The right to privacy is one of the bedrocks of the American value system -- right up there with the right to free speech and the right to watch lots of television. But when it comes to your medical records, there are questions about how far that privacy really extends. Who has access to your medical records? Do they stay in your doctor's office? Do they stay in your health insurance company's files? Do insurance companies share that information with one another?

There is no blanket answer to those questions. Like health care regulation itself, the confidentiality of your medical records depends a great deal on the people who handle them.

Patchwork of privacy
Health care regulation is a hodgepodge of federal and state laws. The kind of benefits you receive and the way they're funded determine where your medical records are kept and who gets to look at them.

Whether you get your insurance coverage through a group, such as your employer, or individually will also determine how much information an insurance company has about you. While employers are most likely to offer group health insurance, some also offer life insurance, disability insurance and, more recently, auto insurance or long-term care coverage. Insurance companies tend to ask more questions of people applying for individual coverage than of people who are part of a group. In other words, you're more likely to be grilled if you try to buy coverage on your own than if you get it through your employer or a trade association.

Insurance companies use "underwriting standards" to decide whether to cover certain people. Life insurance underwriting standards might deal with your age, height, weight and use of tobacco. Underwriting standards for members of a group will be less stringent than for someone who wants to buy coverage as an individual. That's because it's less likely that an insurance company will have to pay out a big claim on all the members of a group than for one individual policyholder.

The Medical Information Bureau
If you have ever applied as an individual for life, health or disability insurance, then chances are you're in a database at the Medical Information Bureau (MIB). Established in 1902, this Boston-based company provides about 600 life insurance companies -- many of which also offer health or disability coverage -- with medical information about individuals. In return, member companies report information to the MIB. It's a way for insurers to compare notes on applicants without having to contact one another directly. The MIB says it was established to combat fraud by providing a place where insurance companies can double-check the information provided by people applying for coverage.

For example, a man with high blood pressure may want to buy a life insurance policy, but he's aware that mentioning his medical condition means his application will be denied. By checking with the MIB, a life insurance company can make sure that the information provided on the application is accurate. If the MIB files show he has high blood pressure, then the life insurance company can dig deeper before issuing a policy.

Insurance companies pay a fee to become members of the MIB, and they also pay a fee every time they request information from the MIB's databases. Member companies agree to report to the MIB any medical conditions that might be of interest to other insurance company underwriters. What kinds of medical conditions? "Almost any medical condition you could think of," says Terry Philbrook, underwriting manager for UNUM Insurance Co., one of the largest disability insurers in the country. Common colds are out, but high blood pressure, back strain and abnormal lab results -- about 230 different conditions and test results -- could end up in the MIB database. Having a record in the MIB doesn't necessarily mean that you'll be denied coverage, but it could mean you'll pay higher rates.

You're supposed to be notified when you apply that the insurance company plans to check the MIB for any record of you, but that notification may be buried in fine print. If you want to know for sure, ask the agent when you fill out the application. And if you know you have a medical condition that might nix your application, think long and hard before applying for individual coverage. Once the database has a record showing you've been denied, it'll be harder for you to get any kind of individual life, health or disability coverage.

In certain circumstances, you could end up with an MIB record even if you have group coverage. Members of very small groups (less than 10 people, say), late enrollees and people who request more coverage than usual may all end up being treated as though they were applying for individual coverage. Hence, any information about medical conditions on your group application could be reported to the MIB.

Getting your hands on your MIB records
The MIB database may keep people honest when they're filling out their applications, but it is far from fail-safe. According to the MIB, it has records on only one or two out of every 10 people who apply for individual insurance. Nonetheless, its database does contain files on about 16 million individuals. How many of those records are inaccurate? The exact number is hard to determine, but the MIB estimates that about 3% of its records contain mistakes. "We had 650 people last year who sought corrections," says Jim Corbett, vice president of the MIB.

"One of the best ways to ensure the accuracy of our database is to encourage disclosure, and to correct it where information is wrong," says Corbett. About 150,000 people request their MIB records every year, a rather paltry number when you consider the total size of the database. While the MIB has made efforts to raise awareness about its existence among consumers, it's still a little-known entity.

The MIB is similar to consumer credit reporting services. For instance, it purges records that have been in the system for more than seven years. Under the Fair Credit Reporting Act, you have a right to see and correct the information the MIB has on you. Some states have also adopted laws specifically dealing with the confidentiality of medical records; the MIB and member companies doing business in those states would also be subject to those laws. "Most companies will comply with both laws," says Corbett. "It's easier to have one standard."

Member companies of the MIB also have to comply with the bureau's own privacy standards. "They pledge to use the information only [within that] member company and only for the purposes of underwriting an application or for looking at a claim," says Corbett.

