Should I Sign the Medical Authorization Form? What It Actually Authorizes and Why It Matters to Your Claim

Shortly after an accident, along with the recorded statement request and perhaps an early settlement offer, many claimants receive a medical authorization form from the at-fault driver's insurance company. The form looks routine. The cover letter describes it as a standard part of processing the claim. The request is framed as a cooperative, necessary step. 

Reading the form carefully tells a different story. 

Medical authorization forms sent by insurance companies are typically drafted to be as broad as legally permissible. Signing one gives the insurer access to far more than the records related to the accident. It often opens the claimant's entire medical history to review, including prior injuries, prior treatment, mental health records, and any other medical information the insurer might use to minimize the claim. 

This page explains what a typical insurance company authorization actually authorizes, how federal HIPAA and California's Confidentiality of Medical Information Act interact to govern medical privacy in this context, what claimants are and are not required to provide, and what a more limited approach to medical records looks like. 

As always, the information here is educational and does not constitute legal advice. Specific situations vary and anyone with questions about their particular situation should discuss them with a California personal injury attorney.

What the Form Actually Says: Reading Past the Routine Language

Insurance company medical authorization forms are typically HIPAA-compliant documents, meaning they meet the technical requirements of the Health Insurance Portability and Accountability Act for authorizing the release of protected health information. HIPAA compliance means the form is legally valid. It does not mean the form is limited to what is actually relevant to the claim. 

A typical insurance company authorization covers all medical records from any provider for any condition over a period that often extends years before the accident. Common language includes phrases along the lines of: 

"All medical records, reports, charts, notes, test results, imaging studies, billing records, and any other health information from any healthcare provider who has treated, examined, or evaluated the undersigned for any condition or complaint." 

The phrase "any condition or complaint" is the key language to notice. It does not limit disclosure to accident-related conditions. It does not limit disclosure to the body parts at issue. It does not limit disclosure to treatment occurring after the accident. It authorizes the release of everything. 

The time period specified in these forms is equally important. Many insurance company authorizations request records going back five years or more. Some are drafted without a specific start date, effectively authorizing access to the claimant's entire medical history. 

The list of authorized recipients is also typically broad, allowing the insurer and its representatives to obtain records from any provider, including providers the claimant may have seen for conditions entirely unrelated to the accident.

Why the Insurer Wants This Information

Understanding why insurers draft authorization forms so broadly requires understanding what they are looking for beyond the accident-related records. 

Prior injuries to the same body parts are the primary target. If the claimant is claiming a back injury from the accident and prior medical records show back complaints or treatment from years before, the insurer will use those records to argue the current condition is pre-existing rather than caused or aggravated by the accident. The broader the authorization, the better the chance of finding something useful for this argument. 

Mental health records are another target. Emotional distress is a compensable element of damages in California personal injury cases. A claimant with prior mental health treatment history may find that history used to argue their current emotional distress predates the accident and is not compensable as an accident-related damage. 

Credibility evidence is a third purpose. Prior medical records inconsistent with the claimant's current account of their health before the accident, or revealing conditions the claimant did not disclose, can be used to challenge credibility in negotiations and at trial. 

General information gathering is a fourth purpose. Some call it a "fishing expedition." Sometimes the broad authorization is simply an exercise in obtaining as much medical history as possible to see what might be useful. A narrow authorization limits this significantly. 

None of this means prior medical history is irrelevant to a personal injury claim — it may genuinely be relevant in specific cases. The issue is whether the insurer is entitled to an unlimited review of the claimant's entire medical past as a condition of processing the claim. Generally, they are not. 

What Personal Injury Claimants Are and Are Not Required to Provide

This is where accurate information matters most, because the typical insurance company framing suggests signing the authorization is mandatory when it is not. 

As a third-party claimant making a claim against the at-fault driver's insurance company, the claimant controls access to their medical records. There is no California law requiring a third-party claimant to sign the opposing carrier's authorization form as a condition of having their claim processed. 

The insurer is entitled to information relevant to the claim. That information can be provided in ways that give the claimant more control than a broad open-ended authorization. 

Providing records directly is one approach. Rather than signing an authorization that gives the insurer unlimited access to contact providers directly, the claimant can gather the relevant records and provide them as part of a demand package. This gives the claimant control over exactly what is submitted and in what context. 

Providing a narrower authorization is another. A claimant can provide a HIPAA-compliant authorization that is limited to specific providers who treated the accident-related conditions, a time period beginning at or near the accident date, and the specific body parts or conditions relevant to the claim. California law supports this approach, as discussed in the CMIA section below. 

