HIPAA Notice of Privacy Practices
114 of 123 blocks carry cards. 54 cards.
Your information.
Your rights.
Our responsibilities.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
- This notice describes how medical information may be used and disclosed and how you can get access to it Legal Rights & Agreement Rules
Our privacy commitment
At Blue Shield of California, we understand the importance of keeping your personal information private, and we take our obligation to do so very seriously.
- This notice describes how medical information may be used and disclosed and how you can get access to it Legal Rights & Agreement Rules
In the normal course of doing business, we create records about you, your medical treatment, and the services we provide to you. The information in those records is called protected health information (“PHI”), which includes your Medical Information, as defined by California law, and Personally Identifiable Information (“PII”), such as your name, address, telephone number, and Social Security number, as well as your health information, such as healthcare diagnosis or claim information.
- PHI means records about you, your treatment and services, including Medical Information and identifiers Data Access & Collection
We are required by federal and state law to provide you with this notice of our legal duties and privacy practices as they relate to your PHI. We are required to maintain the privacy of your PHI and to notify you in the event that you are affected by a breach of unsecured PHI. When we use or give out (“disclose”) your PHI, we are bound by the terms of this notice, which applies to all records that we create, obtain, and/or maintain that contain your PHI.
- Blue Shield says the law requires this notice and that it is bound by the notice for all records containing your PHI Legal Rights & Agreement Rules
Blue Shield of California is an independent member of the Blue Shield Association A52389XLB_0125
- Blue Shield of California is an independent member of the Blue Shield Association; two form codes appear Legal Rights & Agreement Rules
H2819_25_077A_C Approved 02252025
- Blue Shield of California is an independent member of the Blue Shield Association; two form codes appear Legal Rights & Agreement Rules
Your rights
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you. For certain types of requests, you must complete a form that is available either by calling the Customer Service number on the back of your ID card or by visiting our website at https://www.blueshieldca.com/en/home/about-blue-shield/privacy-and-security/privacy-forms.
- Some rights requests require a form, available by phone or on the website Account & Service Control
Get a copy of your health and claims records
- You can ask for a copy of your health and claims records; usually within 30 days, possibly for a fee Account & Service Control
- You can ask to see or get a copy of your health and claims records and other health information we have about you. Ask us how to do this.
- You can ask for a copy of your health and claims records; usually within 30 days, possibly for a fee Account & Service Control
- We will provide a copy of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee for preparing, copying, and/or mailing it to you. In certain limited circumstances permitted by law, we may deny you access to a portion of your records.
- You can ask for a copy of your health and claims records; usually within 30 days, possibly for a fee Account & Service Control
- We likely do not have complete copies of your medical records. If you want to look at, or get a copy of, records we do not maintain, please contact your doctor or clinic.
Ask us to correct health and claims records
- You can ask Blue Shield to correct your records; it may say no in limited cases, with written reasons within 60 days Account & Service Control
- You can ask us to correct your health and claims records if you think they are incorrect or incomplete. Ask us how to do this.
- We may say “no” to your request in certain limited circumstances permitted by law, but we’ll tell you why in writing within 60 days.
- We likely do not have complete copies of your medical records. If you want to change records we do not maintain, please contact your doctor or clinic.
Request confidential communications
- You can ask to be contacted in a specific way or at another address; the request must be in writing Account & Service Control
- You can ask us to contact you regarding your confidential health information in a specific way (for example, home or office phone) or to send mail to a different address.
- You can ask to be contacted in a specific way or at another address; the request must be in writing Account & Service Control
- Your request must be in writing, and we will accommodate all requests for confidential communication in the form and format requested by you, if it is readily producible in the requested form and format, or at alternative locations. If your request involves a minor child, we may ask you to provide legal documentation to support your request.
- You can ask to be contacted in a specific way or at another address; the request must be in writing Account & Service Control
Ask us to limit what we use or share
- You can ask Blue Shield to limit use or sharing for treatment, payment or operations, but it need not agree Use & Processing
- You can ask us not to use or share certain health information to carry out treatment, payment, or our operations.
- We are not required to agree to your request, and we may say “no” if it would affect your care.
Your rights (continued)
Get a list of those with whom we’ve shared information
- You can ask for a list of disclosures of your health information over the past six years; one list a year is free Sharing & Disclosure
- You can ask for a list (“accounting”) of the times we’ve shared your health information for six years prior to the date you ask, and we will tell you what we shared, the date we shared it, who we shared it with, and why.
- We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
Get a copy of this privacy notice
- You can ask for a paper copy of this notice at any time Legal Rights & Agreement Rules
- You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.
