Does HIPAA apply to insurance companies?
Which insurers are covered by HIPAA — health insurers and plans — and which aren't, such as life, disability, auto and workers' comp insurers, and how they get medical records.
Does HIPAA apply to insurance companies? at a glance
It depends on the kind of insurance. Health insurers, HMOs, Medicare, Medicaid and most employer group health plans are HIPAA covered entities. Life, disability income, auto, liability and workers' compensation insurers are not — they are outside HIPAA's definition of a health plan. Those insurers often obtain medical records through the applicant's or claimant's signed HIPAA authorization to their doctors, and state insurance privacy laws then govern how they use the information.
| Covered by HIPAA | Health insurers, HMOs, Medicare, Medicaid, most group health plans |
|---|---|
| Not covered | Life, disability income, auto, liability and workers' comp insurers |
| How non-health insurers get records | Your signed authorization to your providers |
| What protects you there | State insurance privacy laws and the authorization's terms |
HIPAA covers health plans: individual and group plans that provide or pay the cost of medical care, including health insurers, HMOs, Medicare, Medicaid and most employer group health plans (45 CFR 160.103). These are covered entities.
The definition excludes coverage that provides excepted benefits — accident or disability income insurance, liability and auto insurance, workers’ compensation, automobile medical payment and credit-only insurance, among others (42 U.S.C. 300gg-91(c)(1)). Life insurance isn’t health coverage at all. So life, disability, auto and workers’ comp insurers are not covered by HIPAA.
They still often see medical information. During underwriting or a claim, they ask you to sign an authorization letting your providers send records. HIPAA governs that release by your provider; once the insurer has the records, state insurance privacy laws and the authorization’s terms apply. For employer plans, see employer group health plans; for workers’ comp, see Does HIPAA apply to workers’ compensation?.
Next steps
- HIPAA for employer group health plans →Scenario
- Covered entity →Requirement
- HIPAA authorization →Requirement
Frequently asked questions
Does HIPAA apply to life insurance companies?
No. Life insurers aren't health plans under HIPAA. They usually get your medical information through an authorization you sign during underwriting or a claim.
Is my health insurance company covered by HIPAA?
Yes. Health insurers and HMOs are health plans, one of the three kinds of HIPAA covered entities, so the Privacy, Security and Breach Notification Rules apply.
Can a life insurer get my records from my doctor?
Only with your signed HIPAA authorization or another HIPAA permission. Read what the authorization covers and how long it lasts before you sign.