This notice describes how medical information may be used and disclosed and how you can get access to it
The notice opens with a capitalized statement that it describes how medical information about you may be used and disclosed and how you can get access to this information, and asks you to review it carefully. Blue Shield of California says it understands the importance of keeping your personal information private and takes its obligation to do so very seriously.
Supporting quotations
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
At Blue Shield of California, we understand the importance of keeping your personal information private, and we take our obligation to do so very seriously.
Legal Rights & Agreement Rules · Company commitment
Blue Shield says the law requires this notice and that it is bound by the notice for all records containing your PHI
Blue Shield says federal and state law require it to give you this notice of its legal duties and privacy practices for your PHI, to maintain the privacy of your PHI, and to notify you if you are affected by a breach of unsecured PHI. It says that when it uses or discloses your PHI it is bound by the terms of the notice, and that the notice applies to all records it creates, obtains, and/or maintains that contain your PHI.
Supporting quotations
We are required by federal and state law to provide you with this notice of our legal duties and privacy practices as they relate to your PHI.
We are required to maintain the privacy of your PHI and to notify you in the event that you are affected by a breach of unsecured PHI.
we are bound by the terms of this notice, which applies to all records that we create, obtain, and/or maintain that contain your PHI.
Not stated here
This passage does not name the federal and state laws it refers to.
Data Access & Collection · Context
PHI means records about you, your treatment and services, including Medical Information and identifiers
Blue Shield says it creates records about you, your medical treatment and the services it provides to you in the normal course of business. It calls the information in those records protected health information (PHI). PHI includes your Medical Information as defined by California law and Personally Identifiable Information (PII) such as your name, address, telephone number and Social Security number, as well as health information such as healthcare diagnosis or claim information.
Supporting quotations
In the normal course of doing business, we create records about you, your medical treatment, and the services we provide to you. The information in those records is called protected health information (“PHI”), which includes your Medical Information, as defined by California law, and Personally Identifiable Information (“PII”), such as your name, address, telephone number, and Social Security number, as well as your health information, such as healthcare diagnosis or claim information.
Qualifications & exceptions
Medical Information is used as defined by California law.
The lists introduced by "such as" are examples, not a complete list.
Not stated here
The California-law definition of Medical Information is not part of this source.
Legal Rights & Agreement Rules · Context
Blue Shield of California is an independent member of the Blue Shield Association; two form codes appear
One line states that Blue Shield of California is an independent member of the Blue Shield Association and carries the code A52389XLB_0125. A second line reads "H2819_25_077A_C Approved 02252025". The notice does not explain what the codes mean or how that approval line relates to the effective date given at the end of the notice.
Supporting quotations
Blue Shield of California is an independent member of the Blue Shield Association A52389XLB_0125
H2819_25_077A_C Approved 02252025
Not stated here
What the form codes mean is not stated.
How "Approved 02252025" relates to the effective date of 05/21/2025 stated at the end of the notice is not explained.
Account & Service Control · Procedure
Some rights requests require a form, available by phone or on the website
Blue Shield says this section explains your rights over your health information and some of its responsibilities. For certain types of requests you must complete a form, which is available by calling the Customer Service number on the back of your ID card or by visiting the privacy forms page of its website.
Supporting quotations
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you. For certain types of requests, you must complete a form that is available either by calling the Customer Service number on the back of your ID card or by visiting our website at https://www.blueshieldca.com/en/home/about-blue-shield/privacy-and-security/privacy-forms.
Qualifications & exceptions
Only "certain types of requests" require a form.
Not stated here
This passage does not say which requests need a form.
Account & Service Control · User right or choice
You can ask for a copy of your health and claims records; usually within 30 days, possibly for a fee
You can ask to see or get a copy of the health and claims records and other health information Blue Shield has about you. Blue Shield says it will provide a copy of your health and claims records usually within 30 days of your request. It may charge a reasonable, cost-based fee for preparing, copying, and/or mailing it. In certain limited circumstances permitted by law, it may deny you access to a portion of your records.
Supporting quotations
Get a copy of your health and claims records
You can ask to see or get a copy of your health and claims records and other health information we have about you. Ask us how to do this.
We will provide a copy of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee for preparing, copying, and/or mailing it to you. In certain limited circumstances permitted by law, we may deny you access to a portion of your records.
Qualifications & exceptions
The copy is provided "usually" within 30 days of the request.
A reasonable, cost-based fee may be charged for preparing, copying, and/or mailing.
Access to a portion of the records may be denied in certain limited circumstances permitted by law.
Not stated here
The limited circumstances in which access may be denied are not listed.
Account & Service Control · Restriction or exception
Blue Shield likely lacks your complete medical records; for those it does not hold, contact your doctor or clinic
In both the copy right and the correction right, Blue Shield says it likely does not have complete copies of your medical records. If you want to look at, get a copy of, or change records it does not maintain, it says to contact your doctor or clinic.
