August 6, 2026
4:48 pm

Privacy and Your Medical Information After a Sale

Read the HIPAA authorization before you sign it, and specifically read the expiration clause and the list of parties authorized to receive your records — those two lines control everything that happens to your medical information afterward. A settlement file cannot be underwritten without medical records, so there is no version of this transaction in which nobody sees them. What you can control is who, for how long, and what happens once the transaction closes.

The instinct that brings people to this page is usually sound. A life settlement involves handing a stranger a detailed picture of your health, your age, and your policy, and then living for years knowing that an institutional investor has a financial interest in your mortality. That is an uncomfortable fact and it deserves a straight answer rather than reassurance. The answer is that the industry is regulated on exactly this point, the limits are more specific than most people expect, and they are written into state insurance codes rather than left to company policy.

Below: exactly who receives your information and why, what state law restricts them from doing with it, how often a buyer is permitted to contact you after closing, how the alternatives compare on privacy alone, and the situations where the privacy cost is a legitimate reason not to sell. Pine Lake Life Solutions provides education and a free policy review; nothing here is legal advice.

In This Article

Who Actually Sees Your File
What the HIPAA Authorization Does and Does Not Do
The State-Law Protections Most People Never Hear About
What Happens After Closing, Concretely
Comparing the Alternatives on Privacy Alone
When Privacy Is a Good Reason Not to Sell
Five Questions to Ask Before You Sign the Release
Frequently Asked Questions

Privacy and Your Medical Information After a Sale

Who Actually Sees Your File

Five categories of party touch your information in a typical transaction, and the list is shorter than people imagine.

The broker or intermediary assembles the file: policy documents, an in-force illustration, an application, and the medical release. Record retrieval vendors collect charts from your physicians under the authorization you signed. Life expectancy underwriters — a small number of specialist firms — review those records and produce a mortality estimate; files at this stage are normally identified by number rather than name. Licensed providers and their institutional funders receive the underwriting summary and enough identifying detail to verify the insured and the policy. The escrow agent and the carrier handle the closing and the ownership change; the carrier, of course, has had your medical file since the day the policy was issued.

After closing, one more party appears: a tracking service retained by the owner to confirm whether the insured is living. That is the function that generates the periodic contact people ask about, and it is the one most tightly regulated.

What the HIPAA Authorization Does and Does Not Do

The federal privacy rule at 45 C.F.R. 164.508 sets what a valid authorization must contain: a specific description of the information to be disclosed, the person authorized to make the disclosure, who may receive it, the purpose, an expiration date or event, your signature and the date, and a statement of your right to revoke. An authorization missing any of those elements is defective.

Two limits matter and are rarely explained. First, revocation works going forward only — it does not claw back records already disclosed, and revoking mid-transaction generally ends the transaction. Second, HIPAA binds covered entities: health plans, providers, and clearinghouses. A life settlement provider is usually not a covered entity, so once your records lawfully reach it, federal health privacy rules no longer govern what it does with them. What governs at that point is your state’s insurance code and the contract you signed.

That is why the state-law layer is the one to read. Our plain-language explainer on what a HIPAA authorization covers walks through the clauses line by line.

The State-Law Protections Most People Never Hear About

The NAIC Viatical Settlements Model Act, which the great majority of states have enacted in some form, contains a confidentiality section that is stronger than the general privacy law applying to most commercial transactions. Under it, a provider, broker, or purchaser generally may not disclose the identity of the insured, or the insured’s financial or medical information, to anyone without the insured’s written consent — with narrow exceptions for what is necessary to effect the settlement, what a regulator or court requires, and what is needed to verify status.

The same model act limits post-closing contact. The standard formulation permits contact with the insured for the purpose of determining health status no more than once every three months when life expectancy exceeds one year, and no more than once a month when life expectancy is one year or less. Many states adopted that language verbatim. In practice this means one short call or letter a quarter, often to a designated contact person you name rather than to you.

A second layer sits underneath: the Gramm-Leach-Bliley Act’s privacy provisions apply to financial institutions handling nonpublic personal information, implemented for insurance through state adoptions of the NAIC privacy regulation. And a third: your carrier’s own reporting to the Medical Information Bureau, an industry data exchange that retains coded underwriting information for seven years. Under the Fair Credit Reporting Act you may request your own MIB disclosure once a year at no charge, which is a useful and underused way to see what the industry already holds about you.

Option	Medical Disclosure Required	Third Parties Involved	Ongoing Contact
Keep paying	None	None	None
Reduced paid-up or face reduction	None	Carrier only	None
Surrender	None	Carrier only	None
Accelerated death benefit rider	Physician certification	Carrier only	None
1035 exchange or new policy	Full new underwriting, exam and MIB	New carrier and vendors	None
Life settlement	Records release under HIPAA authorization	Broker, LE underwriters, provider, escrow	Status contact, statutorily limited

The State-Law Protections Most People Never Hear About

What Happens After Closing, Concretely

You stop paying premiums. The buyer becomes owner and beneficiary and pays them instead. Your beneficiaries are removed from the policy, which is a fact that deserves a family conversation before the closing rather than after — see how to tell your heirs you sold the policy.

