Personal Privacy in an Information Society. Life and Health Insurers


Life and health insurers and their agents have different reasons for collecting and using information about individuals than property and liability insurers. In the first place, people often have to be persuaded to buy life insurance, whereas there is a ready market for property and liability coverage. Moreover, because life insurance is often sold as part of a package of financial planning services offered by agents, a life insurance prospect may be asked to divulge much information about himself even before the application is completed. For example, when insurance is used in estate building or estate conservation, the agent collects detailed information about the prospect's net worth, income, career prospects, and personal goals. When business life insurance 8 is being considered, extensive information about the financial condition of the firm or its principals is required. As a result, some life insurance agents have more comprehensive knowledge about a client's financial affairs than perhaps anyone else.

Most importantly, life insurance is a contract which binds a company to pay claims or benefits unless the policyholder fails to pay premiums when due, or unless the company can prove fraud or material misrepresentation during a limited "contestable period," generally two years after which a claim must be paid even if the application turns out to have been fraudulent. Thus, before entering into such a contract, the insurer wants an accurate health history, often supplemented by a medical examination to determine current health status, financial status information to protect against overinsurance, and enough information about personal habits to judge whether they might shorten the applicant's life. If the applicant has a significant health impairment, he is subjected to an extensive underwriting investigation to determine whether insurance can be issued to him, and if so, at what rate.

With most individual health insurance, there is less pressure to gather information about the applicant than in life insurance. Unless an individual health policy is the type that is not cancelable, the company can protect itself by increasing the price or declining to renew coverage at expiration. (Some health policies are guaranteed renewable but with the understanding that the company may increase the price at the time of renewal.) Nonetheless, detailed medical-record information is gathered in order to decide whether to accept the risk in the first instance, and how much to charge. Medical-record information is also an obvious consideration in writing disability insurance. Because these coverages are more susceptible than life insurance to abuse by insureds, companies want information concerning an applicant's character and his propensity for a disabling accident or illness. Occupation is also an important consideration-the loss of a finger is more disabling for a surgeon than a businessman-and the amount of disability income protection provided needs to be related to earned income.

The applicant and agent are the primary sources of information in underwriting life and health insurance. Because each has a financial interest in seeing the sale completed, however, investigative-reporting agencies (inspection bureaus) and other outside sources are often used to check the accuracy and completeness of the information applicants and agents provide. The types of inquiries these investigations typically involve and the manner in which inspection bureaus conduct them are described in Chapter 8. Here it is enough to point out that they can involve contacts with neighbors, employers, associates, bankers, and creditors; reviews of medical records obtained from doctors or hospitals; and checks of public records for evidence of financial or legal difficulties.

Life and health insurers and investigative-reporting agencies acting on their behalf often contact third-party sources that have a confidential relationship with the applicant or insured, such as doctors, accountants, or lawyers, and thus an authorization is required before the information can be released. Typically, an applicant is required to sign such an authorization as a condition of having his application considered; is informed, as required by the Fair Credit Reporting Act (FCRA),9 that an investigative report may be obtained; and is notified that information may be reported to the Medical Information Bureau (see below).

Normally, life insurance and medical expense claims are paid when a death certificate or medical bills are submitted. Claims for disability-income benefits are verified with the claimant's physician and employer and may be investigated more thoroughly if the claim appears questionable. The insurer's need for medical-record information in processing claims and the issues it raises for public policy on the confidentiality of the medical-care relationship are discussed in Chapter 7.

The Medical Information Bureau (MIB)

Like credit grantors, life and health insurers have organizations whose record-keeping services allow them to learn something about an applicant's previous contacts with other companies in the industry. The Medical Information Bureau (MIB) is an unincorporated, nonprofit trade association set up to facilitate the exchange of medical-record information among life insurers. Nearly 700 U.S. and Canadian life insurers subscribe to it and use it as an important source of information in underwriting life and health policies and in processing life and health claims.10

Each member company agrees to send the MIB a code anytime it develops information on an individual concerning certain medical and other conditions of some underwriting significance, except that companies are no longer supposed to report information developed in processing a claim. These codes are maintained by the MIB for seven years. Typically, a member company, on receiving an application, asks the MIB to check its files for information on the individual. If a code is found, it is sent to the inquiring company, which may then seek further details from the company that originally reported it, provided, however, that the inquiring company has first conducted its own investigation (e.g., a medical examination) to verify the reported condition. These "requests for details," which must be channeled through the MIB, are limited to 15 percent of the number of reports each company has submitted within the past year.11 In 1975, there were 75,000 of them out of a possible 300,000.12

The MIB does not investigate on its own, nor does it attempt to verify any information reported to it.13 MIB Rule 9 specifies that member companies must report information regardless of the manner or form in which they acquire it.14 Because many life insurers are also health insurers, information discovered in the course of health as well as life underwriting may thus be reported to the Bureau.

