Privacy Commissioner Says Adjuster’s Request for 5 Years of Medical Records Might Have Exceeded Scope of Authorization

In PIPEDA case #362, an insurance adjuster had obtained from an accidents benefits claimant a release for medical records. The document read as follows:

I hereby authorize any doctor, hospital, clinic, institution or person, possessing information or medical records on my person, to furnish any such information, reports or records as may be requested by (the insurance adjuster) or their representative concerning my state of health, nature and extent of injuries arising out of an accident which occurred on or about (the date of the 2004 accident).

Using this release, the adjuster requested the claimant’s health records for the past five years. When the claimant learned this, she revoked her consent. The adjuster had not, by that time, collected any records.

In response to a complaint to the Privacy Commissioner, the Assistant Commissioner ruled that “had the adjuster in fact collected the information he requested, the company could have been found to have collected more personal information than necessary for the purposes identified. It would likely have been found to have collected this information without the complainant’s knowledge or consent, as the authorization form she signed did not in any way authorize the adjuster to collect such information.”

The Assistant Commissioner recommended a change in the records-collection procedures employed by the adjusting firm. The firm complied, introducing the following changes:

The adjuster instituted procedures to ensure that claimants are made fully aware of what information will be collected by the adjuster and that the collection will be limited to that which applies only to the injuries in the incident under investigation. If the claimant indicates that he/she has a pre-existing condition that may affect the injury under investigation, and the adjuster needs to review the information, it will be sought with appropriate consent.

This decision is one of which insurers and adjusters should take note. Medical releases should explictly provide that for disclosure of pre-accident records, where those are felt to be relevant to the claim.

This entry was posted in Insurance News, Privacy. Bookmark the permalink.