- You can ask for a paper copy of this notice at any time Legal Rights & Agreement Rules
Choose someone to act for you
- You may name a personal representative; Blue Shield will check the person has authority before acting Account & Service Control
- You may name another person to act as your personal representative. Your representative will be allowed access to your PHI, to communicate with the healthcare professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf. Depending on the authority you grant your representative, he or she may also have authority to make healthcare decisions for you.
- You may name a personal representative; Blue Shield will check the person has authority before acting Account & Service Control
- We will make sure the person has this authority and can act for you before we take any action.
- You may name a personal representative; Blue Shield will check the person has authority before acting Account & Service Control
File a complaint if you feel your rights are violated
- You can raise questions or complaints about your privacy rights with Blue Shield Legal Rights & Agreement Rules
- Privacy Office contact details for questions or complaints about your privacy rights Legal Rights & Agreement Rules
- If you have questions about your privacy rights or feel we have violated your privacy rights, you may contact us at:
- You can raise questions or complaints about your privacy rights with Blue Shield Legal Rights & Agreement Rules
- Privacy Office contact details for questions or complaints about your privacy rights Legal Rights & Agreement Rules
Blue Shield of California Privacy Office
- Privacy Office contact details for questions or complaints about your privacy rights Legal Rights & Agreement Rules
P.O. Box 272540
- Privacy Office contact details for questions or complaints about your privacy rights Legal Rights & Agreement Rules
Chico, CA 95927-2540 Phone: (888) 266-8080 Hotline: (855) 296-9086 Fax: (800) 201-9020 E-mail: Privacy@blueshieldca.com
- Privacy Office contact details for questions or complaints about your privacy rights Legal Rights & Agreement Rules
- You can file a complaint with the Secretary for the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201, calling (877) 696-6775, emailing OCRComplaint@hhs.gov, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
- You can also file a complaint with the federal Office for Civil Rights Legal Rights & Agreement Rules
- We will not retaliate against you for filing a complaint.
- Blue Shield says it will not retaliate against you for filing a complaint Legal Rights & Agreement Rules
Your choices
For certain health information, you can tell us your choices about what we share and whether we share it. If you have a clear preference for how we share your information in the situations described below, tell us what you want us to do, and we will follow your instructions.
- You can tell Blue Shield not to share with family or others involved in your care or payment, or for fundraising Sharing & Disclosure
For these purposes, you have both the right and choice to tell us not to share your information:
- You can tell Blue Shield not to share with family or others involved in your care or payment, or for fundraising Sharing & Disclosure
- You can tell Blue Shield not to share with a Health Information Exchange such as Manifest Medex Sharing & Disclosure
- With your family, close friends, or others involved in your care or payment for your care
- In connection with fundraising efforts
- With a Health Information Exchange (“HIE”), such as Manifest Medex. HIEs help your health care providers and health plans securely review, analyze, and share medical information about you with the goals of improving the quality of your care, reducing medical errors, and preventing unnecessary and duplicative treatment. You may also opt out of this sharing of information by going to manifestmedex.org/opt-out/ or by calling (800) 490-7617.
- As otherwise set forth in this Notice
If you are not able to tell us your preference, for example, if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.
- You can tell Blue Shield not to share with family or others involved in your care or payment, or for fundraising Sharing & Disclosure
- Blue Shield may share information when needed to lessen a serious and imminent threat to health or safety Sharing & Disclosure
For these cases, we never share your information unless you give us written permission:
- For marketing and for sale of your information, Blue Shield says it never shares without your written permission Sharing & Disclosure
- Marketing purposes
- Sale of your information
Our uses and disclosures
How do we typically use or share your health information? We typically use or share your health information without your written authorization in the following ways.
- Blue Shield typically uses or shares your health information without written authorization in four ways Use & Processing
Help manage the health care treatment you receive
- Blue Shield may use your health information and share it with professionals treating you Sharing & Disclosure
- We can use your health information and share it with professionals who are treating you.
Example: A doctor sends us information about your diagnosis and treatment plan so we can arrange additional services.
- Blue Shield may use your health information and share it with professionals treating you Sharing & Disclosure
Run our organization
- Blue Shield may use and disclose your information to run its organization, including underwriting but not genetic data Use & Processing
- We can use and disclose your information to run our organization and contact you when necessary, including for underwriting purposes.
- Please note, however, that we will not use or disclose your PHI that is genetic information for underwriting purposes – doing so is prohibited by federal law.
Example: We use health information about you to develop better services for you.
