Long before Will Smith and Tommy Lee Jones hit the screen as intergalactic secret agents, the MIB was doing undercover work of a distinctly terrestrial nature. Amassing storehouses of medical information since 1902, the Medical Information Bureau maintains a sort of “Medical Credit Report” on roughly 20% of the United States population.
When you apply for life, health, or disability insurance, insurance companies collect information about factors that might affect your health or longevity, such as age, sex, drug or alcohol use, and other risk behaviors. There is a good chance that at one point or another, you have signed a waiver permitting an insurance provider to transmit this information to the MIB, which creates a record of the insurance findings.
Once stored in the MIB databases, participating MIB insurance companies may access your information in order to reduce insurance fraud. MIB stores these records for seven years, and some of their contents have been a closely held secret. Moreover, some of the information is inaccurate, which can cause major problems for some consumers. This arrangement has led privacy specialist Simson Garfinkel to refer to the MIB as the “official insurance agency gossip columnist.”
The MIB does not store medical test results, records, or X-rays. Though insurance companies are theoretically prohibited from rejecting insurance coverage based upon information in the MIB report, some evidence suggests insurance companies do just that.
So what does your MIB report say? The Fair Credit Reporting Act requires the major credit bureaus to offer one free credit report to consumers annually. However, the Act specifically does not apply to medical records. After some pressure from the FTC in the early 80’s, the MIB has agreed to offer consumers one free MIB Disclosure per year.
Not everybody has an MIB record, but ironically, in order to find out whether you’re in the system, you must become part of the system. The rather stern voice of MIB’s automated phone system warns that failure to provide a broad range of personal information to MIB, will terminate the call. You are asked to “certify under penalty of federal law,” the following information:
- Your Social Security Number (SSN)
- Your Last Name
- Your First Name
- Your Middle Name
- Any Other Previous Surname
- Your Date of Birth
- Your Birth Place
- Your Occupation
- Your Current Address
- Your Telephone Number
So, even if your personal information was not in their databases before you called, it will be once you call. Neither the automated phone system nor the website, www.mib.com, indicates how your personal information will be used, how long it will be stored, whether it becomes a part of your MIB report, or whether it will be shared with insurance companies.
I called the MIB Disclosure Report number (866-692-6901) and reluctantly provided the information. About one week later I received a letter from MIB: “Using the identification information provided as a part of your request to MIB, we have made a thorough search of our records… and cannot find any information.”
Great. Now the MIB had all of my personal information, and I didn’t have anything to show for it.
So I called customer service (781-751-6003), and requested that they purge my personal information from their database. A nice woman with a thick Boston accent answered the phone, and I learned a lot about their data retention policies.
When a consumer calls the Disclosure Report number, her information is divided into two files. Most of her identifying information is entered into a database, and tagged with a unique reference number. Then her SSN is placed in a text log file with the same reference number. Both data sets are stored indefinitely, and the MIB representative could not detail a regular policy of purging either.
MIB uses a person’s name, birth date, address, etc. to 1. Search for matching records, and 2. Make sure the person hasn’t requested a report within the last 12 months. But MIB representatives insist that they do not use the text file with the SSN for anything except to ensure that you are the one requesting your MIB record.” In other words, the MIB inappropriately uses the SSN as a proof-of-identity. This is yet one more reason why your SSN should stay out of others’ hands—to prevent medical impersonation.
Since the MIB claims not to use the SSN for any reason except “proof-of-identity,” I suggested that they re-think their data-retention policy, and purge the text log on a regular basis. The supervisor gave me a dubious reply, “Well I’m sure they have their reasons for keeping [the SSNs].” I didn’t ask who “They” were, or what “their reasons” might be; it was clear she didn’t know. And I doubt that I could have talked to “Them” if I had asked, anyway.
I requested that they purge my SSN from their text log. After a long and good-humored conversation, the representative agreed to do me a favor and delete my SSN. However, it was clear that I was an exception to the rule.
My report and accompanying podcast on the Medical Information Bureau piqued the interest of the MIB’s Vice President/ General Counsel, who contacted me directly. He asserted that they do have a data retention schedule, but that the policy is proprietary and confidential, and may vary based on a number of statutory and subjective factors. Citing another unpublished “proprietary” document, he also promised that MIB does not share any information collected over the phone with insurance companies.
Be sure to do your own cost-benefit analysis before ordering an MIB report. On one hand, the report is very helpful if you were recently turned down for insurance, or if your premiums seem abnormally high. On the other hand, you must yield some very sensitive data to MIB. Regardless, if you have not applied for life, health, or disability insurance within the past seven years, your MIB report will look like mine—empty.
www.mib.com Medical Information Bureau Site
(866) 692-6901- Consumer MIB Record Disclosure
(781) 751-6003- MIB Customer Service