PPLI Privacy: Who Can Access an Insurer’s Policy File?

Map the information, the recipient and the purpose

A policy file is a collection of records: identity documents, financial information, medical underwriting, ownership instructions, investment records and claims correspondence. Think of it as one bundle and you miss the most useful privacy question: which recipient actually needs which part?

Use the table as a due-diligence worksheet. It lists the functions to ask about; the answers will differ from one insurer to the next.

The insurer's privacy notice and written response should identify the actual arrangement. A family-selected manager still needs platform approval and documented responsibilities. See adding an investment manager to an insurer's platform.

U.S. insurance privacy combines several legal frameworks

HIPAA does not automatically protect the life insurer's copy

HHS identifies life insurers among the organizations generally outside HIPAA's Privacy and Security Rules. A physician may need a valid HIPAA authorization before releasing records for life underwriting. That authorization does not turn the recipient life insurer into a HIPAA-covered health plan. HHS guidance.

A company conducting both covered and noncovered activities needs a more precise organizational analysis. Where it properly operates as a hybrid entity, the designated health care components and required safeguards matter. Giving products different names does not, by itself, split the company's HIPAA coverage. 45 CFR 164.105.

Consumer reports have their own access and accuracy rules

The Fair Credit Reporting Act permits specified insurance-underwriting uses of consumer reports. Medical information attracts additional conditions under Section 1681b(g), including affirmative consumer consent for the insurance-transaction report under paragraph (g)(1)(A), subject to the statutory provisions. So an underwriting purpose does not open the door to every disclosure of medical data. 15 USC 1681b.

MIB, Inc. supplies medical specialty information used in individual insurance underwriting, with consumer authorization. If MIB has a file about you, you can request one free report every 12 months. The CFPB states that reporting companies required to provide an annual free report must provide it within 15 days of the request. You can dispute inaccurate or incomplete information. Keep in mind that this report is not the insurer's full underwriting file. CFPB's MIB directory entry.

State insurance privacy rules determine additional rights

The Gramm-Leach-Bliley Act establishes protections for nonpublic personal information, with state insurance authorities assigned enforcement for insurance activities. Review the applicable state implementation and insurer notice. Opting out limits some sharing, but it cannot stop disclosures needed to service the policy, disclosures the law requires or other excepted disclosures. 15 USC 6801, 6802 and 6805.

NAIC Model 670 is a model, not a nationwide statute. Its text provides, among other things:

• Notices of information practices and specified authorization contents.
• A maximum 30-month authorization for collecting information for a life, health or disability application, reinstatement or benefit-change request. Claims authorizations follow different provisions.
• A 30-business-day response framework for qualifying access requests and requests to correct, amend or delete recorded information.
• A 21-business-day response to a timely request for specified adverse-underwriting information. The request generally must arrive within 90 business days of the adverse-decision notice under the model.

Before relying on those periods, check the text your state actually enacted, its exceptions and the real request dates. The NAIC's 2026 working-group mandate includes revising the privacy models, but until a state adopts a revision, it is only a draft. Model 670, Sections 4, 6, 8, 9 and 10; Privacy Protections Working Group.

European protection depends on the processing role and lawful basis

Determine GDPR scope under Article 3. Processing linked to an EU establishment can fall within the regulation even when the server is elsewhere. Specified services offered to people in the EU and monitoring of their behavior can also bring a non-EU organization within scope. Where the server sits is only part of the answer. GDPR.

Separate the controller, processor and employee

A controller determines why and how personal data are processed. A processor acts on the controller's behalf. Employees working under the controller's authority are normally part of the controller, not separate processors.

Article 28 governs processor arrangements, including documented instructions, confidentiality, assistance, audit rights and authorized subprocessors. Specific or general written authorization can cover subprocessors; general authorization requires notice of intended changes and an opportunity to object. Article 29 and Article 32(4) address people working under authority. Articles 5, 25 and 32 add minimization, accountability and security obligations.

Ask the insurer to explain the role assigned to each entity for each activity. An administrator can perform one activity on instructions and another for its own legal purposes. What the contract calls a party matters less than what that party actually does. The EDPB's controller and processor guidance sets out the functional analysis.

Health data needs an additional legal condition

Health information requires an Article 6 lawful basis and an applicable Article 9 exception. Explicit consent under Article 9(2)(a) and necessary legal-claims processing under Article 9(2)(f) are possible routes, subject to their conditions. Other routes exist, and which ones are available depends on the jurisdiction.

Luxembourg's insurance-sector law expressly uses Article 9(2)(g), substantial public interest, for defined insurance and reinsurance processing. Article 181-3 excludes genetic data from that route and imposes specific safeguards. The United Kingdom separately has a conditional insurance provision in Schedule 1, paragraph 20 of its Data Protection Act 2018. Each applies only within its own legal system. Luxembourg Article 181-3; UK insurance condition.

