, state-to-state differences, and the fact that most applicants never check the records that decided their price.

Key takeaways

• An insurer sees what you authorize and what its data vendors hold, not everything; the prescription report and MIB file are limited and contain no full charts or underwriting outcomes.
• HIPAA generally does not cover life insurers, but the Gramm-Leach-Bliley Act, state insurance privacy rules and the Fair Credit Reporting Act do apply, and they vary by state.
• Authorizations often permit sharing with the MIB, reinsurers and vendors, so read them and keep a copy.
• Refusing the standard checks usually means not getting a standard fully underwritten policy; fewer-check products exist but cost more or cap the amount.
• GINA does not cover life insurance; check your state's genetic-information rules before taking a test.
• Request your MIB and prescription reports before applying; accuracy of those records matters more than the myths.