Then the tracking begins, and it is duller than people fear. Most owners designate a contact person — commonly an adult child, an attorney, or a facility administrator — and route all inquiries there. The inquiry is typically a short letter or call asking whether the insured is living and, sometimes, for a current address. It is not a request for medical updates unless you agreed to that separately. Institutional owners also verify status through the Social Security Administration’s Death Master File, access to which was restricted by federal law in 2014 so that records within three years of death are available only to certified persons meeting security requirements.

You can shape this at closing. Ask for the tracking contact to be a named third party, ask what the contact interval will be in writing, and ask whether the servicer will accept an annual written confirmation instead of calls. These are negotiable terms and providers agree to them routinely.

Comparing the Alternatives on Privacy Alone

If privacy is your primary concern, rank the options by how much information each one requires you to release.

Keep paying. No new disclosure at all. If the premium is affordable and the coverage is still wanted, nothing beats it on this measure.

Reduced paid-up or a face reduction. No medical disclosure. These are contractual elections handled entirely inside the carrier, which already holds your file. This is the quietest way to cut a premium you cannot afford.

Surrender. No medical disclosure, and the transaction ends your relationship with the policy entirely. It also captures the least money.

Accelerated death benefit rider. Requires medical certification, but only to your own carrier. No third party enters the picture. Payments on account of terminal or chronic illness are generally excluded from income under Internal Revenue Code section 101(g), subject to that section’s conditions.

A 1035 exchange or new coverage. Counterintuitively, this is the most invasive option. New underwriting means a paramedical exam, an attending physician statement, prescription database checks, and an MIB report — a fuller medical inquiry than most settlements require.

A life settlement. Substantial disclosure to a defined set of licensed parties, bounded by statute, followed by periodic status contact. Meaningful, but narrower than an underwriting file for a new policy.

When Privacy Is a Good Reason Not to Sell

Sometimes the honest answer is that the money is not worth the exposure, and that is a legitimate conclusion rather than a failure of nerve.

The likely proceeds are modest. On a policy near the bottom of the market — Pine Lake works with roughly $100,000 or more in death benefit, and small policies price thinly — a limited offer may not justify releasing a full medical history.
A specific diagnosis is closely held. If your family does not know about a condition and you do not want that to change, understand that records travel to several parties and that a designated contact person may infer things from the questions asked.
You would find periodic contact distressing. Some people are untroubled by a quarterly letter and some are not. If you know you belong to the second group, weigh that honestly rather than assuming you will adjust.
The premium problem has a quieter fix. A face reduction or reduced paid-up election solves affordability with zero new disclosure. Exhaust those first.
You are being pressured to sign a broad release before any offer exists. A legitimate process does not require an open-ended medical authorization simply to see whether you qualify. Treat that as a warning sign; our red flags checklist covers what else to watch for.

Five Questions to Ask Before You Sign the Release

One: exactly which parties will receive my medical records, by name and role? Two: when does this authorization expire, and how do I revoke it in writing? Three: after closing, who will contact me or my designated contact, how often, and by what method — in writing? Four: what does your state’s confidentiality statute permit you to disclose about my identity without my consent, and can you cite it? Five: if I decline, is my file destroyed or retained, and for how long?

Get the answers in writing before signing. A provider licensed in your state should be able to answer all five without hesitation, and you can verify a provider’s license directly with your state insurance department’s consumer services division at no cost.

If you want a read on whether your policy has meaningful market value before you release anything medical, send only the policy cover page for a free, no-obligation review, or call (305) 209-7183. A cover page contains no health information. Pine Lake Life Solutions provides educational information only and does not provide legal, tax, or investment advice.

Frequently Asked Questions

Can the buyer contact me whenever they want after the sale?

No. Most states adopted the NAIC model language limiting contact about health status to no more than once every three months when life expectancy exceeds a year, and no more than monthly when it is a year or less. You can also designate a third party to receive those inquiries instead of you. Get the interval in writing at closing.

Does HIPAA protect my records after they leave my doctor’s office?

Only partly. HIPAA binds covered entities such as providers and health plans. A settlement company is generally not a covered entity, so once records lawfully reach it, federal health privacy rules no longer govern. What governs then is your state insurance code’s confidentiality section and the contract you signed. Read both.

Can I revoke the medical authorization?

Yes, in writing, but revocation operates prospectively. It does not retrieve records already disclosed, and revoking mid-process will generally end the transaction because the file cannot be underwritten without records. If you are uncertain, delay signing rather than signing and revoking.

Will my family find out I sold the policy?

Not automatically, but beneficiaries are removed from the policy at closing and will discover that when a claim is made. Most people find it far easier to have that conversation in advance than to leave it as a surprise. Some sellers also name a family member as the tracking contact, which discloses the sale by implication.

Which option protects my privacy best if I just cannot afford the premium?

A face reduction or a reduced paid-up election. Both are handled entirely inside the carrier that already holds your medical file, require no new disclosure, involve no third party, and generate no ongoing contact. They capture less money than a sale, but on privacy alone they are the strongest choice available.

Is a new policy more private than selling this one?

Usually the opposite. New coverage means full underwriting, which typically involves a paramedical exam, an attending physician statement, prescription database checks, and a Medical Information Bureau report. That is a broader medical inquiry than most settlement files require. You may request your own MIB disclosure once a year at no charge.

Find out what your policy is worth — free, confidential, no obligation.

A 15-minute educational review covers your eligibility, every alternative, and a realistic view of what each path would net you.

Call (305) 209-7183 · Request a review online →

Table of Contents