The situation is different for first-party claims under the claimant's own insurance policy. Where a claimant is making a claim under their own coverage — an uninsured motorist claim, a MedPay claim, or a claim under their own health insurance — the cooperation obligations in the policy may require providing medical information to the claimant's own insurer. Even in that situation, the obligation is to provide relevant information, not necessarily to sign an unlimited authorization drafted by the insurer. Consulting an attorney before signing any authorization is advisable in these situations as well.

The HIPAA Framework: What It Requires and What It Does Not Guarantee

The Health Insurance Portability and Accountability Act governs the privacy of protected health information and requires a signed authorization before healthcare providers can release medical records to third parties such as insurance companies. 

A HIPAA-compliant authorization must contain certain elements: a description of the information to be disclosed, the name of the person or entity authorized to receive it, the purpose of the disclosure, an expiration date or event, and a statement of the individual's right to revoke the authorization. 

Two things about HIPAA are worth understanding clearly in this context. First, HIPAA compliance says nothing about the scope of the authorization. A form can be fully HIPAA-compliant and still authorize disclosure of everything in the claimant's medical history. Compliance with HIPAA is a floor for legal validity, not a ceiling on breadth. 

Second, federal HIPAA does not provide a private right of action for individuals. A claimant whose medical privacy is violated under federal HIPAA can file a complaint with the federal Department of Health and Human Services, but cannot sue the violating party directly in court under federal law. 

California's Confidentiality of Medical Information Act addresses both of these gaps, as discussed in the next section. 

One HIPAA provision worth knowing: the authorization is revocable. Under HIPAA, a claimant can revoke a previously signed authorization at any time by providing written notice to the healthcare provider, as long as the provider has not already acted on it. If a broad authorization has been signed and the claimant subsequently realizes its scope, revocation before the provider has produced records is worth discussing with an attorney.

California's Confidentiality of Medical Information Act May Offer Stronger Protections Than HIPAA

Federal HIPAA sets the minimum floor. California's Confidentiality of Medical Information Act (CMIA), codified at California Civil Code Section 56 et seq., goes significantly further in ways that directly benefit personal injury claimants in this state. 

Two aspects of the CMIA are particularly relevant. 

The first is the restriction on use. Under the CMIA, any recipient of medical information in California, including an auto insurance company, is prohibited from using or disclosing that information for any purpose beyond what was specifically stated in the authorization. An insurer that obtains medical records to evaluate an injury claim from a specific accident cannot legally use those records for unrelated purposes — such as underwriting decisions on the claimant's own insurance policies or sharing with unrelated business units. The CMIA restricts use to the authorized purpose, period. 

This is a meaningful distinction from the federal framework. Under federal HIPAA alone, once records are lawfully obtained through a signed authorization, the constraints on how the recipient uses them internally are more limited. The CMIA closes that gap for California claimants. 

The second is the private right of action. Under Civil Code Section 56.35, a California claimant whose medical information is negligently released, used outside the scope of the authorization, or otherwise mishandled can bring a direct lawsuit in California court. This is a significant practical difference from federal HIPAA, which provides no direct private cause of action. 

The available remedies under a successful CMIA claim include actual damages caused by the violation, nominal statutory damages of $1,000 per violation regardless of whether actual damages can be proven, and attorney's fees under Civil Code Section 56.35. 

A few important qualifications: the CMIA does not prevent an insurer from using records for the stated authorized purpose. If the authorization states that records are being obtained to evaluate a personal injury claim and the insurer uses them for exactly that purpose, they are within the scope of the authorization. The CMIA restricts use beyond that stated purpose. It also does not eliminate the need for a careful authorization in the first place — the better approach is still to limit what the insurer obtains through a narrower authorization, rather than relying on the CMIA to restrict what they do with broadly obtained records. 

The CMIA supports the narrow authorization approach directly. An authorization is enforceable according to its terms under California law. A claimant (or their attorney) has the legal right to draft a customized authorization that specifically limits disclosure to the providers and time period relevant to the accident. Language restricting the authorization to records related to specific body parts from specific providers from the date of the accident forward is legally enforceable. There is no requirement to use the insurer's own broadly drafted form. 

What Happens When the Insurance Adjuster Contacts Providers Directly

When a claimant signs a broad authorization, the insurer does not simply wait for records to arrive. Adjusters and, in significant cases, medical record retrieval companies contact providers directly and request specific records. 

In Los Angeles, medical record retrieval companies including Datavant (formerly Ciox Health) and MRO Corporation regularly fulfill insurer requests for medical records in personal injury claims. The claimant typically has no visibility into exactly what records were requested or what was provided in response. 

