Can ChatGPT review medical records for an underwriting decision?

ChatGPT can review medical records in the sense most people mean: paste in a clinic note or upload a lab report and it will explain the terms, list the diagnoses and write a summary. For a life underwriting decision that is not enough, for reasons that have little to do with how clever the model is. An attending physician statement often runs to hundreds of faxed pages from several offices; the underwriter needs every statement traced to the page it came from, lab values charted across sources, the application checked against the records, and a record of who decided what. The records themselves are protected by state insurance privacy law, which limits who an insurer may hand them to. Botminds' APS Summarization was built for that file and that law: agents read every page, cite every sentence and leave the decision to the underwriter. This guide is about where the line between the two falls.

Can ChatGPT summarize medical records? Yes, for short texts, with measurable errors

The published evidence says language models summarise clinical text well and imperfectly. The largest reader study, by Van Veen and colleagues in Nature Medicine, adapted eight models to "four distinct clinical summarization tasks: radiology reports, patient questions, progress notes and doctor–patient dialogue", and physicians judged the best models' summaries as good as or better than medical experts' in most cases. The same study's safety analysis found errors on both sides, linked them to potential medical harm and catalogued fabricated information.

Two things limit what that means for underwriting. The tasks were short: a radiology report or a progress note, not a stack of 312 pages. And the comparison was with a summary written by an expert, not with a decision someone must defend. A 2025 study in npj Digital Medicine by Asgari and colleagues, who work for Tortus AI, a company that builds clinical documentation software, counted the other failure, the one a reader cannot see. Across its experiments, of 49,590 sentences in the source transcripts, "1712 sentences were omitted (3.45%)". An omission leaves no trace in the summary. On an APS it is the missed hospital visit or the prescription with no diagnosis.

A chat assistant answers the question you ask. An underwriting file needs answers to the questions nobody thought to ask, with the page behind each one.

Can AI summarize hundreds of pages of records?

Yes, but not in one pass of a conversation, and not in a form anyone can check unless it was built to be checked. A real APS is a fax stream: pages rotated, duplicated, out of order, from a primary care office, a specialist, a hospital, a sleep center and outside laboratories. On the fictional sample case, five A1C readings sit on pages 41, 97, 163, 276 and 288 from four sources, and one of them is quoted again on page 175. A summary that says "A1C has ranged from 6.1% to 7.8%" is true and useless: the underwriter needs the order, the dates, the medicine changes and the pages.

That is the work the solution divides among six agents. A record sorter dates and orders every page and marks duplicates without deleting them. An impairment indexer records every mention with its page; on the sample case, 436 mentions of eight impairments. A lab extractor charts each value with its date, unit and laboratory. Only then does a summary writer write, and only from what was indexed. The chain is slower to build than a prompt and much faster to check.

Every mention of one impairment, one click away, each on its page

Three things a chat summary of the sample file would likely miss

The failures are not exotic; they come from what the file is and what the question leaves out. Take the fictional sample applicant's 312 pages and an ordinary prompt, "summarise this patient's medical history", and three gaps follow from the design rather than from the model.

First, the application. The records do not contain the applicant's Part II answers, so a summary of the records cannot say that question 11, an emergency room visit in the past five years, was answered "No" while the hospital pages show a visit on 14 June 2024 with observation to 16 June. Finding that takes the answers and the records side by side, which is a separate task the prompt never asked for. Second, repeats. The 7.1% A1C from an outside laboratory is quoted again in an endocrinology note on page 175, and 23 pages are duplicate faxes; a summary that does not know which pages repeat which will count some readings twice and lean the trend. Third, the negatives that matter. The cardiac work-up ended in a normal stress echo on page 214, which is why no cardiology records were needed. A summary that mentions "chest pain, emergency visit" without the echo invites a requirement nobody needed; one that mentions the echo without its page invites a re-read.

How accurate is ChatGPT with medical records, and how would you know?

You would know only by checking its output against the pages, and a chat answer gives you nothing to check against unless you build that yourself. Accuracy on a general benchmark is not accuracy on your files. A chat assistant asked to summarise a file can be right on every statement it makes and still be incomplete, and it can be confidently wrong about a value that sits on a smudged fax page.

The design answer is to make every statement checkable and to check it. In APS Summarization each of the 24 sentences in the sample summary carries a page, 38 citations in all, and each is verified on its page when the summary is written. In the fictional carrier's monthly audit, 1,637 of 1,644 citations were found on their pages; the seven that were not were slips of location, such as a value cited to the next page, and every one was findable because the page was named. A process for proving this on your own decided cases is in APS medical summarization: pilot it on 40 of your closed cases.

Is it HIPAA compliant to upload medical records to ChatGPT?