Supporting quotations
We likely do not have complete copies of your medical records. If you want to look at, or get a copy of, records we do not maintain, please contact your doctor or clinic.
We likely do not have complete copies of your medical records. If you want to change records we do not maintain, please contact your doctor or clinic.
Qualifications & exceptions
The statement is about records Blue Shield does not maintain.
You can ask Blue Shield to correct your records; it may say no in limited cases, with written reasons within 60 days
You can ask Blue Shield to correct your health and claims records if you think they are incorrect or incomplete. Blue Shield may say "no" to the request in certain limited circumstances permitted by law, but says it will tell you why in writing within 60 days.
Supporting quotations
Ask us to correct health and claims records
You can ask us to correct your health and claims records if you think they are incorrect or incomplete.
We may say “no” to your request in certain limited circumstances permitted by law, but we’ll tell you why in writing within 60 days.
Qualifications & exceptions
A refusal is allowed only in certain limited circumstances permitted by law.
Not stated here
The circumstances in which Blue Shield may refuse are not listed.
The sentence does not say what the 60 days is counted from.
Account & Service Control · User right or choice
You can ask to be contacted in a specific way or at another address; the request must be in writing
You can ask Blue Shield to contact you about your confidential health information in a specific way, for example home or office phone, or to send mail to a different address. The request must be in writing. Blue Shield says it will accommodate all requests for confidential communication in the form and format you request if it is readily producible in that form and format, or at alternative locations. If the request involves a minor child, it may ask you for legal documentation to support the request.
Supporting quotations
Request confidential communications
You can ask us to contact you regarding your confidential health information in a specific way (for example, home or office phone) or to send mail to a different address.
Your request must be in writing, and we will accommodate all requests for confidential communication in the form and format requested by you, if it is readily producible in the requested form and format, or at alternative locations. If your request involves a minor child, we may ask you to provide legal documentation to support your request.
Qualifications & exceptions
The request must be in writing.
Blue Shield commits to accommodate requests in the requested form and format if it is readily producible in that form and format, or at alternative locations.
If the request involves a minor child, Blue Shield may ask for legal documentation.
Not stated here
The notice does not define when a form or format is "readily producible".
Use & Processing · User right or choice
You can ask Blue Shield to limit use or sharing for treatment, payment or operations, but it need not agree
You can ask Blue Shield not to use or share certain health information to carry out treatment, payment, or its operations. Blue Shield says it is not required to agree to your request, and that it may say "no" if agreeing would affect your care.
Supporting quotations
Ask us to limit what we use or share
You can ask us not to use or share certain health information to carry out treatment, payment, or our operations.
We are not required to agree to your request, and we may say “no” if it would affect your care.
Qualifications & exceptions
Blue Shield is not required to agree to the request.
Blue Shield may refuse if the request would affect your care.
Sharing & Disclosure · User right or choice
You can ask for a list of disclosures of your health information over the past six years; one list a year is free
You can ask for a list (an "accounting") of the times Blue Shield has shared your health information in the six years before the date you ask. Blue Shield says it will tell you what it shared, the date, who it shared it with, and why. The list will include all disclosures except those about treatment, payment and health care operations and certain other disclosures, such as any you asked it to make. It provides one accounting a year for free and will charge a reasonable, cost-based fee if you ask for another one within 12 months.
Supporting quotations
Get a list of those with whom we’ve shared information
You can ask for a list (“accounting”) of the times we’ve shared your health information for six years prior to the date you ask, and we will tell you what we shared, the date we shared it, who we shared it with, and why.
We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
Qualifications & exceptions
The list excludes disclosures for treatment, payment, and health care operations, and certain other disclosures such as any you asked Blue Shield to make.
One accounting a year is free; a reasonable, cost-based fee applies to another request within 12 months.
Not stated here
"Certain other disclosures" beyond the example given are not listed.
Legal Rights & Agreement Rules · User right or choice
You can ask for a paper copy of this notice at any time
You can ask for a paper copy of this notice at any time, even if you agreed to receive the notice electronically. Blue Shield says it will provide you with a paper copy promptly.
Supporting quotations
Get a copy of this privacy notice
You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.
Not stated here
"Promptly" is not tied to a number of days.
Account & Service Control · User right or choice
You may name a personal representative; Blue Shield will check the person has authority before acting
You may name another person to act as your personal representative. Blue Shield says your representative will be allowed access to your PHI, to communicate with the healthcare professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf. Depending on the authority you grant, the representative may also have authority to make healthcare decisions for you. Blue Shield says it will make sure the person has this authority and can act for you before it takes any action.
Supporting quotations
Choose someone to act for you
You may name another person to act as your personal representative. Your representative will be allowed access to your PHI, to communicate with the healthcare professionals and facilities providing your care, and to exercise all other HIPAA rights on your behalf. Depending on the authority you grant your representative, he or she may also have authority to make healthcare decisions for you.
