Can the Insurance Company See My Medical Records Without Permission in Texas?

By Ryan Orsatti, San Antonio personal injury attorney · Updated August 4, 2026

Quick Answer

Usually, the at-fault driver’s insurance company cannot obtain your medical records directly from a doctor merely by asking. It normally needs a valid written authorization, records you voluntarily provide, or lawful court process. Different rules may apply to your health insurer, workers’ compensation carrier, or records requested after a Texas personal injury lawsuit is filed. 

Ryan Orsatti Law helps injured people in San Antonio and across Texas evaluate medical-record requests and provide appropriate claim documentation without unnecessarily opening unrelated portions of their medical history.

Key Takeaways

• The at-fault driver’s liability insurer does not ordinarily have automatic access to your complete medical file.
• A broadly written medical authorization may allow disclosure of far more information than your current injuries require.
• Filing a lawsuit may allow the defense to obtain relevant medical records through discovery, subpoenas, or court orders.
• Texas workers’ compensation carriers have broader statutory access to claim-related treatment records.
• Revoking an authorization can stop future disclosures, but it generally cannot retrieve records already released.
• Ignoring a reasonable request for medical documentation can delay or undermine an injury claim. The better approach is usually a controlled, relevant disclosure.

Can the At-Fault Driver’s Insurance Company Get My Records Without My Permission?

The at-fault driver’s insurance company generally cannot call your doctor and obtain your medical records without a valid authorization or another lawful basis. The HIPAA Privacy Rule regulates disclosures by covered health care providers and health plans, while Texas Occupations Code § 159.002 protects physician communications and records concerning a patient’s identity, diagnosis, evaluation, and treatment. 

The insurance company may still ask you to:

• Sign a medical authorization
• Send medical records and itemized bills
• Identify your doctors and prior treatment
• Give a recorded statement about your injuries
• Explain whether you had similar symptoms before the accident

An adverse insurer, meaning the insurance company representing the person or business you say caused the injury, can review anything you or your lawyer voluntarily submit. HIPAA does not prevent an adjuster from asking questions or examining records already lawfully obtained.

That distinction matters. The issue is not whether the adjuster may evaluate your medical history. The issue is how the adjuster obtained the information and whether the request is reasonably limited to the injuries being claimed.

Insurance adjusters often request broad information early in a claim, sometimes during what appears to be a routine or friendly conversation. Our discussion of how insurance adjusters use early phone calls explains why seemingly simple requests can affect a later injury evaluation.

When Can an Insurance Company See Medical Records Without a New Authorization?

An insurer may receive medical information without a new authorization when another law permits the disclosure, the insurer already possesses the information through its role as a health plan, or a court-authorized discovery process applies. The answer therefore depends on which insurance company is requesting the records and why it wants them. 

Situation	Can records be obtained without a new authorization?	General rule
At-fault driver’s liability insurer before suit	Usually not directly from the provider	The insurer generally needs your authorization, records you provide, or another recognized legal basis
Your health insurance plan	Often, for permitted purposes	HIPAA allows certain disclosures for treatment, payment, and health care operations
Your PIP, MedPay, UM, or UIM insurer	Sometimes, depending on the policy and request	The carrier may require proof of loss and claim-related records, but that does not necessarily justify unrestricted access
Texas workers’ compensation carrier	Yes, for claim-related records	Texas Labor Code § 408.025 permits disclosure of records related to diagnosis, treatment, payment, or entitlement
Defendant after a lawsuit is filed	Potentially, through legal process	Relevant, nonprivileged records may be requested through discovery, a subpoena, or a court order
Records you already submitted	Yes	The insurer may use records, bills, photographs, statements, and other information voluntarily provided

Key takeaway: Before signing anything, identify which insurer is asking, what coverage is involved, and whether the request seeks records relevant to the claim or an unrestricted medical history.

What About My Health Insurance Company?

Your health insurer may receive and use medical information for treatment, payment, and health care operations without obtaining a new authorization for each transaction. For example, a provider may submit diagnoses, billing codes, and treatment information so the health plan can process a claim. 