About 95 percent of the coded information contained in the MIB files is considered to be "medical." Only five percent is classified as nonmedical information, such as "reckless driving," "aviation," or "hazardous sport."15 Currently, the MIB maintains information on 11 million individuals. Approximately three percent of all life applicants are uninsurable while six percent are "ratable."16 In 1975, member companies submitted 2.45 million reports to the MIB,17 and 17.5 million requests for information, while the MIB sent out 3.6 million responses.18

The Medical Information Bureau has been a controversial organization ever since its existence came to public attention in the mid-1960's. One of the most controversial aspects has been its use of the so-called nonmedical codes. In testimony before the Commission, the Bureau's Executive Director and General Counsel identified five: (1) reckless driving confirmed by the proposed insured or by official State or provincial (Canadian) motor vehicle bureau reports; (2) aviation with the proposed insured only as the source; (3) hazardous sport with the proposed insured only as the source; (4) nonmedical information where the source is not a consumer report (i.e., an inspection bureau report); and (5) nonmedical information received from a consumer report and not confirmed by the proposed insured.19 He told the Commission that the fifth nonmedical code (nonmedical information received from a consumer report) could only refer to reckless driving, aviation, and hazardous sport and would not give life-style information.20 In a letter sent to the Commission later, however, he states that "further review of MIB>coding instructions shows that these nonspecific codes may also be used to report other types of nonmedical information, such as `age,' `environment,' `foreign residence or travel,' `occupation,' and 'finances.'" 21

Another object of controversy has been a code for reporting information about an individual's health, which, because of source, does not conform to the definition of medical-record information in the Fair Credit Reporting Act, i.e., information obtained from licensed physicians or medical practitioners, hospitals, clinics, or other medical or medically related facilities. [15 U.S.C. 1681a(i)] Such information could be reported in one of two ways. First, it could be reported by noting the specific code for the condition involved together with an additional symbol indicating that the information does not come within the FCRA definition.22 Or second, as indicated in Executive Director Day's letter, it could be reported by using a code for "medical information received from a consumer report, not confirmed by the proposed insured or medical facility. .. ."23

On October 28, 1976, some months after the discussion of these matters in the Commission's hearings, the MIB informed the Commission that it was proposing the following changes to its code list. First, it was deleting three codes: (1) nonmedical information where the source is not a consumer report; (2) nonmedical information received from a. consumer report not confirmed by the proposed insured; and (3) medical information received from a consumer report not confirmed by the proposed insured or a medical facility. The MIB assured the Commission that in the future "medical impairments may be reported only if information or records are received from the applicant or from licensed physicians, hospitals, clinics, or other medical or medically related facilities." It further stated that the three eliminated codes "will no longer be transmitted to member companies and will be purged or subjected to a `no report order."'24

Second, the remaining nonmedical codes (reckless driving, aviation, and hazardous sport confirmed by the proposed insured) may now only be reported to the MIB if such activity has occurred within the three years preceding the application at hand.25 This was in response to the complaint that very old information could get into MIB files; that the practice of purging information reported more than seven years ago does not mean that all events or conditions coded in MIB records occurred within the previous seven years. For example, a reckless driving conviction that occurred 20 years ago could be noted in MIB records if a company reported it within the previous seven years.

Finally, the MIB also proposed to change the code which reports medical information obtained from a Federal agency to read "medical information obtained from a Federal medical source."26

A further source of controversy has been that codes dropped in the past, as far as reporting requirements were concerned, are nonetheless still in the MIB file and thus can still be reported to MIB members. In reaction to this criticism, the MIB informed the Commission that the following discontinued codes will be purged or subjected to a "no report order": "`information obtained through a disability or health claim,' `nonconformity,' `age,' `environment,' `foreign residence or travel,' `occupation,' 'insurance hazard,' and `finances,"' and, of course, the three nonmedical codes mentioned above.27

Finally, the entire MIB system is predicated on the rule that the receiving company may not base an adverse underwriting decision on the information received from the MIB, but must make its own independent investigation.28 Rule 14 reads:

The information received through the Bureau shall not be used in whole or in part for the purpose of serving as a factor in establishing an applicant's eligibility for insurance.

