HIPAA authorization for life insurance: what an APS request needs

A HIPAA authorization for life insurance is the applicant's signed permission that lets a covered health care provider, a doctor, hospital or laboratory, disclose medical records to the insurer for underwriting. The insurer usually needs it because HIPAA binds the provider, not the life insurer: a life carrier is not a covered entity for its life business, but the attending physician statement (APS) it orders comes from someone who is. So the form has to satisfy two sets of rules at once: the federal elements in 45 CFR 164.508 that make a provider willing to release, and the state insurance privacy law, usually modelled on NAIC Model #670, that governs the insurer's collection, how long the form lasts and what happens to the records afterwards. Botminds' APS Summarization starts where the authorization ends: it reads the hundreds of pages a valid request brings in, so the underwriter decides from cited pages rather than a skim.

The case on this page is fictional sample data in the solution. The rules are quoted from the eCFR, the NAIC's model laws and one state statute, linked where they appear; states adopt the models with differences, so a carrier's own state versions govern. This is not legal advice.

Does HIPAA apply to life insurance companies?

Not as a covered entity for life business, in the usual case; HIPAA reaches the life insurer through the provider it asks for records. The Privacy Rule applies to health plans, health care clearinghouses and providers who transmit health information electronically in covered transactions, and a health plan is one "that provides, or pays the cost of, medical care". A life policy pays a sum on death, not the cost of care. The definition also excludes excepted benefits, which include "Coverage only for accident, or disability income insurance", so a carrier's disability income line sits outside it too.

Two qualifications matter to a privacy officer. A company that also writes medical coverage is a health plan for that business. And a carrier that is outside HIPAA is not outside privacy law: state statutes built on the NAIC's models govern its collection and disclosure of health information, and the authorization the provider insists on is the same document the state law regulates.

What must a HIPAA authorization for life insurance contain?

It must contain HIPAA's six core elements and three required statements, in plain language, and the state's own elements for an insurance collection form. Under 45 CFR 164.508(c) the core elements are a specific and meaningful description of the information; who may disclose it; who may receive it; each purpose; an expiration date or event; and the signature and date, with a description of a personal representative's authority where one signs. The required statements cover the right to revoke in writing and its exceptions, whether signing can be made a condition of treatment or benefits, and that information disclosed "may be subject to redisclosure by the recipient and no longer be protected by this subpart."

The state collection rules ask for overlapping but different things. Model #670 lets an insurer use a disclosure authorization form only if it is plain, dated, names the insurer, identifies its representatives generically, states the nature of the information and the purposes, limits its own life, and tells the individual they may have a copy (NAIC Model #670 §6). Most carriers draft one form that satisfies both lists; the table shows where each element comes from.

Why APS requests come back unfilled: the defects that stop a release

A provider will refuse an authorization it can treat as defective, and the rule lists the defects. An authorization is not valid if "The expiration date has passed or the expiration event is known by the covered entity to have occurred", if it "has not been filled out completely" as to a required element, if it is known to have been revoked, if it breaks the rules on combining or conditioning authorizations, or if material information in it is known to be false. Each of those is something a case manager can check before the request leaves.

Two kinds of record need more than the standard form. An authorization for psychotherapy notes may be combined only with another authorization for psychotherapy notes, so a general APS form does not reach them. And records from a federally assisted substance use disorder program fall under 42 CFR Part 2, whose consent has its own required elements, including the patient's name, the recipients, each purpose, the right to revoke and an expiration (42 CFR 2.31). The notice that travels with a Part 2 disclosure says it outright: "A general authorization for the release of medical or other information is NOT sufficient to meet the required elements of written consent to further use or redisclose the record".

How long is a life insurance medical authorization valid?

As long as the form says, within the state's ceiling: HIPAA itself sets no maximum, only the requirement for an expiration date or event, while the NAIC model sets thirty months for a life application. Model #670 caps an authorization signed to collect information for an application, a reinstatement or a change in benefits at "Thirty (30) months from the date the authorization is signed if the application or request involves life, health or disability insurance", and Virginia's statute uses the same words for life, accident and sickness, or disability insurance (Va. Code §38.2-606). For a claim, the model ties the limit to the duration of the claim.

A second clock applies when the insurer, not the provider, discloses. Under the NAIC's privacy regulation, an authorization for a licensee to disclose nonpublic personal health information must state how long it is valid, "which in no event shall be for more than twenty-four (24) months", and the individual may revoke it at any time. Disclosures for underwriting, claims, fraud detection, reinsurance and a long list of other insurance functions are carved out and need no such authorization (Model #672 §18.B).

Revocation has a limit that matters at claim time. HIPAA lets an individual revoke in writing, except to the extent the provider has already acted, or "If the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself." Records read at application can therefore matter again inside the contestable period; how far back underwriters look in them is covered in medical record underwriting: how far back life insurers look.

Can a life insurer make the authorization a condition of applying?

Yes. HIPAA's ban on conditioning binds covered entities, which may not condition treatment, payment, enrollment or eligibility for benefits on an authorization, with narrow exceptions; a life insurer outside HIPAA is not bound by it. A fully underwritten application without the authorization cannot be checked against the records, and the insurer can decline to proceed on that basis.

