When you report an accident, at the end of the claim form you typically sign a densely printed declaration: you release your treating doctors from medical confidentiality and authorise the insurer to obtain health data from wherever it was generated. As a broker, I see that most people sign this paragraph without reading it – and then, months later, when the insurer asks for their GP records or a hospital discharge summary from ten years earlier, they ask indignantly what that has to do with a broken ankle. The question is legitimate, and the answer is not black and white: the insurer has the right and the duty to verify the claim, but that right is purpose-bound. This article shows what the declaration authorises, where data can come from, where the limit lies, and what you can do if you feel a request goes beyond it.
- When you submit a claim for benefit, the insurer asks for your written consent to the processing of your health data: with it, you release your treating doctors from confidentiality and authorise the insurer to request data from healthcare providers and authorities – according to some forms, also from other insurers and from the social-security body.
- The authorisation is purpose-bound: under the insurance secrecy rules of the Insurance Act (Bit.) and the GDPR's data minimisation principle, the insurer may request what it needs to assess the reported claim – the request extends to your full medical history if, under the policy conditions, prior history affects the payout.
- Consent is voluntary and can be withdrawn, but under the Hungarian Civil Code (Ptk.), when you report an insured event you must provide the necessary information and allow verification: if a material circumstance remains impossible to establish because data is missing, the insurer's obligation does not arise.
What happens when you make a claim: the declaration you sign
Under Article 9 of the GDPR, health data is a special category of personal data, which the insurer may, as a general rule, process only with your explicit consent; Section 136 of Act LXXXVIII of 2014 on insurance activity, the Insurance Act (Bit.), requires this consent to be given in writing – the claims-handling privacy notices of Hungarian insurers refer to these rules. That is why the insurer asks for a separately signed declaration, and why simply sending in the claim form is not enough. The declaration typically contains three things. First, it releases your treating doctors and healthcare providers from confidentiality – under Section 25 of the Health Care Act (Act CLIV of 1997, Eütv.), medical confidentiality is the patient's right, over which they themselves may decide, and under Section 138 a healthcare worker's duty of confidentiality does not apply if the patient has given the waiver. Second, it authorises the insurer to request data from the treating provider, doctors and authorities – according to several forms, also from other insurers and from the social-security body; the exact scope varies from form to form. Third, you consent to the insurer passing the data on to a medical expert under contract with it and, in a court dispute, to the forensic medical expert appointed by the court. According to the claims-handling notice of one Hungarian insurer, data processed in this way is kept for twenty years after the contract ends and, in the event of a legal dispute, for five years after the proceedings are closed – this may vary from insurer to insurer, but this order of magnitude is common.
Where the limit lies: purpose limitation and data minimisation
The authorisation is not unlimited. Under the Insurance Act (Bit.), insurance secrecy covers all data relating to the client's personal circumstances – including their state of health – financial situation or contracts (Section 4(1) point 12), and under Section 135 the insurer may process such data only for purposes connected with the insurance contract, its conclusion, its administration and the provision of benefits; and under the data minimisation principle in Article 5 of the GDPR, only data that is necessary and relevant for the purpose may be requested. In practice, this means that in a bone-fracture claim the records of the treatment of the injury – outpatient record, X-ray report, discharge summary, follow-up – are the natural scope, as the article on the documents needed for an accident claim also describes. Prior-history data – GP records, earlier discharge summaries, medication list – may legitimately be requested if, under the policy conditions, prior history affects the payout: Hungarian personal accident conditions typically exclude or proportionately reduce the payout if an earlier illness contributed to the injury, and the line between accident and illness is also decided by prior history. In an osteoporotic fracture, a fall caused by a medical episode, or when the degree of permanent impairment is being determined, the insurer's question about your medical history is therefore not overreach but the application of the contract – this is explained in detail in the article on the contribution of a pre-existing illness. For a simple fracture with no prior history, however, requesting your full medical history is disproportionate, and you can raise this.
Where data can come from: doctors, other insurers, NEAK, EESZT
- The treating provider and the treating doctor. This is the primary source: with the waiver in hand, the insurer can request records or a medical opinion directly from the hospital or your GP. Under Section 24 of the Eütv., you also have the right, in your own name, to access your medical documentation and to obtain a copy – so in many cases it is simpler if you hand over the relevant records yourself, and the insurer does not need to request the entire file.
