Request your medical records to yourself under the HIPAA right of access and the fee is capped at the provider’s cost, with a permitted flat fee of $6.50 for electronic copies of records maintained electronically; sign an authorization sending the same records to a third party and the charge can be whatever your state’s fee schedule allows. Same chart, same pages, a difference that is regularly measured in hundreds of dollars per request.
The HIPAA Privacy Rule at 45 CFR Part 164 governs both routes. A valid authorization must describe the information to be disclosed, name who may disclose it and who may receive it, state the purpose, carry an expiration date or event, explain the right to revoke and how, and state that information disclosed may be re-disclosed and may then no longer be protected by the rule. The separate right of access lets you obtain your own records, with the provider generally required to act within 30 days and permitted one 30-day extension.
Below is one household’s arithmetic, carried all the way, followed by the real answer to how far a life settlement authorization reaches – in breadth and, more importantly, in time. Education only; nothing here is legal or medical advice.
In This Article
- The Household and the Four Requests
- Route A: Sign Four Authorizations – The Expensive Path
- Route B: Pull the Chart Once to Yourself – The Cheap Path
- The Other Arithmetic: What a Delay Costs
- How Far a Life Settlement Authorization Reaches: Breadth
- How Far It Reaches: Time, Which Is the Part People Miss
- Where This Leaves the Policy Decision
- Frequently Asked Questions
The Household and the Four Requests
Ellen is 79. In a single quarter she needs the same medical records for four different purposes:
- A long-term care insurance claim, where the carrier needs the chart to evaluate the benefit trigger.
- A Medicaid application, where the state agency needs medical documentation of the level of care.
- A Veterans Affairs claim for her late husband’s benefit.
- A life settlement application, where the provider needs records to order a life expectancy estimate.
Her chart is not small: two hospital systems, a primary care practice, a cardiologist and a neurologist. Call it roughly 480 pages in total.
Each of the four asks her to sign an authorization directing her providers to send records to them. That is four separate third-party disclosures of the same 480 pages, and each one is billed separately.
Route A: Sign Four Authorizations – The Expensive Path
When records go to a third party under an authorization, the charge is generally governed by state medical records fee schedules rather than by the federal right-of-access cost limits. Those schedules commonly permit a base or retrieval fee plus a per-page rate, with per-page rates frequently in the range of roughly $0.25 to $1.00 and many states capping the total for a full chart somewhere in the low hundreds of dollars. Confirm your own state’s schedule with the state health department or medical board, because these figures are revised.
Run Ellen’s numbers on a mid-range assumption of a $25 base fee plus $0.75 per page:
- 480 pages x $0.75 = $360, plus a $25 base fee = $385 per requester.
- Four requesters = $1,540.
- Multiplied across five separate provider organizations, the real figure is higher still, because each provider bills its own retrieval.
She also loses control of the timeline. Each release vendor works on its own schedule, and she has no visibility into what was actually sent.
Route B: Pull the Chart Once to Yourself – The Cheap Path
Under the HIPAA right of access, an individual requesting their own records pays no more than a cost-based fee covering labor for copying, supplies, and postage. Where records are maintained electronically and an electronic copy is requested, a covered entity may charge a flat fee of $6.50 in lieu of calculating actual costs.
Ellen’s numbers on that route:
- Five provider organizations x $6.50 electronic flat fee = $32.50.
- Even at a cost-based rate rather than the flat fee, realistic totals land in the tens of dollars, not the hundreds.
- She then forwards the same PDF set to all four requesters herself, at no additional cost.
Net difference: roughly $1,300 to $1,500, on identical information. And she gains something worth more than the money – she knows exactly what was sent, to whom, and on what date, because she is the one who sent it.
One caution, because the law here has moved: the fee limitation as applied to records directed to a third party at the individual’s request was vacated by a federal court in 2020, so the low patient rate reliably applies to records sent to you. That is precisely why the pull-then-forward sequence is the durable strategy rather than a loophole.
