Who Sees Your Medical Quote Request? Questions to Ask About Sharing and Privacy

A medical quote request feels like a private note to one clinic. In practice it may pass through several hands before anyone answers it: a website form, a coordinator, one or more clinics, and eventually the clinician and their team. None of that is sinister. It’s how routing works. But each hand-off is a place where you are entitled to ask who sees your information, why, and for how long. This guide covers the questions worth asking, the laws that may or may not protect you, and how to share only what each stage needs.

Map the path your request can travel

Before you ask privacy questions, it helps to picture the route. A typical request abroad moves through some version of this chain:

1. The intake point: a website form, a facilitator’s WhatsApp, or a clinic’s own contact page.
2. Routing: someone decides which provider or providers should see the case. On a referral site, that may mean your inquiry goes to more than one clinic.
3. The clinic’s coordinator: usually the first person at the clinic to read it, often on a phone or shared inbox.
4. The clinical team: the specialist reviewing your case, and possibly an anaesthetist, a radiologist, a lab or a translator.
5. Storage: spreadsheets, email archives, chat histories and the clinic’s own records system.

Every step is legitimate if it’s needed to answer your request. The aim isn’t to stop the flow. It’s to know where it goes, and to keep sensitive material out of the stages that don’t need it.

Which privacy rules might apply, and which might not

Many patients assume their health information is protected the same way everywhere. It isn’t, and the protection often depends on who is holding the data rather than what the data is.

US patients: HIPAA has a defined scope

HIPAA applies to “covered entities” and their business associates. According to the US Department of Health and Human Services (page reviewed 2024), covered entities are health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with certain standard transactions. HHS states that an organisation that is neither a covered entity nor a business associate doesn’t have to comply with the HIPAA Rules. In practice, that means a quote website, a medical travel facilitator or a clinic abroad may not be bound by HIPAA at all, so don’t assume it applies. Ask what rules they do follow.

A separate US rule can apply to some non-HIPAA businesses. The Federal Trade Commission’s Health Breach Notification Rule guidance (updated 2026) covers vendors of personal health records and related companies that aren’t covered by HIPAA. The FTC is explicit that a “breach” isn’t limited to hacking: sharing health data with a third party without the person’s authorisation can count. The rule is narrow and won’t cover every quote service, but it shows the direction of travel: consent to share is the line regulators look at.

Colombia: health data is “sensitive data”

Colombia’s data protection law, Ley 1581 de 2012, lists data relating to health among its categories of sensitive data (Article 5). Processing sensitive data is generally prohibited unless an exception applies, the first being the data subject’s explicit authorisation (Article 6). The law gives individuals rights including to know, update and correct their data, to request proof of the authorisation they gave, to be told on request how their data has been used, and to complain to the Superintendencia de Industria y Comercio (Article 8). It also restricts transfers of personal data to countries without adequate protection, with exceptions that include the person’s express and unequivocal authorisation (Article 26).

This is a summary for orientation, not legal advice. The practical point is simple: when a Colombian clinic or service asks you to tick a consent box, that consent is doing real legal work, so read what it covers.

Questions to ask before you submit a request

Whether you use a referral site, a facilitator or a clinic’s own form, these questions are fair to ask in writing. A good service will answer them without hesitation. This site explains its own handling in what we do with your information; use the list below for anyone else.

• Who receives my request? One clinic, or several? Named in advance, or chosen after I submit?
• How many providers, exactly? If the consent wording sets a limit, what happens if none of them is a good fit?
• Is the service paid by the providers? A paid introduction isn’t wrong, but it is worth knowing when you weigh any recommendation.
• Where is my information stored, and for how long?
• How do I withdraw consent or ask for deletion, and does deletion reach the providers who already received my request?
• Will anyone contact me by phone or WhatsApp, and can I choose email only?

Questions to ask the clinic once you are matched

Once a specific clinic is handling your case, the questions shift from routing to clinical handling. The CDC Yellow Book (2026 edition) lists, among its questions for a facility abroad, whether it has formal policies protecting the privacy and security of medical records. Build on that:

• Which channel should I use to send records and images: a portal, an encrypted upload link, email or WhatsApp?
• Who at the clinic will see them, and will they be shared with anyone outside it, such as an outside lab, radiologist or translator?
• Once files reach the clinic, are they moved into the clinical record and deleted from staff phones and chat accounts?
• Will any photo of me be used for teaching, social media or before-and-after marketing? If so, is there a separate consent I can decline?
• How long will you keep my records if I don’t go ahead with treatment?

Share in layers: what each stage actually needs

The best privacy tool is not sending what isn’t needed yet. A layered approach keeps the first contact light and moves detail to the clinic only when it is handling your case.

A tidy one-page case summary helps here: it lets a clinic judge your case without your sending the whole file, and you can list records instead of attaching them.

Messaging apps: convenient, but think about where files end up

WhatsApp is how many clinics communicate, and it’s often the fastest route to an answer. The privacy question is less about the app and more about what happens next. Images sent in a chat may sit in a coordinator’s phone gallery, a shared business account or a backup. Before sending anything sensitive by chat, ask whether the clinic has a more formal upload route, and if not, what it does with files once they arrive.

Referral service or direct contact?

Contacting a clinic yourself means fewer hands, but also only one opinion. Using a referral service means your request may go to several providers, which is the point, but also means more people see it. Neither is automatically more private. What matters is whether you know, before you click, exactly who will receive your request. For the wider trade-off, see requesting through us vs contacting clinics yourself.

If something goes wrong

If you think your information was shared beyond what you agreed to, start by writing to the service or clinic and asking exactly what was shared, with whom and when. Keep a copy of the consent wording you agreed to. In Colombia, Ley 1581 gives data subjects the right to complain to the Superintendencia de Industria y Comercio. In other countries, the relevant regulator depends on where the business is based and what kind of business it is.

Sources

This site provides general information and lead-routing services, not medical advice. Provider introductions may be compensated. Verify credentials, facility status, pricing and clinical recommendations independently. Do not delay urgent or necessary medical care because of information on this site.