The application of this rule means that: (a) an application for insurance shall never be denied nor shall any charge therefore be increased wholly or partly because of information received through the Bureau and (b) all information received through the Bureau shall only be used as an alert signal.29

MIB's Executive Director told the Commission that "... Rule 14 is strictly adhered to by members who are regularly visited under the Company Visit Program."30 When questioned, however, he agreed that the requirement to conduct an independent investigation may mean simply going to an investigative agency and getting old information that was once before the basis for an MIB report.31 (Presumably this problem will be alleviated by the proposed elimination of inspection bureaus as authorized sources of certain types of information.) As to the Company Visit Program, moreover, it became apparent that Rule 14 may not be as strictly observed as the MIB would like to believe.

From time to time MIB staff members visit member companies to make certain that underwriters understand the Bureau's rules and to check on compliance with them.32 A typical visit includes a check and review of the member's security arrangements and an "audit" of 20 randomly selected files.33 Two major kinds of violations are looked for: (1) requests for details on MIB codes that have been submitted without first conducting the required independent investigation; and (2) adverse underwriting decisions that have been made solely on the basis of an MIB code (i.e., violations of Rule 14).34 In a letter following his hearing testimony, the Executive Director told the Commission that in 1975, "161 member companies were visited and 3,200 underwriting files were examined ...," but that "in fact only fifteen violations [of Rule 14]" were discovered.35 Since the MIB sends out 3.5 million positive responses to company queries each year this means, if the sampling procedures permit such extrapolation, that overall there were approximately 15,000 violations of Rule 14 in 1975.

The efficacy of the investigation procedure was also questioned by the Commission. Each year the Company Visit Program looks at about 3,000 files (three companies per week, 150 companies per year, 20 files per company).36 Because companies may have several regional offices, however, and because at the rate of 150 companies per year it would take five years to cover all the members, a considerable amount of slippage could go undetected.

Thus, in response to the Commission's expression of concern, the MIB has proposed the following changes. Each MIB member will now be required to adopt formal procedures to protect the confidentiality of MIB information. In addition, starting in 1977, each member must conduct at least annually "a self-audit program to determine whether it has complied with MIB's constitution and rules and whether its internal procedures have protected the . . . confidentiality of MIB information." In addition, the MIB investigation program, "will be expanded during the course of 1977 to include review of the results of members' self-audits." Such a review will include an on-premise inspection of internal procedures instituted by companies to implement certain aspects of MIB policy.37

Whether this voluntary program will be effective remains to be seen. The Commission, however, took the proposed changes into account in making its recommendations regarding insurance institutions and support organizations and believes that it has also found several ways of reinforcing the MIB initiative.

The Impairment Bureau

The Impairment Bureau, a service of the National Insurance Association, is another support organization that exists solely to facilitate communication among life and health insurers. The Impairment Bureau, however,differs from the Medical Information Bureau in several important respects.

In the first place, the Impairment Bureau's membership is muchsmaller and while all of its member companies may forward information toit, only five do so on a regular basis. Second, information about anindividual is only sent to the Impairment Bureau when his application hasbeen declined. Third, each member regularly receives a report on every declination reported to the Bureau without having to ask for information on any particular individual. The Bureau compiles the information it receives on sheets which contain approximately 60 entries per page. Each entry contains the name of the applicant, his date and place of birth, the date of the rejection, a coded entry representing the cause of the declination, a coded entry representing the name of the reporting company, and the city and State where the applicant resides. This information, on approximately 2,000 declined applicants a year, is sent every other month to all member companies.

Like MIB records, Impairment Bureau records contain some information on conditions other than medical ones. Unlike the MIB, however, the Impairment Bureau does not have any specific rules to govern the use of the information it disseminates to member companies or the functioning of the Impairment Bureau itself. Each company may use the declination information as it sees fit and could, for instance, decline an applicant on the basis of the previous declination alone. On the other hand, the Impairment Bureau does not retain copies of the information submitted to it and has not done so since 1964. It merely compiles and distributes information to its members on the basis of the reports it gets from them. Once it has performed this function, the incoming reports are destroyed.38