A confrontation over insurers’ right to know
The trade body for UK doctors has recently issued revised guidance to its members about requests from insurers for copies of a patient’s full medical record. Questions have been raised about the legality of such requests and a regulatory review could stand as an important landmark on insurers’ right to know.
In the past, insurers used to request a report from the patient’s doctor that contained details of the patient’s medical history relevant to the insurer’s request. The fee for such a report turned out to be more than a doctor would charge a patient for a copy of their full medical record, in large part because it required expert input. As a result, insurers switched over requesting the full medical report.
Excessive Requests?
The British Medical Association (BMA) viewed such requests as excessive and in breach of a patient’s rights under the Data Protection Act (DPA). That states that the personal data should be “adequate, relevant and not excessive” in relation to the purpose for which the information is requested. As a result, the BMA withdrew guidance on access to medical records that it had previously agreed with the Association of British Insurers, on the basis that insurers were ignoring it and submitting excessive requests for full medical records instead.
Money has clearly been a motivating factor for insurers, but that saving in fees will easily be exceeded by the cost of the insurer’s own medical staff checking through the full medical record. If the job is left to non-medical staff, then the long term cost of underwriting errors will be even greater. And then there’s the question of consent: to comply with the DPA, the insurer has to ask the patient to request their full medical record (it’s not something insurers can do themselves). Yet it appears that pressure has been put on patients to do this, with the BMA talking about some doctors feeling blackmailed with threats of the patient’s cover being invalidated if they didn’t co-operate. Consent would seem to be conspicous by its absence.
A ‘Right to Know’?
Important though issues like consent are, there is a more fundamental point at issue here. To what extent does the insurance sector have a right to know? Does its adoption of ‘lifestyle underwriting’ override the interests of other providers of services to the customer, such as doctors? These questions are pertinent because big data is starting to radically expand the range and depth of information insurers are interested in for underwriting and claims. Will the BMA’s referral of this ‘full medical record’ question to the Information Commissioners Office (ICO) turn out to be a landmark in insurers’ big data strategies?
In my humble opinion, it seems somewhat untenable for an insurer to say that they need to know everything about a customer, on the basis that there may be something in all that information that could affect the risk being insured. It sounds a bit like a journalist wanting to know everything about you incase there may be a story in it, or a campaigner wanting to know everything about your firm incase it had been up to something untoward. Firms put up boundaries; why not customers?
Insurance isn’t in a Vacuum
So limits are bound to be put at some point on insurers’ right to know, because insurance doesn’t operate in a vacuum. Consumers have other interests, other needs, other priorities. Being able to trust their doctor and disclose to them what is needed to receive suitable medical treatment is one such need. The public policy implications of that trust being undermined by the doctor then being obliged to provide insurers with unrestricted access to their medical records are significant.
Big data will transform insurance, yet if the outcomes for customers are to be more positive than negative, insurers need to make a serious effort to address three key ethical issues associated with big data: fairness, privacy and social justice. I say ‘serious’ because there seems to be more ‘talk’ than ‘walk’ at the moment. Each of those three issues permeates this ‘full medical record’ situation and the ICO’s eventual ruling could turn out to be very influential, especially for the Financial Conduct Authority’s big data review.