That does not automatically give an unrelated automobile liability carrier access to the same information. Your health plan’s possession of records is different from disclosure to the insurer representing the driver who caused the crash.

Questions about health insurance, PIP, and responsibility for accident-related expenses are discussed further in our guide to who pays medical bills after a Texas car accident.

What About a Texas Workers’ Compensation Carrier?

A Texas workers’ compensation carrier has statutory access to certain records connected to the claimed workplace injury. Under Texas Labor Code § 408.025(d), a health care provider may disclose records relating to the diagnosis or treatment of the compensable injury without the employee’s authorization when the carrier needs the information to determine payment or entitlement to benefits. 

This exception is limited to the workers’ compensation system. It should not be treated as a general rule allowing every insurance adjuster unrestricted access to a person’s lifetime medical history.

What Should I Check Before Signing a Medical Authorization?

Before signing a medical authorization, confirm exactly what information may be released, which providers may release it, who will receive it, why it is requested, and when the authorization expires. Under Texas Occupations Code § 159.005, consent for physician records must be written, signed, and identify the information, purpose, and recipient. HIPAA authorizations also require specific descriptions and an expiration date or event. 

Use this checklist before signing:

1. Identify the recipient. The form should name the insurance company, law firm, records vendor, or other recipient.
2. Review the provider scope. Determine whether the authorization applies to one provider, specifically identified providers, or every provider who has ever treated you.
3. Limit the date range. A request for records from the accident date forward is materially different from a request covering your entire life.
4. Identify the conditions and body parts. The authorization should be reasonably related to the injuries being claimed, subject to legitimate questions about prior similar conditions.
5. Look for sensitive categories. Determine whether the form covers mental health treatment, psychotherapy notes, substance use treatment, reproductive care, genetic information, or other sensitive records.
6. Read the purpose provision. “Evaluating injuries from the collision” is narrower than “any purpose related to any claim.”
7. Check the expiration. Avoid a form that remains effective indefinitely or long after the claim ends.
8. Keep a complete copy. Save the signed form, any cover letter, and the date it was delivered.

A particularly important HIPAA rule is that the “minimum necessary” standard generally does not limit a disclosure made under an individual’s written authorization. If the authorization expressly permits release of the “entire medical record” or “complete patient file,” the provider may disclose that broad category. 

For that reason, the safest response is not always to refuse every authorization. A better response may be to revise the form, limit its scope, or have relevant records gathered and provided directly.

Can the Insurance Company Request Old or Unrelated Medical Records?

An insurance company may request older records when they could reasonably bear on causation, prior symptoms, the extent of an aggravation, or another disputed issue. A request does not mean the insurer is automatically entitled to every record, however, and a claimant should distinguish relevant prior treatment from unrelated medical history.

For example, earlier neck treatment may be relevant when a person claims a cervical injury after a rear-end collision. Ten-year-old dermatology or dental records usually have little connection to that issue unless unusual facts make them relevant.

A pre-existing condition does not automatically defeat a Texas personal injury claim. The real questions are whether the accident caused a new injury, aggravated an existing condition, or produced symptoms and limitations beyond the person’s prior baseline. Our article on pre-existing conditions in San Antonio personal injury claims explains how medical timelines and prior symptoms affect this analysis.

Attorney Insight

Adjusters commonly compare prior records against the claimant’s post-accident history. They look for treatment to the same body part, similar complaints, gaps in care, prior imaging, and alternative causes. The strongest response is often an accurate medical chronology with the relevant prior history addressed directly, not concealment and not an unrestricted lifetime authorization.

What Changes After a Texas Personal Injury Lawsuit Is Filed?

After a Texas personal injury lawsuit is filed, the defendant may seek relevant, nonprivileged medical records through formal discovery even if the injured person refuses to sign the insurer’s preferred authorization. Texas Occupations Code § 159.003 creates an exception to physician-patient confidentiality when a patient seeks monetary damages for a physical or mental condition and the records are relevant to that condition. 