What to say: “I am making a request under my HIPAA right of access for an electronic copy of my complete record, sent to me.” Do not sign the third party’s authorization first.
| Route | Fee Basis | Ellen’s Cost | Timeline Control |
|---|---|---|---|
| Right of access, electronic copy to you | Cost-based, or a permitted $6.50 flat fee | About $32.50 across five providers | Provider must generally act within 30 days |
| Authorization to a third party | State medical records fee schedule | About $385 per requester | Vendor’s schedule, no visibility |
| Four separate authorizations | State schedule, four times | About $1,540 | Four separate unknown timelines |
| Pull once, forward four times | Right-of-access fee only | About $32.50 | You control every send date |
The Other Arithmetic: What a Delay Costs
Money is not the only meter running. Under the right of access a covered entity must generally act within 30 days, with one permitted 30-day extension on written notice. Third-party release vendors are not bound by that individual right and routinely take longer.
In Ellen’s case the sequencing mattered more than the fees:
- Long-term care claim: benefits are not payable until the elimination period is satisfied and the claim is approved. At a home care rate of roughly $28 to $40 an hour in 2025 cost-of-care surveys, each month of delay in claim approval is a four-figure out-of-pocket cost the household carries.
- Medicaid application: incomplete medical documentation is one of the most common reasons an application sits, and a pending application means private-pay days accumulating at the facility rate.
- Life settlement application: records drive the life expectancy estimate, which drives the offer, and providers will not price a file without them.
Having the complete chart in hand, ready to forward the same day a request arrives, compresses all three timelines simultaneously. That is the actual return on the $32.50.
How Far a Life Settlement Authorization Reaches: Breadth
Now the specific question. A HIPAA authorization signed as part of a life settlement application is typically broad by design, and you should read it rather than assume.
Who may disclose. Frequently drafted to cover any physician, hospital, clinic, laboratory, pharmacy, insurer or other provider that has records about the insured – not a named list. That is deliberate, because the underwriter does not know in advance which providers hold relevant records.
Who may receive. Usually the provider, the broker if one is involved, the life expectancy underwriting firms, the eventual purchaser or its servicing agent, and any financing party. Ask for that list in writing.
What is disclosed. Generally the full medical record. Some categories carry extra protection under federal or state law – substance use disorder treatment records under the federal confidentiality regulations, and in many states mental health, HIV and genetic testing records – and often require specific consent language. If those categories matter to you, ask how they are handled.
The re-disclosure warning. The rule requires the authorization to state that information disclosed under it may be re-disclosed by the recipient and may then no longer be protected by the Privacy Rule. That sentence is not boilerplate. It is the most important sentence on the form.
Our explainers on what a HIPAA authorization is and the life settlement authorization specifically go through the form clause by clause, and what documents a provider needs lists everything else in the file.
How Far It Reaches: Time, Which Is the Part People Miss
Breadth surprises people. Duration is what they never considered.
An authorization in a completed settlement typically survives the closing, because the purchaser has a continuing need: it must periodically confirm whether the insured is living in order to know when to file a claim. So the authorization is generally drafted to remain effective for the duration of the policy, or until the death benefit is paid, rather than expiring on a calendar date.
Two consequences that matter to households:
- Ongoing contact is limited but real. The NAIC model framework adopted in most states restricts how often a purchaser or its agent may contact the insured to determine health status – commonly no more than once every three months for insureds with a life expectancy greater than one year, and no more than monthly for shorter life expectancies. Confirm your state’s limit with your state insurance department, and complain there if contact exceeds it.
- Revocation has limits. The Privacy Rule gives an individual the right to revoke an authorization in writing, but that right is expressly subject to the extent that the recipient has already acted in reliance on it. In a completed transaction, reliance has occurred. Revoking after closing generally stops nothing that has already happened and may breach the contract you signed. Read what privacy looks like after selling a policy before you sign, not after.