- Other insurers. Data requests between insurers may be based on your consent on the one hand and, on the other, on the purpose-bound data-exchange rules of the Bit. that serve to protect the risk pool; typically they check whether a claim has been submitted elsewhere for the same injury, and what prior history featured in earlier claims.
- The social-security body. Some forms also name the social-security body – NEAK, the Hungarian national health insurance fund; from there, with your authorisation, the insurer may request data on your use of healthcare services, for example when and where you received hospital or specialist care. This is not data at the level of medical findings, but the fact and date of the care and the diagnosis code reported.
- EESZT. The EESZT (the national e-health system) is a system of connected healthcare providers, pharmacies and the state bodies specified by law; as the claims-handling declarations show, a private insurer does not query the EESZT directly but requests data from the treating provider or doctor. EESZT data can therefore reach the insurer in two ways: through the treating provider, on the basis of the waiver, or from you, since you can download your own documents from the public portal (Lakossági portál). In the Digital Self-Determination (Digitális Önrendelkezés) menu, you can control which providers can see your data, and in the log you can see afterwards who has viewed it – this is also useful in a claim if you want to know what happened to your documents.
What can you refuse, and what are the consequences?
Consent is voluntary and, under Article 7 of the GDPR, can be withdrawn at any time; withdrawal does not affect the lawfulness of earlier processing. At the same time, the insurer states it frankly: without consent it cannot assess the claim for benefit – according to the claims-handling notice of one Hungarian insurer, in such a case “the provision of the benefit is not possible”. The legal background to this is Section 6:453 of the Ptk.: when an insured event is reported, the necessary information must be provided and it must be made possible to verify the content of the report; if the policyholder fails to do so and, as a result, a material circumstance cannot be established, the insurer's obligation does not arise. Refusal therefore does not lead to automatic rejection, but if, without the missing data, the accidental origin or the prior history cannot be clarified, then under the Ptk. the insurer's obligation does not arise – so you bear the consequences of the gap, since it is for the person claiming the benefit to prove that the insured event has occurred.
The workable route is not “yes or no” but narrowing the request. You can ask the insurer to state in writing which data it is requesting, for what purpose and with reference to which clause of the conditions – under Article 15 of the GDPR, you also have the right to find out what it has collected about you and from whom. You can offer to hand over the relevant records yourself instead of the full file. If the request is disproportionate, you can lodge a complaint with the data protection authority (NAIH), while the substantive dispute over the claim – as described in the article on stuck or disputed claims – is decided, after the insurer's complaints procedure, by the Financial Arbitration Board (PBT) or the court; the MNB (Hungary's central bank and financial supervisor) does not decide individual claims disputes.
What should you do in practice?
Before submitting your claim, read the declaration and check which bodies it names – if there is anything you do not understand, ask the insurer before you sign it. Collect the records of the injury yourself, following the medical document checklist, and submit them together with your claim: the more complete the first round, the less reason the insurer will have to request prior history. If it nevertheless requests prior-history data, ask which clause of the conditions the request is based on – and if, under the conditions, the prior history really does matter, handing over the data is also in your interest, because without it the claim will stall. As a broker, in a stuck or disputed case I help where I can, acting on your behalf; only you, however, can decide about your data – no one can take this decision over from you. The insurer pays only for what is an insured event under your contract – and it can establish this only if it sees the health data that goes with it.
Have a question specific to your own claim? Run the numbers in minutes with the online calculator (in Hungarian), or book a free 20-minute consultation →
Sources
- Alfa Vienna Insurance Group Biztosító – Information notice and declaration on the processing of health data during claims handling (A07-K)
- Insurance Act (Bit., Act LXXXVIII of 2014) Section 4(1) point 12, Sections 135–136 – definition of insurance secrecy, purpose-bound data processing, processing of health data with written consent
- Health Care Act (Eütv., Act CLIV of 1997) Sections 24, 25 and 138 – access to medical documentation, medical confidentiality, duty of confidentiality
- Eüak. (Act XLVII of 1997) – processing of health data and related personal data, EESZT rules
- Hungarian Civil Code (Ptk., Act V of 2013) Section 6:453 – reporting the insured event, providing information, verification
- GDPR (Regulation (EU) 2016/679) Articles 5, 7, 9 and 15 – data minimisation, withdrawal of consent, special categories of data, right of access
- EESZT public portal (Lakossági portál) – Digital Self-Determination (Digitális Önrendelkezés)