This lack of visibility is one of the practical reasons to prefer the direct submission approach over a broad authorization. When the claimant provides records directly as part of a demand package, they know exactly what the insurer has. When the insurer contacts providers directly under a broad authorization, the claimant does not. 

The Pre-Existing Condition Issue and Why Prior Records Matter

The pre-existing condition argument is one of the most commonly deployed defenses in Los Angeles personal injury claims, and the broad medical authorization is the insurer's primary tool for building it. 

California law does not bar recovery for injuries that aggravated pre-existing conditions. The eggshell plaintiff doctrine — accurately stated — holds that once liability is established, a defendant is responsible for the full extent of the plaintiff's injuries even if a pre-existing condition made those injuries more severe than they might have been in a person without that history. The doctrine addresses the scope of damages once liability is proven. It does not independently establish liability where none otherwise exists. 

In practical terms, prior medical history to the same body parts is a complicating factor in a claim, not an automatic bar to recovery. But the complication is real. A claimant with a prior back injury who is now claiming a back injury from the accident will face a more challenging negotiation than one with no prior back history, and the insurer will use the prior records in that negotiation. 

Providing only records from the post-accident treatment period, without a broad authorization that opens prior records, gives the insurer less material for the pre-existing condition argument in the pre-litigation phase. This is not concealment — it is providing the accident-related records as appropriate without voluntarily opening prior history through an overly broad authorization. 

If the case proceeds to litigation, formal discovery under the California Code of Civil Procedure will give the defense access to prior medical records through document requests and deposition questions. That is a different situation from voluntarily opening those records in the pre-litigation phase via a broad authorization.

Mental Health Records: A Sensitive and Separately Protected Category

Mental health records deserve specific attention in this context because they carry additional legal protections in California and because they are particularly sensitive from a claims perspective. 

California Evidence Code Section 1014 establishes the psychotherapist-patient privilege, which protects confidential communications between a patient and a psychotherapist. This privilege is broader than the general physician-patient privilege under Evidence Code Section 994 and reflects California's policy of providing strong protection for mental health treatment communications. 

In personal injury litigation, a plaintiff who places their mental and emotional condition at issue by claiming emotional distress damages may implicitly waive certain aspects of the psychotherapist-patient privilege with respect to relevant treatment. The scope of any such waiver is a contested legal question that California courts have addressed in various contexts. It is not a blanket waiver of all mental health records. 

The practical takeaway for pre-litigation purposes: a claimant should not sign any authorization that includes mental health records without specifically understanding what they are authorizing and why. Mental health treatment history that predates the accident and is unrelated to its effects is generally not relevant to the personal injury claim and should not be included in any authorization provided to the opposing carrier.

A Practical Approach to the Medical Authorization Request

When the insurance company sends a medical authorization form, the following approach protects the claimant's interests without being uncooperative. 

Read the form before doing anything. Review the description of records covered, the time period, the list of providers covered, and the list of authorized recipients. Note how broad each of those elements is. 

Do not sign immediately. There is no urgent legal deadline on responding to an authorization request. The claim continues to be processed while the form is under review. 

Consider the alternative of direct submission. Gathering the relevant accident-related records and submitting them directly as part of a demand package gives the claimant control over what the insurer receives and eliminates the need for a broad authorization. 

If an authorization is going to be provided, make it narrow. Under California law, a claimant has the right to provide a HIPAA-compliant authorization that is limited to specific providers who treated the accident-related conditions, a time period starting at or near the accident date, and the specific body parts or conditions at issue. Language restricting the authorization to records related to specific body parts from specific providers from the date of the accident forward is legally enforceable under the CMIA. There is no requirement to use the insurer's own broadly drafted form. 

Exclude mental health records unless there is a specific reason to include them. Given the additional protections California law provides for mental health records under Evidence Code Section 1014, and the sensitivity of that history from a claims perspective, mental health records should not be included in any authorization provided to the opposing carrier without careful consideration and legal advice. 

Consult an attorney before signing anything, particularly in cases involving prior medical history to the same body parts, mental health treatment, or any sensitive medical history that could be used to minimize the claim. The authorization question is one where a brief conversation with an experienced California personal injury attorney before signing can make a meaningful difference to how the claim develops.

Chapter 7: Negotiation Tactics 

Chapter 7 covers the final piece of the Insurance Playbook — the specific negotiation tactics adjusters use once a demand has been made, how to recognize each one, and how to respond effectively.

→ Continue to Chapter 7: Insurance Adjuster Negotiation Tactics — and How to Respond to Each One Link: /insurance-playbook/negotiation-tactics/