As part of their claims processing procedures, health insurance companies may request medical information directly from a patient’s medical practitioner or service provider (hospital) so that medical costs and services can be paid. This is normally done with the consent of the patient who completes the relevant claim form with their Insurer.

The claims process should be relevant and not excessive and it is the opinion of the Data Protection Commission (DPC) that requests for medical information should be data specific to the purpose of assessing the validity of a claim or underwriting process of a claim. Any request by a health insurance company to seek a copy of the complete medical files of an individual would be considered disproportionate and excessive.

Compensation claims for personal injuries are dealt with under a specialised legal process governed by tort Law (or other similar laws) and court’s legislation which outlines the procedures for making such legal claims. (A tort is a civil wrong that causes a claimant to suffer loss or harm, resulting in legal liability for the person who commits the tortious act). Any medical report is usually obtained by the claimant’s solicitor and follows the Rules of Discovery regarding any disclosure that could be made to an insurance company.

The following extract from the Irish College of General Practitioners (ICGP) on this issue, on the Data Protection section of the ICGP website, compiled in consultation with this office, provides guidance to GPs in relation to the completion of Private Medical Attendant Reports:

"The completion of private medical attendant reports for GPs on behalf of their patients has long been an area of concern. In many cases patients do not appear to be aware of the extent of information sought about their health by the insurance companies. Nor do they appear to be aware of the implications of adverse health information and that insurance companies are allowed to share "adverse" health information with each other. GPs can easily get caught up in a dispute between patients and their insurance companies and patients can feel angry that GPs have disclosed information to insurance companies even though they have provided consent. In order to protect the GP and the patient from the negative effects of this practice the GP should:

• Ensure written consent is provided with every request for a PMA report.
• Not send actual copies of recorded consultations.
• Not send specialist reports even if these are requested by the company. These can be sought together with an opinion on their relevance from the specialist separately if the company so wishes.
• Include in your patient information leaflet the fact that medical information is passed on to insurance companies (as is standard practice) on receipt of a signed consent form by the patient.

Some GPs offer patients the opportunity to review their PMA report before it is returned to the insurance company, particularly if it is likely to have a negative impact on their insurance risk. GPs may wish to consider this action, where they have concerns that the patient has consented to what may be considered excessive disclosure of their information, to ensure the patient fully understands the nature of the consent provided.

In the completion of PMA reports it is important that GPs do not suppress or omit information in order to help patients avoid financial "loading" by the insurance company. To do so would make the policy invalid and could leave the GP exposed to legal action. If patients are unhappy with the terms offered based on medical information provided by the GP they should be referred to the chief medical officer of the insurance company in the first instance and failing this, the Financial Services

Ombudsman… and\or the Equality Authority… who may be able to help."  For further information visit the Irish Human Rights and Equality Commission.