The right to privacy is one of the bedrocks of the American value system — right up there with the right to free speech. But when it comes to your medical records, there are questions about how far that privacy really extends. Who has access to your medical records? Do they stay in your doctor's office? Do they stay in your health insurance company's files? Do insurance companies share that information with one another?

There is no blanket answer to those questions. Like health care regulation itself, the confidentiality of your medical records depends on the people who handle them.

Patchwork of privacy

Health care regulation is a hodgepodge of federal and state laws. The kind of benefits you receive and the way they're funded determine where your medical records are kept and who gets to look at them.

Whether you get your insurance coverage through a group — such as your employer — or individually will also determine how much information an insurance company has about you. While employers are most likely to offer group health insurance, some also offer life insurance, disability insurance, and, more recently, even auto insurance or long term care coverage. Insurance companies tend to ask more questions of people applying for individual coverage than of people who are part of a group.

Insurance companies use "underwriting standards" to decide whether to cover certain people. Life insurance companies often factor in your age, height, weight, and whether you use tobacco products when underwriting your policy. Underwriting standards for members of a group are less stringent than for someone who wants to buy individual coverage. That's because it's less likely that an insurer will have to pay out a big claim on all the members of a group than for one individual policyholder.

The Medical Information Bureau

If you have ever applied as an individual for life, health, or disability insurance, then chances are you're in a database at the Medical Information Bureau (MIB). Established in 1902, this Boston-based company provides about 600 life insurance companies — many of whom also offer health or disability coverage — with general medical information about individuals. In return, member companies report information to the MIB. It's a way for insurers to compare notes on applicants without having to contact one another directly. The MIB says it was established to combat fraud by providing a place where insurance companies can double-check the information provided by people applying for coverage.

For example, a man with high blood pressure may want to buy a life insurance policy, but he's aware that mentioning his medical condition probably means his application will be denied. By checking with the MIB, a life insurance company can make sure that the information provided on the application is accurate. If the MIB files show he has high blood pressure, then the life insurance company can dig deeper before issuing a policy.

Insurance companies pay a fee to become members of the MIB, and they also pay a fee every time they request information from the MIB's databases. In return, member companies agree to report to the MIB any medical conditions that might be of interest to other insurance company underwriters. Common colds are out, but high blood pressure, back strain, and abnormal lab results — about 230 different conditions and test results — could end up in the MIB database. While having a record in the MIB doesn't necessarily mean that you'll be denied insurance, it could mean you'll pay higher rates if your health history requies it.

You will be notified when you apply that the insurance company plans to check the MIB for any record of you, but that notification may be buried in fine print of the authorization you will sign. If you want to know for sure, ask the agent when you fill out the application. And if you know you have a medical condition that might nix your application, think long and hard before applying for individual coverage. Once the database has a record showing you've been denied, it'll be harder for you to get any kind of individual life, health, or disability coverage.

In certain circumstances, you could end up with an MIB record even if you have group coverage. Members of very small groups (less than 10 people, say), late enrollees, and people who request more coverage than usual, may all end up being treated as though they were applying for individual coverage. Hence, any information about medical conditions on your group application could be reported to the MIB.

Getting your hands on your MIB records

The MIB database may keep people honest when they're filling out their insurance applications, but it is far from fail-safe. According to the MIB, it has records on only one or two out of every 10 people who apply for individual insurance. Nonetheless, its database does contain files on about 16 million individuals. It's impossible to know how many of these files contain mistakes, but errors are inevitable. The easiest way for you to check to see if the MIB has a file on you — and whether that file is accurate — is to request a copy of your record.

The MIB is similar to consumer credit reporting services. For instance, it purges records that have been in the system for more than seven years. Under the Fair Credit Reporting Act, you have a right to see and correct the information the MIB has on you. Some states have also adopted laws specifically dealing with the confidentiality of medical records. The MIB and member companies doing business in those states are also subject to those laws.

Member companies of the MIB must also comply with the bureau's own privacy standards. They pledge to use the information only within the member company and only for the purposes of underwriting an application or for looking at a claim.

Many eyes mean loose lips

Although some states and the MIB have their own privacy standards, that doesn't mean your patient information doesn't travel to other places.

One of the problems with keeping medical records confidential is the sheer number of people who handle such information. Every time you visit the doctor, you leave a paper trail that passes through numerous hands. Have health insurance? The insurance company has the right to review your records before it pays for your claim.

While state and federal privacy laws may require a doctor to keep some records private, an insurance company can demand that it be able to review all necessary records, sometimes in direct contradiction to the law. In most states, the contracts that doctors sign with insurance companies aren't even reviewed by the insurance department.

Does your employer administer your benefits in-house? That means someone in your own company may know the intimate details of your medical history. If your co-worker is less than discreet, that trip to the psychiatrist in 1992 could become common knowledge in the lunchroom.

Even if you pay for your health care out of your own pocket, eschewing insurance altogether, your medical records could still end up in the hands of an HMO. That's because most doctors are part of health care networks that want access to all records, not just their own enrollees.

The health plans' motives may be legitimate. For instance, they want to see if doctors recommend more expensive treatments for enrollees than for uninsured patients.

Hospitals also keep records on patients they've served. Pharmacies store information about the kinds of medication that customers use. Considering the fatal consequences of certain drug combinations, tracking a patient's medication can be crucial. But in some states, it is perfectly legal for pharmacies to sell your information to drug companies, who can then use it for direct marketing.

In this age of outsourcing, insurance companies often contract with other companies to help with their data collection. Sometimes, you may not even know that you're dealing with a "third-party" company. About half of all life, health, and disability insurance companies contract with a third party to collect your medical records. Companies such as Intellisys (a division of a subsidiary of ChoicePoint, which provides auto insurers with DMV records) routinely acquire medical records and physician statements for their insurance company clients. Intellisys differs from the MIB, though, in that it doesn't retain any of the data it acquires. However, once your insurance company gets your records, it may very well report medical conditions to the MIB.

Will HIPPA help or hurt?

Nervousness over medical privacy issues has increased among consumers as they await consensus over the electronic privacy standards proposed in the federal government's Health Insurance Portability and Accountability Act (HIPAA). One objective of HIPAA is to reduce health care costs by requiring insurers, health care providers, and health information clearinghouses to work together to simplify electronic data transactions..

Compliance with HIPAA's newly-mandated privacy rule is required by February 2003. Each organization governed under HIPAA is required to set up procedures to protect patients' privacy. Each also has to designate an official to monitor that system and notify patients about their privacy-protection practices. The regulations call for penalties, ranging from fines to criminal charges, against people who violate a patient's right to privacy.

However, right-to-privacy groups are concerned that the standards are contradictory. Even though the standards establish privacy guidelines, they say the proposed regulations actually give more entities access to patients' medical information.