Article 9(2)(h) covers specified health, occupational and care-related purposes with the safeguards in Article 9(3). Having a doctor involved does not bring ordinary commercial life underwriting within it. Ask for the actual purpose and the national-law basis; a passing reference to medical secrecy is not a full answer.

Reinsurance does not authorize unrestricted medical-file sharing

The reinsurance arrangement must identify the information needed, the parties' processing roles, the health-data condition and any international-transfer mechanism. An independent reinsurer making its own risk decisions may be a separate controller. Whether that is true for a given service depends on the facts, and the ceding insurer keeps its own duties either way.

Insurance law adds its own disclosure rules. Luxembourg Article 300(5), for example, permits specified disclosure to reinsurers and co-insurers where detailed knowledge of individual files is needed to assess the risk and perform their commitments. Article 181-3 expressly addresses insurance and reinsurance health-data processing. Even so, what a reinsurer may receive depends on the facts and the law. Not every reinsurer receives the entire medical file.

Request recipient identities and access information with the right limits

GDPR access rights belong to the natural person whose information is processed. If a company or trustee owns the policy, that owner cannot simply demand the insured person's medical records. Anyone requesting on the insured's behalf needs proper authority to act for them.

In C-154/21, Österreichische Post, the Court of Justice explained the recipient-identity obligation. In C-579/21, Pankki S, it distinguished consultation dates and purposes from employee identities. Employee identity can be relevant where essential to exercising the person's rights, with employees' rights and freedoms also considered.

Article 12 generally requires action without undue delay and within one month. An extension of two further months can apply because of complexity or the number of requests, with reasons communicated within the first month. Identity verification, justified restrictions and manifestly unfounded or excessive requests require their own analysis. Ordinary access is free; reasonable fees can apply to additional copies or qualifying excessive requests.

A useful request identifies the person, policy reference and relevant period, then asks for data categories, sources, recipients, retention criteria, consultation information and transfer safeguards. Use the controller's secure channel. A policyholder's own access request is a different legal process from disclosure in litigation or divorce.

Check every international transfer and its onward recipients

For transfers governed by GDPR Chapter V, identify the exporter, importer, destination, processing roles and applicable mechanism. Adequacy decisions and contractual safeguards make the transfer lawful. The processing itself still needs a lawful purpose and, for health data, an applicable condition.

The 2021 standard contractual clauses have four modules: controller to controller, controller to processor, processor to processor and processor to controller. Module 1 may fit a controller-to-controller reinsurance transfer where the clauses' scope and other conditions are met. The module depends on the parties' roles, not simply on the destination lacking adequacy. Assess the destination's law and practices, necessary supplementary measures and onward transfers. European Commission SCC guidance.

Sources: Commission adequacy register and Decision 2025/2574.

The challenge to the U.S. decision in T-553/23 was dismissed on September 3, 2025; an appeal was filed on October 31, 2025 as C-703/25 P. An appeal on its own does not suspend or annul the decision. Official appeal notice.

On July 31, 2026, the EDPB asked the Commission to assess the implications of the U.S. Supreme Court's Trump v. Slaughter ruling for the framework. The letter asks for an assessment; it suspends nothing. In practice, keep checking the current decision and whether the recipient is eligible under it. EDPB letter.

Luxembourg has separate rules for secrecy, outsourcing and health data

Professional secrecy has defined exceptions

Article 300 of the insurance-sector law imposes secrecy duties on specified persons and refers breaches to Penal Code Article 458. It also contains exceptions for legally authorized disclosure, contract performance, fraud prevention, supervision, outsourcing and qualifying reinsurance disclosures. Its scope contains exclusions, including for reinsurance undertakings subject to the stated exception. Ask which provision applies to each recipient.

Older policies have a specific registered-letter process

Article 181-2 applies to life contracts in Annex II classes I, III or VI taken out before April 6, 2024. It concerns requests under Article 300(2bis), second subparagraph. The sequence matters:

1. After three months without a response to the request, the insurer confirms it by a first registered letter to the last known address.
2. If the policyholder has not responded within three months of receiving the first registered letter, the insurer sends a second registered letter. The second cannot be sent earlier than three months after the first was sent. It must explain the request, the consequences of silence and the right to object. The insurer must make additional enquiries about the address.
3. Acceptance is presumed after three months from posting the second letter if the policyholder remains silent.

This is a specific procedure for accepting outsourcing, and each step has to be followed. Two letters arriving in the post do not show that it was completed properly. Nor does acceptance amount to explicit GDPR consent for all health-data processing.

Health-data safeguards deserve a separate review

Article 181-3, introduced by the law of February 6, 2025, provides the conditional substantial-public-interest route described above. Its safeguards include a data protection officer, impact assessment, functional separation, encryption, restricted access, logs, staff awareness, independent review, sectoral codes and an internal policy.