Many eyes mean loose lips
According to industry sources, there is no other database of individual medical information as comprehensive as the MIB's. But that doesn't mean your patient information doesn't travel to other places.

One of the problems with keeping medical records confidential is the sheer number of people who handle such records. Every time you go the doctor, you leave a paper trail that then passes through numerous hands. Have health insurance? The insurance company has the right to review your records before it pays for your doctor's appointment. State and federal privacy laws may require a doctor to keep some records private, but an insurance company can also demand that it be able to review all necessary records, sometimes in direct contradiction to the law. In most states, the contracts that doctors sign with insurance companies aren't even reviewed by the insurance department. If the doctor doesn't like the terms of the contract, too bad; she can't join the network. And in this growing age of managed care, that can mean career suicide.

Does your employer administer your benefits in-house? That means someone in your own company may know the intimate details of your medical history. If your co-worker is less than discreet, that trip to the psychiatrist in 1992 could become common knowledge in the lunchroom.

Even if you dig deep into your own pockets for the cost of health care, eschewing insurance altogether, your medical records could still end up in the hands of a managed care company. That's because most doctors are part of a healthcare network. "The health plan wants to make a judgment about the doctors and their practice, billing and quality of care," explains John Conniff, Washington state's deputy insurance commissioner and health information privacy guru. "They want access to all records, not just enrollees."

The plans' motives may be legitimate; they want to see if doctors recommend more expensive treatments for enrollees than for uninsured patients, for instance. But that doesn't change the fact that a company like Aetna could have access to the medical files of someone who doesn't even have Aetna health insurance.

Hospitals also keep records on patients they've served. If you file a claim for an emergency room visit, chances are your insurance company will also send that information to the Medical Information Bureau. In one famous case, an Iowa woman sought treatment in an emergency room after an incident of domestic violence. Later, she was turned down for life insurance because of it. Regulators have since taken steps to protect domestic violence victims, but protection varies from state to state.

Pharmacies also store information about the kinds of medication that customers use. Considering the fatal consequences of certain drug combinations, tracking a patient's medication can be crucial. But in some states, it is perfectly legal for pharmacies to sell your information to drug companies, who can then use it for direct marketing.

The mysterious "third party"
In this age of outsourcing, insurance companies often contract with other companies to help with their data collection. Sometimes, you may not even know that you're dealing with another company.

About half of all life, health and disability insurance companies contract with a third party to collect your medical records. Companies such as Intellisys (a division of a subsidiary of ChoicePoint, which provides auto insurers with DMV records) routinely acquire medical records and physician statements for their insurance company clients. Intellisys differs from the MIB, though, in that it doesn't retain any of the data it acquires. However, once your insurance company gets your records, it may very well report medical conditions to the MIB.

Rochester, N.Y.-based Patient InfoSystems is another third-party contractor, but it provides a much different kind of service. Health insurance companies send Patient InfoSystems the names and phone numbers of enrollees who have specific health problems such as asthma or high blood pressure. Telephone interviewers then call enrollees and conduct scripted interviews about the condition. The research is voluntary, and according to one former employee, a fair number of people called were indignant at what they considered an invasion of their privacy. But others freely answered the questions, even after being informed that the information might be kept and used.

"Disease management" is one service that the company provides. Depending on its client's wishes, Patient InfoSystems can red-flag patients who might need a call from an HMO nurse (this is called "intervention" by the company). It performs statistical analysis and insurance companies can request patient-specific information, to do with as they please.

Patient InfoSystems also conducts surveys for the pharmaceutical industry, which can use the information to market products to individual patients. The company keeps a database of all the information it has compiled over the years, with the permission of its corporate clients. "Patient InfoSystems holds onto the data, but most clients retain the ownership of data," says Marnie LaVigne, vice president of clinical services. LaVigne says that they do not sell their data to marketers.

What exactly Patient InfoSystems will do with the results of all its surveys is unclear. "There's a sense that, for us, we created this somewhat new application to gather the information, and we have really just begun to scratch the surface of how to use it," says LaVigne.

Contacting the MIB
You might have trouble figuring out how to obtain your MIB record. Your physician may have never heard of the MIB. Your insurance agent should know about it, since she's supposed to tell you that the information on your application can end up there. But if you're part of a group plan, you may not have dealt with an insurance agent. The customer service agents at your health plan may not know where to direct you, either.

Luckily, the MIB's Web site has directions on how to request your file. If you want it with a minimum of delay, there's even a PDF document you can print, fill out and send in. Unless you've been denied insurance coverage because of your MIB record, you will also need to send an $8.50 payment with your request. Expect a response within 30 days.

Copyright © insure.com. All rights reserved.