Under the Texas Rules of Civil Procedure, parties may discover relevant, nonprivileged information. Rule 205 governs discovery from nonparties, including health care providers. A document subpoena ordinarily requires advance notice, and Rule 205 generally requires at least 10 days’ notice before service of a subpoena seeking production from a nonparty. 

HIPAA also permits disclosure in response to certain judicial proceedings. A provider may comply with a court order to the extent the order specifically authorizes disclosure. A subpoena that is not accompanied by a court order generally requires satisfactory assurances that the patient received notice and had an opportunity to object, or that a qualified protective order was obtained. 

Filing suit therefore changes the answer to the permission question. Your signature is no longer the only possible route to the records. Even then, requests can be challenged when they are irrelevant, excessively broad, unduly burdensome, or seek protected information beyond the issues in the case.

Can I Revoke a Medical Authorization After Signing It?

A medical authorization can generally be revoked in writing, but revocation usually stops only future disclosures. It does not require the insurance company to return records already lawfully obtained, and it does not undo actions taken by a provider or insurer in reasonable reliance on the authorization before receiving the revocation. 

A practical revocation should:

1. Identify the authorization and the date it was signed.
2. State clearly that it is revoked effective immediately.
3. Be delivered to every provider, records custodian, insurer, and records vendor that received the authorization.
4. Request written confirmation that no further records will be released under it.
5. Preserve proof of delivery.

Revoking an authorization does not eliminate the insurer’s legitimate right to evaluate an injury claim. The insurer may still ask you to provide relevant records or, after litigation begins, seek them through discovery.

Are Mental Health and Substance Use Records Treated Differently?

Psychotherapy notes and certain substance use disorder records may receive additional protection beyond ordinary medical records. Psychotherapy notes are notes kept separately by a mental health professional documenting or analyzing private counseling conversations, and HIPAA generally requires specific authorization before they are disclosed, subject to limited exceptions. 

Records maintained by federally assisted substance use disorder programs may also fall under 42 C.F.R. Part 2. Covered programs were required to comply with HHS’s updated Part 2 rule by February 16, 2026. Consent and court-order requirements may restrict both disclosure and later use of those records in legal proceedings. 

These protections do not necessarily make sensitive records completely unavailable. If a claimant affirmatively places a mental health condition at issue, some related information may become discoverable. The scope should be evaluated carefully before records are released or damages based on that condition are claimed.

What Should I Do If I Think My Records Were Released Improperly?

If you believe a provider released medical records without permission or another lawful basis, act promptly and preserve the paper trail. Ask the provider’s privacy officer for the authorization, subpoena, court order, or other authority relied upon, along with the date, recipient, and categories of information disclosed.

Recommended steps include:

• Request a copy of every authorization bearing your signature.
• Ask the provider for available disclosure documentation or an accounting of disclosures.
• Notify the provider and insurer in writing that the disclosure is disputed.
• Preserve emails, envelopes, portal messages, fax confirmations, and claim correspondence.
• File a complaint with the provider’s privacy officer when appropriate.
• Consider complaints to the Texas Attorney General’s patient privacy program or the HHS Office for Civil Rights.
• Obtain legal advice promptly if the disclosure caused harm or could affect pending litigation.

A HIPAA complaint generally must be submitted within 180 days after the person knew of the suspected violation, although HHS may extend the deadline for good cause. As of October 31, 2024, the Office for Civil Rights reported receiving 374,322 HIPAA complaints, resolving 99 percent of them, and obtaining corrective action in 31,191 investigated cases. 

Texas law may also provide remedies in some circumstances. Texas Occupations Code § 159.009 permits a person harmed by an unauthorized disclosure of physician records to seek injunctive relief and damages, but whether that section applies depends on the provider, records, disclosure, and surrounding facts. 

How Can a Texas Personal Injury Lawyer Handle Medical-Record Requests?

