The Basics
What your insurer knows about you
Thought that
little problem was just between you and your doctor? In the insurance world, more than a
few sets of eyes may have access to your medical information. Here's how to find out what
they're saying about you.
The right to privacy is one of the bedrocks of the American
value system -- right up there with the right to free speech and the right to watch lots
of television. But when it comes to your medical records, there are questions about how
far that privacy really extends. Who has access to your medical records? Do they stay in
your doctor's office? Do they stay in your health insurance company's files? Do insurance
companies share that information with one another?
There is no blanket
answer to those questions. Like health care regulation itself, the confidentiality of your
medical records depends a great deal on the people who handle them.
Patchwork of privacy
Health
care regulation is a hodgepodge of federal and state laws. The kind of benefits you
receive and the way they're funded determine where your medical records are kept and who
gets to look at them.
Whether you get your insurance coverage through a group, such as
your employer, or individually will also determine how much information an insurance
company has about you. While employers are most likely to offer group health insurance,
some also offer life insurance, disability insurance and, more recently, auto insurance or
long-term care coverage. Insurance companies tend to ask more questions of people applying
for individual coverage than of people who are part of a group. In other words, you're
more likely to be grilled if you try to buy coverage on your own than if you get it
through your employer or a trade association.
Insurance companies
use "underwriting standards" to decide whether to cover certain people. Life
insurance underwriting standards might deal with your age, height, weight and use of
tobacco. Underwriting standards for members of a group will be less stringent than for
someone who wants to buy coverage as an individual. That's because it's less likely that
an insurance company will have to pay out a big claim on all the members of a group than
for one individual policyholder.
The Medical
Information Bureau
If you
have ever applied as an individual for life, health or disability insurance, then chances
are you're in a database at the Medical Information Bureau (MIB). Established in 1902,
this Boston-based company provides about 600 life insurance companies -- many of which
also offer health or disability coverage -- with medical information about individuals. In
return, member companies report information to the MIB. It's a way for insurers to compare
notes on applicants without having to contact one another directly. The MIB says it was
established to combat fraud by providing a place where insurance companies can double -
check the information provided by people applying for coverage.
For example, a man
with high blood pressure may want to buy a life insurance policy, but he's aware that
mentioning his medical condition means his application will be denied. By checking with
the MIB, a life insurance company can make sure that the information provided on the
application is accurate. If the MIB files show he has high blood pressure, then the life
insurance company can dig deeper before issuing a policy.
Insurance companies
pay a fee to become members of the MIB, and they also pay a fee every time they request
information from the MIB's databases. Member companies agree to report to the MIB any
medical conditions that might be of interest to other insurance company underwriters. What
kinds of medical conditions? "Almost any medical condition you could think of,"
says Terry Philbrook, underwriting manager for UNUM Insurance Co., one of the largest
disability insurers in the country. Common colds are out, but high blood pressure, back
strain and abnormal lab results -- about 230 different conditions and test results --
could end up in the MIB database. Having a record in the MIB doesn't necessarily mean that
you'll be denied coverage, but it could mean you'll pay higher rates.
You're supposed to be
notified when you apply that the insurance company plans to check the MIB for any record
of you, but that notification may be buried in fine print. If you want to know for sure,
ask the agent when you fill out the application.
In certain circumstances, you could end up with an MIB record
even if you have group coverage. Members of very small groups (less than 10 people, say),
late enrollees and people who request more coverage than usual may all end up being
treated as though they were applying for individual coverage. Hence, any information about
medical conditions on your group application could be reported to the MIB.
Getting your hands on
your MIB records
The MIB
database may keep people honest when they're filling out their applications, but it is far
from fail-safe. According to the MIB, it has records on only one or two out of every 10
people who apply for individual insurance. Nonetheless, its database does contain files on
about 16 million individuals. How many of those records are inaccurate? The exact number
is hard to determine, but the MIB estimates that about 3% of its records contain mistakes.
"We had 650 people last year who sought corrections," says Jim Corbett, vice
president of the MIB.
"One of the best ways to ensure the accuracy of our
database is to encourage disclosure, and to correct it where information is wrong,"
says Corbett. About 150,000 people request their MIB records every year, a rather paltry
number when you consider the total size of the database. While the MIB has made efforts to
raise awareness about its existence among consumers, it's still a little-known entity.
The MIB is similar to
consumer credit reporting services. For instance, it purges records that have been in the
system for more than seven years. Under the Fair Credit Reporting Act, you have a right to
see and correct the information the MIB has on you. Some states have also adopted laws
specifically dealing with the confidentiality of medical records; the MIB and member
companies doing business in those states would also be subject to those laws. "Most
companies will comply with both laws," says Corbett. "It's easier to have one
standard."
Member companies of the MIB also have to comply with the
bureau's own privacy standards. "They pledge to use the information only [within
that] member company and only for the purposes of underwriting an application or for
looking at a claim," says Corbett.
