You sit down to fill out a health insurance application. Name, date of birth, address, a few medical history questions. You answer honestly. You hit submit.
What you don’t know is what happens by the time the underwriting system processes your form. It may have already queried two or three external databases you never filled out. From those, it builds a risk profile around you. It can include medications you’ve taken, neighborhoods you’ve lived in, and financial signals you’ve never thought of as health data. The form was formality. The real file was assembled before you started typing.
This is not speculation. It is how insurance underwriting works in the United States, and there is nothing in Indian regulations that prohibits it here.
How do health insurers profile you before you apply? In the US, underwriting systems query outside databases before setting your premium. LexisNexis Risk Solutions and Verisk sell consumer risk profiles built from public records and behavioral data. Milliman IntelliScript compiles your prescription-fill history from pharmacy benefit managers. Those queries happen before you’re quoted, often before the insurer contacts you at all. In the US you can request and dispute these reports under the Fair Credit Reporting Act. In the EU, GDPR gives you access rights. In India, the infrastructure exists but the guardrails are still thin.
The companies that sell your health risk score
In the US market, two companies sit at the center of pre-application health data collection: LexisNexis Risk Solutions and Verisk (through its Verisk Financial and analytics divisions). Both sell consumer risk profiles to insurers. These combine public records, address history, credit indicators, and in some products, behavioral signals inferred from purchasing data. These are not background check companies in the colloquial sense. They are underwriting intelligence platforms, and major US health and life insurers are their primary clients.
More pointed is Milliman IntelliScript, which compiles prescription fill history sourced from pharmacy benefit managers. When a US insurer wants to know what medications you’ve taken over the last several years, they don’t ask you. They query IntelliScript. The database is populated by PBMs, the intermediaries that process pharmacy claims. They license the data to Milliman, which resells access to insurers as a subscription product.
This covers prescriptions you filled. Opioid medications. Psychiatric medications. Diabetes and cardiovascular drugs. The fill record exists whether or not you disclosed the condition on your application. The query happens before you’re told your premium — often before you’ve received any communication from the insurer at all.
What the profile contains
The breadth of data that feeds into insurance risk models is wider than most people assume, and it extends well beyond clinical history.
Prescription fill history is the most direct signal. A diabetes medication fill pattern lets an insurer infer both the condition and, from fill frequency and dosage changes, how well-managed it is. The same logic applies to psychiatric prescriptions, pain management regimens, and chronic condition medications that application questions are designed to surface anyway.
Credit score and payment history appear counterintuitive as health indicators, but actuarial models have established a statistical correlation between financial stress and health outcomes. Whether it reflects causation or confounding doesn’t matter to the model. The correlation is commercially useful enough to include.
Home ownership status and neighborhood data are proxies for socioeconomic risk — and through that, health risk. Whether you live within walking distance of a gym or a fast food cluster is a real signal. It has appeared as a data point in experimental US insurer models. The data comes from location services companies that sell aggregated mobility patterns.
Social media activity has been piloted by some US insurers as a behavioral signal. The evidence that it adds underwriting value is contested. That hasn’t stopped the experimentation.
None of these inputs appear on your application form. Several of them you don’t think of as health-related data at all.
The India picture
Indian health insurers — Star Health, HDFC Ergo, Niva Bupa, Bajaj Allianz Health, and others — operate under IRDAI’s regulatory framework. IRDAI’s underwriting guidelines require disclosure of the criteria used to set premiums and decline applications. They do not prohibit third-party data purchases for underwriting. Whether Indian insurers currently buy data broker products for pre-application profiling is not publicly confirmed. IRDAI has not issued guidance restricting it. And the commercial incentive is identical to the one in markets where it’s already standard.
India’s DPDPA addresses consent and individual rights. Its rules were notified and its Data Protection Board stood up in late 2025. But 2026 is a phased soft-enforcement period, and its application to insurance underwriting data flows has not been tested. The risk isn’t that Indian insurers are definitely doing this. It’s that the infrastructure exists, the incentive is real, and the guardrails don’t.
The Star Health breach: why this matters doubly
In October 2024, reports emerged that personal data belonging to approximately 31 million Star Health Insurance customers had been offered for sale via a Telegram chatbot. The data reportedly included policy numbers, PAN numbers, medical claims information, and personal contact details. That is exactly the health-financial combination identity fraudsters value most, because it enables fraud across both systems at once.
The attacker claimed an insider had facilitated access. Star Health disputed this and said it was investigating. The data appeared online regardless.
What this illustrates is a compounding risk. The very data insurers collect to profile you — prescription history, medical claims, financial identifiers — is itself breach-exposed. Insurers are high-value targets precisely because of what they hold. The profile built on you before you apply is the same profile that surfaces on Telegram when the insurer is compromised.
Your rights, by jurisdiction
The rights available to you depend entirely on where you are.
In the United States, the Fair Credit Reporting Act (FCRA) classifies Milliman IntelliScript and similar pharmacy history databases as consumer reporting agencies. You have the right to request a free copy of your IntelliScript report and dispute inaccurate entries — request it at milliman.com/intelliscript. LexisNexis consumer reports are accessible via lexisnexis.com/consumer-disclosures. If you’ve been denied coverage or charged a higher premium, requesting these reports is where to start.
In the EU, GDPR Article 22 restricts fully automated decisions with legal or significant effects, unless there is meaningful human review. A premium determination likely qualifies. Article 15 gives you access to the personal data used in a decision about you, including its sources. Exercising this against an insurer requires a formal subject access request and persistence, but the right exists and courts have enforced it.
In India, IRDAI regulations allow you to request the underwriting rationale from your insurer. One thing DPDPA has not yet clarified is whether you can compel an insurer to disclose that it used third-party data broker inputs. Nor can you always force it to identify which ones. That gap needs explicit IRDAI guidance.
What you can do
If you’re in the US, request your LexisNexis consumer disclosure and your Milliman IntelliScript report. You have a legal right to both at no cost. Errors in these databases — a medication attributed to the wrong person, an outdated condition — can raise your premium without your knowledge.
Check your CIBIL report regularly. Credit data feeds insurance risk models in multiple markets. A payment history error that hurts you on a loan can hurt you again at underwriting.
If your premium increases without explanation, ask in writing what data was used in the decision. In India, frame this as a request for underwriting rationale under IRDAI guidelines. You may not get a complete answer — but the request creates a paper trail.
Be deliberate about app permissions. The data feeding insurer risk models is assembled from dozens of mundane sources: a pharmacy app, a fitness tracker, a grocery loyalty card. Each one is a feed.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.