An adjuster sent you something to sign, or asked you to sign something over the phone, and it had language in it about medical records, and you signed it because you were trying to cooperate and get your claim moving and nobody explained what you were actually authorizing. Or you did not sign it and now the adjuster is applying pressure, suggesting that the claim cannot proceed without it, and you are trying to figure out whether that is true and what your options are. Or you are at the beginning of this process and you want to understand what your rights are before anyone puts anything in front of you. Wherever you are in that sequence, the answer to this question is one of the most practically important things you can understand about your car accident claim, and most people understand it too late.

The baseline answer is no. An insurance company cannot obtain your medical records without your authorization. Federal law under the Health Insurance Portability and Accountability Act, HIPAA, prohibits healthcare providers from releasing your records to third parties, including insurance companies, without a valid signed authorization from you. This protection applies to the at-fault driver’s insurance company, your own insurance company in most circumstances, and any other third party seeking records from your providers. The insurer has no independent legal mechanism to compel your doctors to produce your records during the claims phase, meaning before any lawsuit has been filed. Before litigation begins, records come through you, through your authorization, and that means you have far more control over what gets produced and to whom than the claims process is designed to make you feel.

The mechanism that strips that control away is the medical authorization form, sometimes called a HIPAA authorization or a release of medical records, that insurance adjusters routinely send to claimants in the early stages of a claim. These forms are presented as routine, necessary, and procedurally required in language that implies the claim cannot be processed without them. None of that framing is accurate in the way it is intended to convey. What is accurate is that an insurer does need some access to your medical records to evaluate your claim, because evaluating your damages requires some understanding of your injuries and treatment. What is not accurate is that you are required to hand them a signed blank authorization that lets them request whatever they want from whoever they want, without your review, without limitation on scope, and without any involvement of your attorney.

The specific danger in a broad, unrestricted medical authorization is scope. Adjusters routinely send authorizations that are not limited to the treatment you received for the injuries in this accident. They send authorizations that allow the insurance company to request your entire medical history from every provider you have ever seen, your primary care physician, your ob-gyn, your therapist, your psychiatrist, your chiropractor, your cardiologist, and every other specialist you have consulted over years or decades. The insurer is not entitled to all of that. But once you have signed a broad authorization, your providers will comply with the request, and the insurance company will receive and review records that have no legitimate connection to your accident injuries, looking for prior complaints, prior diagnoses, prior treatments, and any other material that can be used to argue that your current injuries are pre-existing, psychological, or otherwise not attributable to the accident. This is not speculation about what might happen. It is the documented practice of claims management departments at major insurance carriers, and it is one of the primary tools used to reduce or deny claims that would otherwise have been paid at full value.

The authorization you sign also typically contains no limitation on what the insurer can do with the records once they obtain them. Records produced pursuant to a broad authorization can be shared with retained defense medical experts, with defense attorneys if litigation is filed, and with claims management systems that aggregate data across carriers. Your medical history, once released through a broad authorization, is no longer in your control, and the downstream consequences of that release extend well beyond the current claim.

You are not required to sign a broad, unrestricted medical authorization to pursue your personal injury claim. What you are required to do is provide the at-fault insurer with reasonable access to the records that are relevant to the injuries you are claiming. The legally operative distinction is between records relevant to your accident injuries and records from your entire medical history. You can provide relevant records directly through your attorney, who reviews them before production and ensures that only appropriate records are disclosed. You can provide records limited to specific providers, specific date ranges, and specific body parts or conditions that are at issue in your claim. You can, and generally should, refuse to sign an authorization that is not limited in these ways and offer instead to provide records through your own counsel with appropriate scope limitations.

Your own insurance company occupies a different legal position in this analysis, and the distinction matters. If you are making a claim under your own policy, whether that is a collision claim, a medical payments claim, an underinsured motorist claim, or any other first-party coverage, your insurance policy almost certainly contains a cooperation clause that requires you to assist in the investigation of your claim. This contractual obligation is more extensive than your obligations to the at-fault driver’s insurer, and courts have interpreted it to require providing reasonable access to medical records that are relevant to the claim being made. Even here, however, the obligation is to provide relevant records, not to sign a blanket authorization for your entire history. The policy’s cooperation clause is a contractual obligation, not a waiver of all privacy rights, and your insurer is required to make requests that are reasonable in scope.

Once a lawsuit has been filed, the rules change significantly. Civil discovery rules in Missouri and most other states allow both parties to obtain medical records through formal discovery processes including subpoenas, interrogatories, and requests for production, subject to the court’s oversight and the ability of both sides to object to requests that are overbroad or seek irrelevant information. In litigation, a defense attorney can subpoena records from your providers directly without your authorization, and the scope of discoverable medical history is broader than what was relevant to the pre-litigation claims process. This is one of the reasons that the litigation phase of a personal injury claim produces a more complete picture of your medical history than the claims phase, and it is also the reason that your attorney needs to know your full medical history, including anything that might be characterized as a pre-existing condition, before the litigation begins rather than after a subpoena reveals it.

The independent medical examination is a related context in which your medical records are accessed without your real-time participation, and it deserves mention here. When an insurer requests that you submit to an IME, they are asking you to be examined by a physician they have retained, whose report they will use to contest your injury claims. The physician conducting the IME will review whatever records the insurer provides them, which in most cases will be the records the insurer has already obtained through the authorization you signed. The scope and framing of the records produced to the IME physician is not neutral. Adjusters and defense attorneys curate what the IME physician receives, and a physician reviewing a selectively assembled record may reach different conclusions than one reviewing the complete clinical picture. Your attorney can and should be involved in the IME process, including reviewing what records are being provided to the examining physician and ensuring that the examination is conducted appropriately.

The practical guidance from all of this is sequential and specific. First, do not sign any medical authorization form sent by the at-fault driver’s insurance company without having your attorney review it. If you do not yet have an attorney and an authorization has arrived, do not sign it until you have consulted with one. Second, if you are asked to sign a broad authorization without scope limitations, understand that you have the right to propose a limited authorization covering only the providers, dates, and conditions relevant to your accident injuries. Third, if you have already signed a broad authorization, inform your attorney immediately so they can assess what records were produced and whether any corrective steps are available. Fourth, understand that the pressure the adjuster applies around records access is itself a claims management tactic designed to produce a broad disclosure that serves their interests rather than yours, and that the claim will not disappear if you decline to sign a document that is not in your interest to sign.

Your medical history is the most private category of personal information most people possess. The accident that brought you into the claims process did not eliminate your right to control who sees it and in what context. The system is designed to make you feel as though cooperation requires surrendering that control entirely and immediately. It does not. Understanding where your obligations end and where the insurer’s entitlement ends is the information that protects everything that comes after.

This article is intended for general informational purposes only and does not constitute legal advice. Privacy rights, medical record disclosure obligations, and the legal requirements governing insurance claims vary by jurisdiction and the specific terms of applicable insurance policies. If you have received a request for medical records or a medical authorization form in connection with a car accident claim, consult with a licensed personal injury attorney before signing anything or producing any records.