A Texas personal injury lawyer can determine which records are genuinely relevant, collect them directly, negotiate narrower authorization language, and challenge improper subpoenas or overly broad discovery. Counsel can also coordinate medical records with billing evidence, health insurance payments, liens, prior conditions, and the injuries actually placed at issue.

In a typical claim, the process may include:

1. Identifying every insurer and the coverage each one provides.
2. Collecting accident-related records and itemized bills.
3. Reviewing prior treatment involving the same symptoms or body parts.
4. Preparing a medical chronology that distinguishes prior conditions from post-accident changes.
5. Providing enough information for a fair claim evaluation without voluntarily disclosing unrelated history.
6. Reviewing subpoenas and filing objections or seeking a protective order when justified.
7. Preserving proof of what was provided, when it was provided, and under what authorization.

Medical-record requests often arrive with requests for broad interviews or recorded statements. Before responding, review our explanation of recorded statements in Texas insurance claims.

Ryan Orsatti Law helps injured people in San Antonio, Bexar County, and across Texas evaluate medical authorizations, insurance requests, pre-existing-condition issues, and discovery involving medical records. A consultation can help determine whether a request is routine, reasonably limited, or broader than the circumstances justify.

Frequently Asked Questions

Do I Have to Sign the Other Driver’s Medical Authorization in Texas?

You generally do not have to sign the at-fault driver’s insurance company’s preferred medical authorization before filing a lawsuit. The insurer may still require reasonable medical documentation before evaluating or paying an injury claim. Instead of granting unrestricted access, you may provide relevant records directly or negotiate an authorization limited by provider, date range, condition, and purpose.

Can the Insurance Company Get All My Medical Records After I File a Lawsuit?

Filing a lawsuit does not automatically make every medical record discoverable. The defense may obtain relevant, nonprivileged records concerning the injuries, causation, prior similar conditions, and claimed damages. Unrelated or excessively broad requests may be challenged under Texas discovery rules, although the court has authority to decide disputed scope and issue protective orders.

How Far Back Can an Insurance Company Request Medical Records?

There is no universal number of years that applies to every Texas personal injury claim. The reasonable period depends on the injury, prior symptoms, treatment history, and disputed issues. Records involving the same body part may be relevant farther back than unrelated care. Before suit, the insurer must still obtain the records through authorization or another lawful method.

Can I Revoke a Medical Authorization After the Insurer Receives My Records?

You may generally revoke a medical authorization in writing, but revocation does not retrieve information already disclosed or undo actions taken in reliance on the authorization. Send the revocation to the provider, insurer, and any records vendor. Keep proof of delivery and ask for written confirmation that no additional records will be released under that authorization.

Can an Insurance Company See My Mental Health Records?

An insurer does not automatically receive unrestricted access to mental health records. Ordinary treatment records may become relevant if a claimant seeks damages for psychological injuries, while separately maintained psychotherapy notes generally receive additional HIPAA protection. The proper scope depends on the damages claimed, the wording of any authorization, and whether litigation or a court order is involved.

Can My Health Insurance Company Share Records With an Auto Insurer?

Your health plan may use medical information for treatment, payment, and health care operations, but that does not automatically authorize disclosure of your complete file to an adverse auto insurer. A separate authorization, legal process, or other recognized basis may be required. Coordination can become more complicated when reimbursement, subrogation, PIP, MedPay, or UM/UIM coverage is involved.

What Happens If I Refuse to Provide Any Medical Records?

An injury claimant must ordinarily provide enough medical evidence for the insurer to evaluate whether the accident caused an injury and the amount of claimed damages. Refusing every request may delay or prevent a voluntary resolution. The issue is usually not whether to provide records, but which records are relevant and how to provide them without unnecessarily disclosing unrelated information.

Ryan Orsatti Law
4634 De Zavala Rd, San Antonio, TX 78249
Phone: 210-525-1200
ryanorsattilaw.com

This blog is for informational purposes only, not legal advice. Reading it does not create an attorney-client relationship. Past results do not guarantee future results.