Insurance adjuster readjusts its collection practices

PIPEDA Case Summary #2006-362

[Subsection 5(3); Principles 4.3, 4.4 and 4.4.1 of Schedule 1]

An insurance claimant thought she had consented to an adjuster, working on behalf of the insurance company, collecting medical information relating to a car accident in which the claimant had been injured.  She was surprised to learn, however, that the adjuster had requested medical information about her dating back five years.  She revoked her consent and the adjuster never collected the information.  She then complained to the Office that the adjuster had been attempting to collect an excessive amount of information.

As there was no collection of personal information, the Assistant Privacy Commissioner concluded that the collection portion of the complaint was not well-founded.  However, she noted that had a collection in fact taken place, the company could have been in contravention of the Personal Information Protection and Electronic Documents Act (the Act).  She made a number of recommendations to the adjuster, which were fully implemented, and concluded that, on the matter of language of consent and limiting collection, the complaint was well-founded and resolved.

The following is a detailed overview of the investigation and the Assistant Commissioner’s deliberations.

Summary of Investigation

The complainant suffered an injury in a motor vehicle accident.  The other driver’s insurance company retained the services of the adjuster to investigate. 

She met with an adjuster, who asked her to sign an authorization form for medical information, which she did.  The complainant stated that the adjuster had led her to believe that she would be consenting to him accessing medical information related to the accident.  She believed that he had her sign the authorization under false pretences as he later attempted to collect more information than she had consented to.  By way of letter dated a month after signing the authorization form, the complainant revoked her consent in writing, and copied the letter to her medical practitioners. 

The insurance adjuster stated that its role, as the adjuster for the insurance company, was to make contact with the complainant, obtain information from her by way of a signed statement, and obtain authorizations for “medical and special damages information” to determine the potential for a bodily injury claim.  The insurance company had instructed the adjuster to obtain details concerning prior injuries or heath issues and to request the appropriate medical and hospital authorizations.

The insurance adjuster met with the complainant and obtained a statement from her.  The adjuster learned that the complainant had been involved in a previous accident in 2003, and that she was still receiving physiotherapy treatments.  He had her sign authorization forms, including an authorization for medical information form.  This form stated the following with respect to the release of information:

I hereby authorize any doctor, hospital, clinic, institution or person, possessing information or medical records on my person, to furnish any such information, reports or records as may be requested by (the insurance adjuster) or their representative concerning my state of health, nature and extent of injuries arising out of an accident which occurred on or about (the date of the 2004 accident).

The purpose for the release and collection of information was explained on the form in the following manner:

I understand that the insurer, or their representative will use the personal information furnished through this request for: the investigation and adjudication of my claims, and for such other lawful purposes in accordance with applicable federal and provincial laws.

The complainant indicated that, when the adjuster obtained her authorization, he left her with the understanding that she was giving permission for him to access medical information strictly related to her recent accident.  She noted that she verbally agreed that was the sole intention of that authorization.

Shortly after the complainant signed the form, the insurance adjuster wrote to one of the complainant’s treating physicians and the centre where she had been receiving physiotherapy.  He made the following request:

…we will require the medical records regarding the injury sustained in this accident and all clinical notes and records regarding this patient for the past five years.  We are particularly interested in the nature of the injury, treatment given, length of disability, and prognosis for the future.  Attached is a form authorizing the release of this information.

In the adjuster’s first report to the insurance company, it indicated that the medical authorizations obtained from the complainant were used to request the clinical notes and records of the physiotherapist, massage therapist, and general practitioner. 

After learning of the request from one of her therapists, the complainant wrote to the insurance adjuster expressing her concern about the authorization for medical information form, which she felt she had been “coerced” into signing.  She revoked her consent and copied the letter to her treating physicians.

Upon receiving the adjuster’s first investigation report and before it became aware of the complainant’s revocation of consent, the insurance company directed the adjuster to obtain “appropriate authorizations.”  The insurance company asked that the adjuster request an authorization for the general practitioner’s entire clinical notes and records from January 1, 2000, onwards as well as one to obtain physiotherapy and massage records for both accidents.

The adjuster confirmed that it had not received any response to its written requests by the time it received the complainant’s revocation of consent.  The complainant’s file was then closed.

Findings

Issued December 14, 2006

Application: Subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.  Principle 4.3 stipulates that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.  Under Principle 4.4, the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization.  Information shall be collected by fair and lawful means.  Principle 4.4.1 states that organizations shall not collect personal information indiscriminately.  Both the amount and type shall be limited to that which is necessary to fulfil the purposes identified.  Organizations shall specify the type of information collected as part of their information-handling policies and practices.

In making her determinations, the Assistant Commissioner deliberated as follows:

• There was no dispute that, for an insurance company to investigate and adjudicate a claim for benefits, it must collect information pertaining to the circumstances surrounding the claim. 
• The adjuster, as an agent for the insurance company, presented the complainant with authorization forms concerning the collection of such information.  Based on the wording of the authorization for medical information form, which the complainant initially signed, she authorized specific persons or entities to furnish information pertaining to her state of health and the nature and extent of her injuries arising out of the 2004 accident to the adjuster. 
• In the Assistant Commissioner’s opinion, the purpose for such a collection appeared to be appropriate in the circumstances and thus in keeping with subsection 5(3). 
• The problem, however, was not with the purpose but rather with the scope of the information requested by the adjuster.  When the adjuster attempted to collect the complainant’s personal information from the treatment centre and from her treating physician, it was asking for information relating to the December 2004 injury as well as all clinical notes and records for the previous five years.  Such a request was not limited to the purposes which had been identified to the complainant by way of the authorization form and to which she had consented. 
• Although the adjuster may have assumed that because he had raised the issue of the complainant receiving chiropractic treatment related to a previous motor vehicle accident that she would know he would attempt to collect medical information predating the accident for which she was submitting a claim, the consent form she signed only specified the release and collection of information related to the most recent accident.  The complainant therefore had the reasonable expectation that any information collected by the adjuster would only relate to that accident. 
• The adjuster, however, did not in fact collect any personal information about the complainant because she had revoked her consent shortly after it had made its request to the treatment centre and her physician.  It therefore did not technically contravene any of the Principles cited in this report. 
• The Assistant Commissioner nevertheless noted that had the adjuster in fact collected the information he requested, the company could have been found to have collected more personal information than necessary for the purposes identified.  It would likely have been found to have collected this information without the complainant’s knowledge or consent, as the authorization form she signed did not in any way authorize the adjuster to collect such information.
• It was clear to the Assistant Commissioner that the insurance adjuster’s practices and the consent language used in its forms must be changed in order for the company to fully meet its obligations under the Act. 
• She therefore recommended that the company:
• • institute procedures to ensure that, when obtaining a claimant’s consent to collect personal information, it limit its collection to that which is absolutely necessary to fulfil the identified purpose;
  • limit the amount of personal information collected to only that to which the claimant has consented; and
  • use consent language that is consistent with these collection practices.
• The adjuster instituted procedures to ensure that claimants are made fully aware of what information will be collected by the adjuster and that the collection will be limited to that which applies only to the injuries in the incident under investigation.  If the claimant indicates that he/she has a pre-existing condition that may affect the injury under investigation, and the adjuster needs to review the information, it will be sought with appropriate consent.
• The adjuster revised its authorization for medical information form to reflect this. 
• Based on these actions, the Assistant Commissioner was now satisfied that the adjuster was meetings its obligations under Principles 4.4 and 4.4.1.

The Assistant Commissioner concluded that, on the matter of collection, the complaint was not well-founded. On the matter of language of consent and limiting collection, she concluded that the complaint was well-founded and resolved.