It depends on who is uploading, and for an insurer HIPAA is not the main question. HIPAA binds covered entities, which the rule defines as a health plan, a health care clearinghouse, and "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter", together with their business associates. A person uploading their own records is not a covered entity, so HIPAA does not stop them; it also stops protecting the copy they hand over. Every HIPAA authorization must warn of exactly that: information disclosed under it may be redisclosed by the recipient and no longer protected by the federal rule (45 CFR 164.508(c)(2)(iii)).

A life insurer is usually not a covered entity either, which is why HIPAA does not settle its question. What governs an insurer's handling of the APS is state insurance privacy law. Virginia's version of the NAIC model is a clear example. It allows a carrier to disclose medical-record information without a new authorization to someone working for it only where that is necessary "To enable that person to perform a business, professional or insurance function for the disclosing insurance institution, agent, or insurance-support organization and that person agrees not to disclose the information further without the individual's written authorization". A consumer chat service used on an individual account, under its standard terms, is a hard fit for that condition; an enterprise arrangement with a written no-redisclosure agreement is a different conversation, and the one a carrier's privacy office should have. What the authorization must contain, and what governs the records once they arrive, is in HIPAA authorization for life insurance.

What are the risks of using ChatGPT for underwriting?

Four, and only the first is about the model. The first is accuracy without accountability: a summary nobody can trace is a summary nobody can defend to an examiner or a court. The second is consistency. Life insurance law forbids unfair discrimination between people of the same class and equal expectation of life, a standard our sister guide on unfair discrimination in insurance sets out; two runs of a chat assistant over the same file can select and phrase differently, and if an underwriter rates from each, two identical applicants can be treated differently for no reason in the file.

The third is governance. New York's 2024 circular applies to any AI system used, wholly or partly, to supplement traditional life underwriting, which a chat assistant summarising an APS for an underwriter plainly does, and expects the insurer to oversee it, including when a vendor supplies it. The NAIC's model bulletin asks for a written program covering AI systems that make or support decisions, and for checks that vendor systems meet the standards the insurer itself must meet. A tool adopted by one underwriter on a personal account sits outside both. The fourth is data handling, covered above.

Is there a HIPAA-compliant AI for medical records in underwriting?

For an insurer the better question is whether the tool meets insurance privacy law and the insurer's AI governance expectations, and whether its output can be checked. HIPAA compliance is a property of how a covered entity and its business associates handle health information; for a life insurer reading an APS under an applicant's authorization, the rules that bite are the state's insurance privacy statute and the regulators' AI guidance. A tool that answers those, and cites every statement to its page, is fit for underwriting; a tool that claims HIPAA compliance but produces untraceable prose is not.

That is the design of APS Summarization. It reads the whole file the moment it lands, cites every sentence, charts every lab value with its source, writes application differences in neutral words, and never states a rating or class, orders a requirement or contacts the applicant or producer. How each regulator's expectation maps to those choices is set out in AI medical record review in life underwriting: what the rules require.

The impairment timeline: eight lanes, every mark a page

Can ChatGPT read my medical report if I am the applicant?

Yes, and it can help you understand terms in your own records; it cannot tell you what an insurer made of them. If you want to know that, the insurance privacy laws give you better tools than a chat assistant. In Virginia, for example, you can ask the insurer for the recorded personal information it holds about you, and medical-record information is supplied "either directly to the individual or to a medical professional designated by the individual". If you were declined or offered worse terms, the insurer must give you the reasons or tell you how to ask for them. The full sample case, including the neutral letter the underwriter sends when records and answers differ, is on the APS Summarization page.

Questions people ask

Can ChatGPT analyze medical records accurately?

On short clinical texts, research finds language model summaries often as good as experts', with errors on both sides. Omissions are the hidden risk: in a 2025 study by Asgari and colleagues, who work for a clinical documentation software company, 3.45% of source sentences were left out across its experiments. An underwriting file needs every statement checkable against its page to catch both.

Is it legal for an insurer to put an APS into a chat assistant?

It depends on the state's insurance privacy law and the arrangement. Virginia's statute, for example, allows disclosure of medical-record information to someone performing a function for the insurer only if they agree not to disclose it further. A consumer account under standard terms is a poor fit for that condition.

Does New York's AI circular cover a chat assistant used by an underwriter?

If it supplements underwriting, yes. Circular Letter No. 7 of 2024 covers AI systems used in whole or in part to supplement traditional life underwriting, and expects insurers to oversee them, including those supplied by vendors.

What does an underwriting tool need that ChatGPT lacks?

Page citations on every statement, lab values charted across sources, the application checked against the records, prescription history and MIB report, fixed settings, and a record of who decided. APS Summarization provides those and states no rating or class.

Can I use ChatGPT to understand my own medical records?

HIPAA does not prevent an individual from sharing their own records, but once uploaded the copy is governed by the service's terms, not HIPAA. To learn what a life insurer concluded from your records, state insurance privacy laws give you a right to ask the insurer directly.