- Blue Shield may use and disclose your information to run its organization, including underwriting but not genetic data Use & Processing
Pay for your health services
- Blue Shield may use and disclose your health information to pay for your health services Sharing & Disclosure
- We can use and disclose your health information as we pay for your health services.
Example: We share information about you with your dental plan to coordinate payment for your dental work.
- Blue Shield may use and disclose your health information to pay for your health services Sharing & Disclosure
Administer your plan
- Blue Shield may disclose your health information to your health plan sponsor for plan administration Sharing & Disclosure
- We may disclose your health information to your health plan sponsor for plan administration.
Example: Your company contracts with us to provide a health plan, and we provide your company with certain statistics to explain the premiums we charge.
- Blue Shield may disclose your health information to your health plan sponsor for plan administration Sharing & Disclosure
Our uses and disclosures (continued)
How else can we use or share your health information? We are allowed and required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research, without your written authorization. We must meet many conditions in the law before we can share your information for these purposes. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.
- Blue Shield says it is allowed and required to share information in other ways that serve the public good Sharing & Disclosure
- Blue Shield may share information for special government functions like national security, as the law allows Sharing & Disclosure
- Blue Shield may share information if state or federal law requires it, including with the federal health department Sharing & Disclosure
- Blue Shield may share information in response to a court or administrative order or a subpoena, as the law allows Sharing & Disclosure
Help with public health and safety issues
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- We may share health information about you for certain situations such as:
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- Preventing disease
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- Helping with product recalls
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- Reporting adverse reactions to medications
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- Reporting suspected abuse, neglect, or domestic violence
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- Assisting with disaster relief efforts
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
- Preventing or reducing a serious threat to anyone’s health or safety
- Blue Shield may share health information for public health and safety situations Sharing & Disclosure
Do research
- Blue Shield may use or share health information for research, but only as the law allows Use & Processing
- We may use or share your health information for health research, but only according to, and as allowed by, law.
Respond to organ and tissue donation requests and work with a medical examiner or funeral director
- Blue Shield may share information with organ procurement groups and, as law allows, coroners and funeral directors Sharing & Disclosure
- We may share health information about you with organ procurement organizations.
- We may share health information with a coroner, medical examiner, or funeral director when an individual dies, but only according to, and as allowed by, law.
Address workers’ compensation, law enforcement, and other government requests
- Blue Shield may share information for workers’ compensation, law enforcement and health oversight, as the law allows Sharing & Disclosure
- We may use or share health information about you:
- For workers’ compensation claims
- For law enforcement purposes or with a law enforcement official, but only according to, and as allowed by, law
- With health oversight agencies for activities authorized by law, but only according to, and as allowed by, law
- For special government functions such as military, national security, and presidential protective services, but only according to, and as allowed by, law
Comply with the law
- Blue Shield may share information if state or federal law requires it, including with the federal health department Sharing & Disclosure
- We may share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
Respond to lawsuits and legal actions
- Blue Shield may share information in response to a court or administrative order or a subpoena, as the law allows Sharing & Disclosure
- We may share health information about you in response to a court or administrative order, or in response to a subpoena, but only according to, and as allowed by, law.
Other than for the purposes described above, we must obtain your written authorization to use or disclose your PHI. For example, we will not use your PHI for marketing purposes, sell your PHI, nor use or disclose substance use disorder records or psychotherapy notes without your written authorization, except as expressly allowed by law.
- Otherwise Blue Shield needs your written authorization; it says it will not use PHI for marketing or sell it without one Use & Processing
You may cancel a written authorization that you previously gave us. When submitted to us in writing, the cancellation will apply to future uses and disclosures of your PHI. It will not affect uses or disclosures made previously, while your authorization was in effect.
- You may cancel a written authorization; the cancellation applies only to future uses and disclosures Use & Processing
Are there instances when we will not share your health information? We are not allowed to use or share the following types of health information without your written authorization unless otherwise allowed by law:
- Blue Shield says your health information cannot be used to investigate or penalize lawful reproductive health care Legal Rights & Agreement Rules
Reproductive health care
- Blue Shield says your health information cannot be used to investigate or penalize lawful reproductive health care Legal Rights & Agreement Rules
- Your health information cannot be used or disclosed to conduct any criminal, civil, or administrative investigation or impose any liability on you or anyone else, or identify you or anyone else in connection with seeking, obtaining, providing, or facilitating reproductive health care, provided that the reproductive health care is lawful under Federal law and the law of the state in which the reproductive health care is provided. Reproductive health care includes, but is not limited to, abortion-related services.