The information also drives the number. Life expectancy underwriting is what converts a chart into an offer – see how life expectancy underwriting works and what a provider actually does with your file.
Where This Leaves the Policy Decision
The records arithmetic is not a reason to sell or not to sell. It is a reason to control your own file before anyone asks for it.
Three practical rules. Pull the complete chart to yourself first, electronically, for a few dollars. Read any authorization you are handed for its expiration language, its recipient list, and its re-disclosure warning. And ask, before signing, who specifically will receive the records and how long the authorization remains effective.
And be clear about when a sale is the wrong answer regardless of how tidy the paperwork is: when the death benefit is under roughly $100,000, generally below the size the secondary market engages; when the policy is a small final-expense or burial policy, particularly one sitting inside a state Medicaid burial exclusion; when the insured is in strong health for their age, which lengthens the projected life expectancy and compresses offers; and when a surviving spouse still needs the coverage. In those cases the right move is to keep the policy and not to release a medical record to anyone.
If you want to understand what a review involves before authorizing anything, what a life settlement is and what drives a policy’s value explain the process without any records changing hands. A preliminary review starts with the policy cover page alone – no medical records – and it is free with no obligation: call (732) 978-9575. Pine Lake Legacy provides education and reviews only and does not give legal, tax or medical advice.
Frequently Asked Questions
Why is it cheaper to get my own records than to send them somewhere?
The HIPAA right of access limits what a provider may charge an individual for their own records to a cost-based fee, with a permitted flat fee of $6.50 for electronic copies of electronically maintained records. Disclosures to a third party under an authorization are generally governed by state medical records fee schedules instead.
How long does a provider have to give me my records?
Under the right of access a covered entity must generally act within 30 days of the request, with one permitted 30-day extension on written notice explaining the reason. Third-party release vendors operating under an authorization are not bound by that individual right and frequently take considerably longer.
How broad is a life settlement HIPAA authorization?
Typically very broad by design, often covering any physician, hospital, laboratory, pharmacy or insurer holding records, and naming multiple recipients including the provider, any broker, the life expectancy underwriting firms, the purchaser and financing parties. Ask for the recipient list in writing before signing anything.
Does the authorization end when the sale closes?
Usually not. A purchaser has a continuing need to confirm whether the insured is living in order to know when to file the claim, so these authorizations are commonly drafted to remain effective for the life of the policy rather than expiring on a calendar date. Read the expiration clause specifically.
Can I revoke it later?
The Privacy Rule gives you a right to revoke an authorization in writing, but that right is expressly limited to the extent the recipient has already acted in reliance on it. After a completed transaction, reliance has occurred, so revocation generally stops nothing already done and may breach the contract you signed.
How often can a buyer contact the insured afterward?
The NAIC model framework adopted in most states limits contact to determine health status, commonly to no more than once every three months where life expectancy exceeds one year and no more than monthly for shorter life expectancies. Confirm your state’s limit with the state insurance department and complain there if it is exceeded.
Do I have to release records just to find out what my policy is worth?
No. A preliminary review starts with the policy cover page – carrier, policy number, face amount, issue date – and no medical records at all. Medical records become necessary only when a formal application proceeds to life expectancy underwriting, and you can stop before that point.
Find out what your policy is worth — free, confidential, no obligation.
A 15-minute educational review covers your eligibility, every alternative, and a realistic view of what each path would net you.
Related Reading
- What Is A Hipaa Authorization
- Life Settlement Hipaa Authorization Explained
- What Is Life Expectancy Underwriting
- Privacy After Selling Policy
- What Documents A Provider Needs
- What A Provider Does With Your File
- What Is A Life Settlement
- How Much Is My Policy Worth
Pine Lake Legacy does not purchase life insurance policies and does not provide legal, tax, or investment advice. Information provided is for educational purposes only. Eligibility for any option, including life settlements, is not guaranteed and depends on individual circumstances, policy terms, underwriting, and market conditions. Consult independent legal, tax, or financial professionals before making decisions regarding a life insurance policy.