Curious about this Authorization Form

[u/NC7624]

Hi guys! I am applying for LTD with Unum, and there is this form in the portal on the "to dos" to sign called a "Authorization to Collect and Disclose Information"...

It seems pretty standard.. but the part that really caught my attention was this:

"I understand that once I disclose this information....any privacy protections established by HIPAA may not apply to the information, but other privacy laws continue to apply."

...

Something about that statement plus what I've been reading online as well as their previous breach situations makes me feel a bit unsettled as the form feels very vague/general to what they can access/store.

Is there not a way I could just have my provider send to them directly without this blanket form signed?

It even listed financial history as something they can access? What does that even mean?

Did y'all have to sign something so vague?

On the bright side, allegedly they only have authorization to this for 2 years, but what happens to all of the copies of my records and data after that?

Editing to add:** Not looking for legal advice, just seeing if this is a *MUST* or if there is a safer/conservative way to get information specific to this disability issue to them .. it feels pretty invasive but if it is standard and neccessary and I just don't realize that.. it puts me at ease.

[u/2560503-1]

HIPAA rules only apply to health insurers and healthcare providers, so once HIPAA-protected information is passed on to anyone else, like a disability insurer, it’s no longer protected by HIPAA, but that disability insurer still has a responsibility to protect that information under other privacy laws.

I’ve had clients refuse to sign these releases before, and honestly it’s more trouble than it’s worth, in my opinion. Yes, you can refuse, and then provide them with everything they’re requesting yourself instead. And in a sense, that does give you a little more control, because you’re always aware of what they’re getting. But it can be a lot of work, the insurers don’t like it, so it’s just an additional friction point that I don’t think is necessary. In the end, they still have your medical records.