The provision permits documented, justified exclusions for certain listed measures. It does not permit derogation from its requirements for encryption in transit and key management, access restrictions, specified logs, staff awareness and an internal policy. Ask which measures apply and how any permitted exclusion was justified.

Separately, Article 80 retains the domestic record-keeping rule with a defined derogation for digital storage and processing by a qualifying critical ICT provider in Luxembourg or another Member State under European supervision. Records cannot simply be hosted anywhere. CAA consolidated law, Articles 80, 181-2, 181-3 and 300.

DORA adds operational requirements for entities within its scope

The Digital Operational Resilience Act has applied since January 17, 2025. Insurance and reinsurance undertakings and intermediaries appear in its scope, but Article 2 also has exclusions. These include specified small insurance undertakings and intermediaries that are micro, small or medium-sized enterprises.

Article 28(3) requires in-scope financial entities to maintain a register of contractual arrangements for third-party ICT services. That register lists contracts with ICT providers; it does not log who opened a policy file. It is available to the competent authority, and the provision gives policyholders no right to the whole register. Ask for a case-relevant explanation of hosting, support access and subcontractors.

Register templates are prescribed by Regulation 2024/2956. EIOPA's earlier cloud-outsourcing guidelines ended application on January 17, 2025. Sources: DORA, register templates and EIOPA's historical-guideline notice.

Review Swiss insurance privacy under the applicable Swiss provisions

It is easy to assume that Swiss banking secrecy also covers an insurer's policy files. It is a different regime. The Federal Act on Data Protection, contractual duties and applicable insurance rules need their own analysis. The revised data-protection act took effect on September 1, 2023. Its sensitive-data definition includes health and the private sphere; its access framework appears in Articles 25 to 27. Federal Act on Data Protection.

Article 62 addresses intentional disclosure of secret personal data learned through professional activity, including the specified assistance and training situations. On complaint, the maximum fine is CHF 250,000. Article 64 provides corporate-liability rules, including a subsidiary procedure where the contemplated fine is no more than CHF 50,000 and identifying the individual would require disproportionate measures.

These are criminal provisions. They do not cap civil liability, and negligent processing can still have consequences. The Swiss regulator explains that civil claims can involve different conditions and greater amounts. FDPIC explanation of criminal liability.

Separate breach reporting, individual notification and penalties

Under GDPR, the controller's regulator-notification duty and the affected person's notification right have different thresholds:

For that exception to apply, encryption has to have actually protected the affected data; a general statement that the insurer uses encryption is not enough, and the regulator may still require notification. A decision not to notify individuals can be lawful, so hearing nothing tells you neither that the insurer complied nor that it did not. Other applicable jurisdictions can impose separate duties.

Article 83 sets maximum administrative-fine tiers. Specified obligations under Articles 25 to 39 fall within the EUR 10 million or, for an undertaking, 2% of worldwide annual turnover tier, whichever is higher. Specified principles, rights and transfer violations fall within EUR 20 million or 4%. Actual penalties depend on the infringement and statutory factors. A single security failure can breach more than one provision. The tiers are maximum fines, not a ranking of insurers or a measure of compensation. GDPR Articles 33, 34 and 83.

Build a privacy review file before sending sensitive records

1. Name the parties. Record the issuer, administrator, intermediaries, known reinsurers and the controller's privacy contact.
2. Split the records. List identity, financial, medical, investment and claims information separately. Match each proposed recipient to a purpose.
3. Record the authority. Retain the privacy notice, relevant authorization, health-data basis and explanation of any statutory disclosure.
4. Map the transfers. Record hosting and support locations, recipient roles, transfer mechanisms and onward recipients. Request the relevant SCC information where those clauses apply.
5. Test the response. Submit a clear access request through the proper channel and record receipt, any justified extension and the response. Distinguish missing answers from lawful restrictions.
6. Resolve discrepancies. Compare the response with the notice and application. Ask the responsible privacy team to explain mismatches and correct inaccurate personal data.

For example, suppose an illustrative access map lists an administrator and reinsurer, while the notice describes only service providers. The follow-up is to identify the entities, data categories and purposes, then determine whether the response satisfies the applicable rights. A mismatch like this is a question to raise, not proof that anything unlawful happened.

A precise written answer is valuable to keep on file, though no answer can guarantee that unauthorized access will never happen. Keep privacy review alongside carrier due diligence and the broader PPLI privacy framework.

Insurance-file privacy questions

Start with the issuer and the data-sharing question

For a PPLI research inquiry, identify the issuer jurisdiction and the issue you want to understand. Please do not send medical reports or identity documents with a first general inquiry. Send a PPLI inquiry.

This article is educational. A specific access request, authorization or cross-border transfer requires analysis of the actual parties, records and applicable law. See our editorial standards.