Under federal law, a patient must provide written authorization for a life insurance company to receive their protected health information (PHI) unless the insurer is acting as the patient's health plan. The Health Insurance Portability and Accountability Act (HIPAA) requires a signed, specific consent form that lists the information to be disclosed and the purpose of the disclosure. If the insurer is a health plan covered by HIPAA, it may share PHI without separate permission, but most life insurers are not health plans and must obtain patient authorization.
More from this site
Keep reading the latest coverage
HIPAA's Consent Requirements
HIPAA's Privacy Rule mandates that a covered entity obtain a written authorization before disclosing PHI for non‑treatment, non‑payment, or non‑health care operations. The authorization must include: a description of the information to be released, the identity of the recipient, the purpose of the disclosure, and an expiration date or statement that the authorization is revocable. The patient retains the right to revoke the authorization at any time, and the insurer must cease further disclosure upon revocation.
Life Insurance as a Non‑Covered Entity
Unlike health plans, most life insurers are not covered under HIPAA. They can request PHI through an authorization form, but they cannot use PHI for underwriting without explicit consent. If an insurer fails to obtain proper authorization, it risks violating HIPAA and facing civil penalties of up to $50,000 per violation.
State‑Specific Exceptions and Regulations
Some states have enacted statutes that either relax or strengthen PHI disclosure requirements for life insurers. For example, in California, the Confidentiality of Medical Information Act (CMIA) requires additional safeguards and may limit the type of PHI that can be used for underwriting. Conversely, states like Texas allow insurers to access certain medical records under a "medical underwriting" clause, provided the patient signs a specific consent. Patients should review their state's privacy laws and consult a healthcare attorney if unsure.
Practical Steps for Patients
When applying for life insurance, patients should: 1) Request a copy of the insurer's PHI authorization form; 2) Verify that the form lists all data points the insurer will use, such as medical history, medication list, and diagnostic test results; 3) Confirm the expiration date and revocation procedure; 4) Keep a signed copy for their records. If a patient believes the insurer is requesting PHI beyond what is necessary for underwriting, they can negotiate a narrower authorization or seek an alternative insurer.
Practical Steps for Insurers
Insurers must: 1) Design authorization forms that comply with HIPAA's language requirements; 2) Train staff to obtain and store authorizations securely; 3) Implement a revocation system that promptly stops PHI sharing when a patient withdraws consent; 4) Conduct periodic audits to ensure compliance. Failure to follow these steps can result in costly settlements and reputational damage.
Key Takeaway
Patients must grant explicit permission for life insurers to receive PHI unless the insurer is a HIPAA‑covered health plan. Both parties should understand and adhere to federal and state privacy laws to avoid legal penalties and protect patient confidentiality.