Many eyes mean loose
lips
According
to industry sources, there is no other database of individual medical information as
comprehensive as the MIB's. But that doesn't mean your patient information doesn't travel
to other places.
One of the problems with keeping medical records confidential is
the sheer number of people who handle such records. Every time you go the doctor, you
leave a paper trail that then passes through numerous hands. Have health insurance? The
insurance company has the right to review your records before it pays for your doctor's
appointment. State and federal privacy laws may require a doctor to keep some records
private, but an insurance company can also demand that it be able to review all necessary
records, sometimes in direct contradiction to the law. In most states, the contracts that
doctors sign with insurance companies aren't even reviewed by the insurance department. If
the doctor doesn't like the terms of the contract, too bad; she can't join the network.
And in this growing age of managed care, that can mean career suicide.
Does your employer
administer your benefits in-house? That means someone in your own company may know the
intimate details of your medical history. If your co-worker is less than discreet, that
trip to the psychiatrist in 1992 could become common knowledge in the lunchroom.
Even if you dig deep into your own pockets for the cost of
health care, eschewing insurance altogether, your medical records could still end up in
the hands of a managed care company. That's because most doctors are part of a healthcare
network. "The health plan wants to make a judgment about the doctors and their
practice, billing and quality of care," explains John Conniff, Washington's deputy
insurance commissioner and health information privacy guru. "They want access to all
records, not just enrollees."
The plans' motives
may be legitimate; they want to see if doctors recommend more expensive treatments for
enrollees than for uninsured patients, for instance. But that doesn't change the fact that
a company like Aetna could have access to the medical files of someone who doesn't even
have Aetna health insurance.
Hospitals also keep records on patients they've served. If you
file a claim for an emergency room visit, chances are your insurance company will also
send that information to the Medical Information Bureau. In one famous case, an Iowa woman
sought treatment in an emergency room after an incident of domestic violence. Later, she
was turned down for life insurance because of it. Regulators have since taken steps to
protect domestic violence victims, but protection varies from state to state.
Pharmacies also store
information about the kinds of medication that customers use. Considering the fatal
consequences of certain drug combinations, tracking a patient's medication can be crucial.
But in some states, it is perfectly legal for pharmacies to sell your information to drug
companies, who can then use it for direct marketing.
The
mysterious "third party"
In this
age of outsourcing, insurance companies often contract with other companies to help with
their data collection. Sometimes, you may not even know that you're dealing with another
company.
About half of all life, health and disability insurance
companies contract with a third party to collect your medical records. Companies such as
Intellisys (a division of a subsidiary of ChoicePoint, which provides auto insurers with
DMV records) routinely acquire medical records and physician statements for their
insurance company clients. Intellisys differs from the MIB, though, in that it doesn't
retain any of the data it acquires. However, once your insurance company gets your
records, it may very well report medical conditions to the MIB.
Rochester, N.Y.-based
Patient InfoSystems is another third-party contractor, but it provides a much different
kind of service. Health insurance companies send Patient InfoSystems the names and phone
numbers of enrollees who have specific health problems such as asthma or high blood
pressure. Telephone interviewers then call enrollees and conduct scripted interviews about
the condition. The research is voluntary, and according to one former employee, a fair
number of people called were indignant at what they considered an invasion of their
privacy. But others freely answered the questions, even after being informed that the
information might be kept and used.
"Disease management" is one service that the company
provides. Depending on its client's wishes, Patient InfoSystems can red-flag patients who
might need a call from an HMO nurse (this is called "intervention" by the
company). It performs statistical analysis and insurance companies can request
patient-specific information, to do with as they please.
Patient InfoSystems also conducts surveys for the pharmaceutical
industry, which can use the information to market products to individual patients. The
company keeps a database of all the information it has compiled over the years, with the
permission of its corporate clients. "Patient InfoSystems holds onto the data, but
most clients retain the ownership of data," says Marnie LaVigne, vice president of
clinical services. LaVigne says that they do not sell their data to marketers.
What exactly Patient
InfoSystems will do with the results of all its surveys is unclear. "There's a sense
that, for us, we created this somewhat new application to gather the information, and we
have really just begun to scratch the surface of how to use it," says LaVigne.
Contacting the MIB
You
might have trouble figuring out how to obtain your MIB record. Your physician may have
never heard of the MIB. Your insurance agent should know about it, since she's supposed to
tell you that the information on your application can end up there. But if you're part of
a group plan, you may not have dealt with an insurance agent. The customer service agents
at your health plan may not know where to direct you, either.
Luckily, the MIB's Web site has directions on how to request
your file. If you want it with a minimum of delay, there's even a PDF document you can
print, fill out and send in. Unless you've been denied insurance coverage because of your
MIB record, you will also need to send an $8.50 payment with your request. Expect a
response within 30 days. |
|
