An insurer may need medical information to assess an entitlement. At the same time, a request for years of medical records can go much further than expected. The appropriate response depends on the insurance type, purpose of the investigation and specific questions. If in doubt, have an insurance lawyer examine the request and possible consequences for your claim. This guide concerns data and the insurance procedure; medical assessment itself belongs to authorised medical professionals.
Sources (3)
On this page
1. Establish which assessment is taking place
Start with the letter requesting medical information. Does it concern an occupational disability claim, accident insurance, a health declaration for new insurance or reimbursement of care? Record the file number, requested documents and response date. Ask what decision the insurer intends to make using the information if the letter does not make this clear.
That context matters. Rules governing a health insurer’s statutory duties are not automatically the same as the procedure with a private accident insurer. A personal injury case against another person’s insurer also has its own position. Therefore show your lawyer the policy and original information request as well as the authorisation form.
2. Request specific questions and a period
A request for 'your complete medical records' says little about the information necessary. Ask which facts need investigation, which symptoms or limitations the request concerns and why the chosen period is relevant. A focused question helps your treating practitioner and the medical adviser assess the extent of disclosure.
The KNMG requires focused, factual questions when information is requested from treating practitioners. Complete records require particular justification. This does not mean information predating the loss event can never be relevant. For a broad request, have it examined whether a shorter period or targeted answers suffice. A lawyer can discuss this with an independent medical adviser without drawing medical conclusions themselves.
3. Check who receives medical data
Ask for the name or role of the medical adviser and address to which your practitioner should supply information. For private insurers, the KNMG describes a route through, or under the responsibility of, the medical adviser. Distinguish the medical records, medical opinion and information a claims handler needs to decide.
Therefore do not thoughtlessly attach sensitive documents to an ordinary email exchange with everyone involved. Ask about the agreed secure submission route and check the recipient. Keep what you sent and the accompanying explanation. If unclear, ask which employees receive access and for what purpose; a job title alone does not explain how your data are used.
4. Read consent and authorisation substantively
Check whether the form describes which practitioner may disclose data, to whom, for which purpose and for which period. A signature should not replace an explanation of the actual question. Discuss with your practitioner whether the requested information matches the consent you intend to give and clarify unclear wording before records are requested.
For disclosure by a treating practitioner to a private insurer’s medical adviser, specific consent is an important starting point. This does not mean consent is the only possible legal basis for every processing operation. The Dutch Data Protection Authority (AP), for example, points to health insurers’ statutory duties. Have your specific situation assessed rather than using one general consent form as the answer to every insurance question.
5. Respond carefully if the request is too broad
Your objection need not be limited to a general reference to privacy. Identify which part you consider excessive and why. For example, request an explanation of the link between an old treatment and the current insurance question. Propose answering focused factual questions first. This shows you wish to cooperate with an appropriate assessment of your entitlement.
A categorical refusal may complicate substantive assessment of your claim. Unlimited disclosure may also have unwanted consequences. If rejection threatens, therefore promptly discuss which information is still reasonably needed and which policy obligation the insurer relies on. Request sufficient time for consultation and confirmation of agreements; do not assume an objection automatically grants an extension.
6. Make your own medical data file easy to navigate
Keep the original questions, signed authorisation, any amended versions and confirmation of dispatch. For each disclosure, record date, sender, recipient and information type. Add medical opinions received and the insurance decision based on them. Keep this file separate and protected from general correspondence you might later share thoughtlessly with third parties.
Check factual details such as names, treatment dates and the period covered by the opinion. Identify a suspected error specifically and request correction or explanation through the appropriate route. An unfavourable professional assessment is not automatically inaccurate personal data. Where needed, have your lawyer and medical adviser clarify the difference between factual correction and substantive medical assessment.
7. Connect the privacy objection with the payment dispute
An objection to data use and an entitlement to payment can coexist. Ask the insurer whether the file can already be substantively assessed with available information. Also request an explanation of which missing information still prevents a decision. This avoids correspondence focusing solely on the form while the claim itself remains unaddressed.
The appropriate complaint route depends on the party and insurance involved. For processing by a health insurer, the AP mentions the SKGZ among others. A private insurance claim may follow a different route. Before submission, establish what you seek: narrowing a request, an explanation of disclosure, correction of an error or reassessment of a rejected payment.
8. Prepare a focused meeting with your lawyer
Bring the policy, medical information request, authorisation and most recent decision. Prepare a brief chronology and write down which part of disclosure you dispute. Your lawyer does not automatically need your entire medical history for an initial assessment. Ask which documents are necessary and how sensitive attachments can be supplied securely.
Discuss when an independent medical adviser is needed and associated costs. Request a specific next step: a more focused request, amended consent, consultation on necessary documents or a reasoned objection to the insurance decision. This connects your privacy question with progress in your case without promising a medical outcome or insurance payment in advance.
Frequently asked questions
Can an insurer always request my entire file?
No, complete records are not an automatic starting point. Ask about purpose, relevant period and specific justification. Whether more data are needed depends on the insurance and investigation.
Can I refuse all medical information?
A general refusal may impede assessment of your entitlement. Discuss which focused information is needed and promptly obtain legal assessment of the consequences for your claim.
Do the same rules apply to health insurers as to occupational disability insurance?
Not automatically. Health insurers also have statutory duties for which data are processed. Private occupational disability insurance has its own claims and information procedure. Check the specific basis and questions.
Sources
These sources relate to this page. For a specific case, check current rules and your own documents.
- KNMG — richtlijn Omgaan met medische gegevens, paragrafen 4.3.1 en 4.3.2 Accessed: 2026-10-23
- KNMG — informatie aan medisch adviseur verzekeraar Accessed: 2026-10-23
- Autoriteit Persoonsgegevens — zorgverzekeraars Accessed: 2026-10-23
Related articles
Legal review
Not legally reviewed yetThis version has not been reviewed by a lawyer or legal professional. Checking sources or editing text is not legal approval.
Editorial team Insurance law in the Netherlands
We connect explanations to sources and record targeted changes. Legal review is attributed only to the actual reviewed version, with a real reviewer, date and scope. Human legal review of these articles remains open.
Ricardo van der Spoel
Editorial responsibility · Editorial organisation and technology