- Blue Shield says your health information cannot be used to investigate or penalize lawful reproductive health care Legal Rights & Agreement Rules
- Any of your health information relating to lawful abortion-related services will not be released in response to a subpoena, request, or court order, nor in cooperation with an inquiry or investigation by an individual or government entity in another state or a federal law enforcement agency, without your written authorization, except as expressly permitted or required by law.
- Any of your health information relating to you seeking, obtaining, providing, supporting, or aiding in the performance of a lawful abortion will not be disclosed, shared, or made available in an electronic health records system or through an HIE to any individual in another state, without your written authorization, except as expressly permitted or required by law.
Example: If you live in one state and travel to California to receive lawful reproductive health care, such as an abortion, we are not allowed to and will not share that information if someone tries to investigate you for obtaining that care. However, if we receive a lawful attestation from the person requesting it, we may disclose your PHI potentially related to reproductive health care (such as an abortion) for the following purposes:
- With a lawful attestation, Blue Shield may disclose information possibly related to reproductive care for four purposes Sharing & Disclosure
- Health oversight activities
- Judicial or administrative proceedings
- Law enforcement
- Coroner or medical examinations
Substance use disorder treatment
- Substance use disorder records are not used against you in proceedings without authorization or a qualifying court order Legal Rights & Agreement Rules
- Any substance use disorder treatment records will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you give written authorization, or unless a court orders the disclosure after giving you notice and an opportunity to object and the order is accompanied by a subpoena or other legal requirement compelling disclosure.
- Substance use disorder records are not used against you in proceedings without authorization or a qualifying court order Legal Rights & Agreement Rules
Example: If you are involved in a lawsuit and someone asks us for your substance use disorder treatment records, we will not provide them unless you tell us to in writing or a court orders it and issues a legal document requiring it.
- Substance use disorder records are not used against you in proceedings without authorization or a qualifying court order Legal Rights & Agreement Rules
Our responsibilities
- Blue Shield says it will promptly tell you if a breach may have compromised the privacy or security of your information Security & Safeguards
- We are required by law to maintain physical, technical, and administrative safeguards to ensure the privacy of your PHI. To protect your privacy, only Blue Shield workforce members who are authorized and trained are given access to our paper and electronic records and to non-public areas where this information is stored. Workforce members are trained on topics including:
- Privacy and data protection policies and procedures, including how paper and electronic records are labeled, stored, filed, and accessed
- Physical, technical, and administrative safeguards in place to maintain the privacy and security of your PHI
- Our corporate Privacy Office monitors how we follow our privacy policies and procedures and educates our organization on this important topic.
- We will obey any and all laws that require us to give you privacy protections, including HIPAA and any other federal or California privacy law. For example, there are special laws that protect some types of health information, such as, but not limited to, psychotherapy notes, reproductive and sexual health information, gender affirming care, mental health services, treatment for substance use disorders (SUD), genetic information, and HIV/AIDS testing and treatment. We will follow those laws. To the extent federal and California privacy laws set forth different standards for certain health information, we will apply the standard that affords your health information the greater degree of protection and security, unless otherwise required by law. Any disclosure of PHI beyond the provisions of the law is prohibited.
- Blue Shield says it will obey privacy laws, including HIPAA and California law, and special laws for sensitive data Legal Rights & Agreement Rules
- Where federal and California standards differ, Blue Shield applies the one that gives your information more protection Legal Rights & Agreement Rules
- We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
- We must follow the duties and privacy practices described in this notice and give you a copy of it.
- Blue Shield says it must follow the duties and privacy practices in this notice and give you a copy Legal Rights & Agreement Rules
- We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
- Please note that it is possible that information that we have properly disclosed pursuant to this Notice will be redisclosed by the recipient and, if so, it is no longer protected by the policies in this Notice.
For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.
- The notice points to a federal web page for more information on notices of privacy practices Legal Rights & Agreement Rules
Changes to the Terms of This Notice
- Blue Shield can change the notice and the changes apply to all information it has about you Legal Rights & Agreement Rules
We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, on our web site, and we will mail a copy to you.
- Blue Shield can change the notice and the changes apply to all information it has about you Legal Rights & Agreement Rules
Effective Date of this Notice: 05/21/2025
- This notice states an effective date of 05/21/2025 Legal Rights & Agreement Rules
Blue Shield of California Privacy Office P.O. Box 272540 Chico, CA 95927-2540 Phone: (888) 266-8080 Hotline: (855) 296-9086 Fax: (800) 201-9020 E-mail: Privacy@blueshieldca.com
- The notice repeats the Privacy Office mailing address, phone, hotline, fax and e-mail at its end Legal Rights & Agreement Rules