Medical Authorization From an Adjuster: Should You Sign?

A few days after your accident, an envelope or email arrives from the insurance adjuster with a one-page form and a note asking you to sign and return it "so we can process your claim." It is a medical authorization, and it reads like routine paperwork. This post explains what that form can actually unlock, what California and federal law require of it, and how to give the insurer what it legitimately needs without handing over your entire medical life.

What the form actually does

A medical authorization is your written permission for doctors, hospitals, pharmacies, and other providers to send your records directly to the insurance company. Once it is signed, the adjuster no longer has to ask you for anything. They can request records from anyone listed, or in many forms, anyone at all.

That is the real issue. The insurer does need records to evaluate an injury claim. It does not need your whole history to do it, and the form usually asks for far more than the crash put at issue.

Read the scope language closely

Insurers publish their own forms, and the wording is worth reading slowly. GEICO's publicly posted California authorization, form C-256 CA, is a useful example because it is typical of the genre. It authorizes providers to furnish "any and all medical information which may be requested concerning my physical and/or mental condition and treatment."

The records it covers "shall specifically include, but shall not be limited to" treatment related to the accident. The phrase "not be limited to" is doing the heavy lifting. The same form goes on to list billing and insurance files, "all employment records," workers' compensation documents, and "scholastic records." It also states that the records may include information about communicable diseases, psychiatric care, and drug or alcohol treatment.

Then there is redisclosure. The form says the information "may be re-disclosed by GEICO pursuant to applicable law and may no longer be protected by" HIPAA, and it separately authorizes GEICO to re-disclose the records for purposes connected to evaluating or litigating the claim. It also lets the insurer's consultants and "any physicians appointed by it" examine them.

None of this is hidden. It is all on the page, which is exactly why it is worth reading before you sign.

Why the adjuster wants everything

An open-ended authorization is the raw material for the pre-existing condition argument. If the adjuster can pull ten years of records, they can look for an old back complaint, a sports injury, a note about anxiety, or a gap in care, and argue that your pain came from that instead of the crash.

It also shifts control. When you or your lawyer gather records and send them, you know exactly what the insurer has seen. When the insurer pulls records itself, you often do not, until a piece of your history shows up in a denial letter or a lowball offer.

What federal and California law require

Two sets of rules govern these forms, and knowing them helps you spot a bad one.

Under the federal HIPAA rule, 45 CFR § 164.508, a valid authorization must include:

• A description of the information to be disclosed
• Who may disclose it and who may receive it
• The purpose of the disclosure
• An expiration date or expiration event
• Your signature and the date

It must also tell you that you can revoke it in writing, and it must warn you that the information may be redisclosed by the recipient and lose its protection. It has to be in plain language, and if a covered entity asks you to sign, it must give you a copy.

California's Confidentiality of Medical Information Act adds its own requirements in Civil Code § 56.11. The authorization must be handwritten or printed in at least 14-point type, kept separate from other language on the page, signed and dated, and it must specify the limits on the types of medical information to be disclosed, who may disclose it, who may receive it, and the limits on how the recipient may use it. It must include a specific expiration date or event and tell you that you have a right to a copy.

California also restricts what happens after disclosure. Under Civil Code § 56.13, a recipient generally may not pass your medical information along except under a new authorization or as the law specifically allows. Read the redisclosure paragraph of any form with that in mind, because signing it may be the very permission that rule calls for.

What this means in California

Your medical condition does become relevant when you claim an injury. California Evidence Code § 996 says the physician-patient privilege does not protect communications "relevant to an issue concerning the condition of the patient" when the patient is the one who raised that issue. Filing a bodily injury claim raises it.

Notice the limit built into that rule. It reaches communications relevant to the condition you put at issue, not everything a doctor ever wrote about you. A neck and shoulder claim makes your neck and shoulder fair game, along with reasonably related history. It does not automatically open your reproductive health, your therapy, or your childhood school file.

If you change your mind after signing, Civil Code § 56.15 lets you cancel or modify an authorization by written notice, and it takes effect once the provider receives it. Revocation only works going forward. Records already sent stay sent.

How to handle the request

You can cooperate without signing a blank check.

• Do not sign on day one. There is rarely a good reason to sign in the first week, while your treatment is still developing.
• Offer records instead of access. Gather the records and bills from the providers who treated you for this accident and send them yourself. The adjuster gets what they need to evaluate the claim, and you know exactly what went out.
• If you do sign, narrow it. Cross out "not limited to" language, list the specific providers, set a date range starting shortly before the accident, write in a near expiration date, and strike employment and school records unless lost earnings are actually part of the claim.
• Keep a copy of anything you sign. You are entitled to one.
• Know whose insurer is asking. With the other driver's insurer, you are under no contract with them. With your own insurer on a MedPay or uninsured motorist claim, your policy likely includes a cooperation clause, and the GEICO form warns that not signing can delay or lead to denial of the claim. That is a reason to negotiate the scope, not a reason to sign the broadest version.

The same instinct that should make you cautious about recorded statements applies here. Being cooperative and being careful are not opposites.

Next steps

If an authorization is sitting in your inbox, read the scope, the redisclosure paragraph, and the expiration line before you do anything else. Keep treating, keep your own copies of records and bills, and send the insurer what relates to this injury. Remember that the two-year statute of limitations under CCP § 335.1 keeps running while records go back and forth. If you are unsure what a form you were sent actually covers, a free consultation with our firm costs nothing and there is no fee unless there is a recovery.