The form still has to say so. One of the required statements is either that the covered entity may not condition treatment or benefits on signing, or "The consequences to the individual of a refusal to sign the authorization" where conditioning is allowed. The rule also lets a provider condition an exam that exists only to create information for a third party, such as a paramedical exam for a life application, on authorizing its release to that party (45 CFR 164.508(b)(4)(iii)).

What a valid authorization brings in, and why it is so large

A valid authorization usually brings in the whole chart, because HIPAA's minimum-necessary standard does not apply to disclosures made under an authorization (45 CFR 164.502(b)(2)(iii)). If the form covers a practice's records, the practice can send all of them: years of visit notes, labs from several laboratories, hospital discharge papers, often faxed and out of order. Reading a file of about 300 pages by hand takes an underwriter 2 to 4 hours, by our estimate.

The sample case shows the scale. A 52-year-old applies for $2,500,000 of 20-year term; the records arrive on a Friday evening, 312 pages from seven sources, 23 of them duplicate fax pages. The solution read the file in 6 minutes 12 seconds, filed each page with its source and date, and kept every duplicate linked to its original, because removing a page from an underwriting file is a decision nobody should make by default. Across the sample queue, nine files with records in held 1,680 pages that had arrived since Friday.

Records in: what the authorizations brought, file by file

After the records arrive: state insurance privacy law takes over

Once the records leave the provider, HIPAA's protection ends for the insurer's copy, and the form says so in its redisclosure statement. What follows is state insurance privacy law. Under Model #670 an insurer may not disclose personal or privileged information collected in an insurance transaction except on the listed grounds, starting with the individual's written authorization (§13). It must, within 30 business days of a written request, tell an individual the nature and substance of what it recorded and let them see or copy it, with medical-record information supplied either to the individual or to a medical professional they designate (§8). And after an adverse underwriting decision it must give the specific reasons or say how to ask for them, and answer a request made within 90 business days within 21 business days (§10).

The NAIC's later privacy regulation adds the authorization rule for disclosures of health information and its exceptions for insurance functions, and one provision that makes HIPAA relevant again: a licensee that complies with all the requirements of the HIPAA privacy rule "shall not be subject to the provisions of this Article V" (Model #672 §21). A carrier choosing which standard to build its controls to can use that.

Vendors, security and the APS file

Most carriers do not hold every page themselves: retrieval firms order and collect records, and some send them on to outside summarizers. The NAIC's data security model treats that chain as the carrier's responsibility. A licensee must exercise due diligence in selecting a third-party service provider and require it to protect the information systems and nonpublic information it can reach (Model #668 §4.F). Nonpublic information expressly includes data "created by or derived from a health care provider" that relates to a consumer's physical, mental or behavioral health.

The same model sets the notice clock: the commissioner must be told as promptly as possible and in no event later than 72 hours after the licensee determines that a qualifying cybersecurity event has occurred. An APS file in transit between a retrieval firm, a summarizer and the carrier is three places such an event can happen. The cost and control trade-offs of reading APS files in-house, through a service or with agents are compared in APS retrieval and summary services.

What one authorization brought in: 312 pages, indexed and cited

Where APS Summarization starts, and what it leaves to people

The solution begins when the records land. It splits the file into its source documents, dates and orders every page, marks duplicates without deleting them, indexes each impairment mention, charts lab values over time without filling gaps, compares the Part II answers with the records, the prescription history and the MIB report, and writes a two-page summary in which each sentence cites its page; a citation not found on its page blocks signing. Differences from the application are written as what was answered and what the records show, never as misrepresentation, and no one is contacted until the underwriter sends a request.

It does not draft, validate or store the authorization, order records, or decide anything: the case manager orders, the underwriter rates within authority, and cases over $2,000,000 with two or more impairments go to the medical director. Each agent step and human decision is in the case activity, and each month an auditor re-checks a sample of 40 decided cases citation by citation. On the sample case the decision, Standard subject to a signed amendment, was signed the first working day after the records arrived. The full case is on the APS Summarization page.

When records and answers differ, the request names the facts, not a motive

Questions people ask

What are the core elements of a HIPAA authorization?

Under 45 CFR 164.508(c): a specific description of the information, who may disclose it, who may receive it, each purpose, an expiration date or event, and the signature and date. It must also state the right to revoke, whether signing can be made a condition, and that disclosed information may be redisclosed and no longer protected.

Does a HIPAA authorization for life insurance expire?

It must carry an expiration date or event, and a provider treats it as defective once that has passed. State laws built on NAIC Model #670 cap an authorization for a life application at 30 months from signing.

Can an applicant revoke a HIPAA authorization after the policy is issued?

Yes, in writing, but revocation does not undo disclosures already made in reliance on it. Where the authorization was a condition of obtaining coverage, it also does not override other law giving the insurer the right to contest a claim or the policy.

Does HIPAA apply to life insurance agents?

Not as covered entities when they sell life insurance. Agents handling applicants' health information are subject to state insurance privacy law, which under Model #670 applies to insurance institutions, agents and insurance-support organizations alike.

Can a life insurer share APS records with a reinsurer?

Under NAIC Model #672 a disclosure of health information for reinsurance is one of the insurance functions that needs no separate authorization. Model #670 adds its own conditions on disclosure, and each state's version governs.

Does the Gramm-Leach-Bliley Act apply to life insurers?

Yes, through state law. NAIC Model #672 is the insurance regulators' model for Title V of the Act, covering privacy notices, opt-outs for financial information and authorization for health information.