We will make sure the person has this authority and can act for you before we take any action.
Qualifications & exceptions
Authority to make healthcare decisions depends on the authority you grant the representative.
Not stated here
The notice does not describe how you name a representative or what proof of authority Blue Shield accepts.
Legal Rights & Agreement Rules · User right or choice
You can raise questions or complaints about your privacy rights with Blue Shield
Under a heading about filing a complaint if you feel your rights are violated, Blue Shield says that if you have questions about your privacy rights or feel it has violated them, you may contact it. The contact details for the Blue Shield Privacy Office follow in the next part of the notice.
Supporting quotations
File a complaint if you feel your rights are violated
If you have questions about your privacy rights or feel we have violated your privacy rights, you may contact us at:
Legal Rights & Agreement Rules · Procedure
Privacy Office contact details for questions or complaints about your privacy rights
If you have questions about your privacy rights or feel Blue Shield has violated them, you may contact the Blue Shield of California Privacy Office by mail at P.O. Box 272540, Chico, CA 95927-2540, by phone at (888) 266-8080, on its hotline at (855) 296-9086, by fax at (800) 201-9020, or by e-mail at Privacy@blueshieldca.com.
Supporting quotations
File a complaint if you feel your rights are violated
If you have questions about your privacy rights or feel we have violated your privacy rights, you may contact us at:
Legal Rights & Agreement Rules · User right or choice
You can also file a complaint with the federal Office for Civil Rights
You can file a complaint with the Secretary of the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201, calling (877) 696-6775, emailing OCRComplaint@hhs.gov, or visiting the complaints page at www.hhs.gov/ocr/privacy/hipaa/complaints/.
Supporting quotations
You can file a complaint with the Secretary for the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201, calling (877) 696-6775, emailing OCRComplaint@hhs.gov, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
Legal Rights & Agreement Rules · Company commitment
Blue Shield says it will not retaliate against you for filing a complaint
Blue Shield says it will not retaliate against you for filing a complaint.
Supporting quotations
We will not retaliate against you for filing a complaint.
Not stated here
The sentence does not say whether this covers complaints made to Blue Shield, to the federal Office for Civil Rights, or both.
Sharing & Disclosure · User right or choice
You can tell Blue Shield not to share with family or others involved in your care or payment, or for fundraising
For certain health information you can tell Blue Shield your choices about what it shares and whether it shares it. If you have a clear preference in the situations described, Blue Shield says you should tell it what you want and it will follow your instructions. The notice says you have both the right and choice to tell it not to share your information with your family, close friends or others involved in your care or payment for your care, and in connection with fundraising efforts. A further item in the same list reads "As otherwise set forth in this Notice". If you cannot tell Blue Shield your preference, for example if you are unconscious, it may go ahead and share if it believes that is in your best interest.
Supporting quotations
For certain health information, you can tell us your choices about what we share and whether we share it. If you have a clear preference for how we share your information in the situations described below, tell us what you want us to do, and we will follow your instructions.
For these purposes, you have both the right and choice to tell us not to share your information:
With your family, close friends, or others involved in your care or payment for your care
In connection with fundraising efforts
As otherwise set forth in this Notice
If you are not able to tell us your preference, for example, if you are unconscious, we may go ahead and share your information if we believe it is in your best interest.
Qualifications & exceptions
Applies to "certain health information" and the situations described in the list.
Exception: if you are not able to tell Blue Shield your preference, for example if you are unconscious, it may go ahead and share if it believes it is in your best interest.
Not stated here
The item "As otherwise set forth in this Notice" does not say which other sharing you can tell Blue Shield not to do.
Sharing & Disclosure · User right or choice
You can tell Blue Shield not to share with a Health Information Exchange such as Manifest Medex
Among the choices listed, you can tell Blue Shield not to share your information with a Health Information Exchange (HIE), such as Manifest Medex. The notice says HIEs help your health care providers and health plans securely review, analyze and share medical information about you, with the goals of improving the quality of your care, reducing medical errors and preventing unnecessary and duplicative treatment. It adds that you may also opt out of this sharing through the Manifest Medex opt-out page or by calling (800) 490-7617.
Supporting quotations
For these purposes, you have both the right and choice to tell us not to share your information:
With a Health Information Exchange (“HIE”), such as Manifest Medex. HIEs help your health care providers and health plans securely review, analyze, and share medical information about you with the goals of improving the quality of your care, reducing medical errors, and preventing unnecessary and duplicative treatment. You may also opt out of this sharing of information by going to manifestmedex.org/opt-out/ or by calling (800) 490-7617.
Qualifications & exceptions
The listed opt-out routes are the Manifest Medex web page and phone number.
Not stated here
Manifest Medex is given as an example ("such as"); other exchanges, if any, and how to opt out of them are not listed.
Sharing & Disclosure · Permission or license
Blue Shield may share information when needed to lessen a serious and imminent threat to health or safety
Blue Shield says it may also share your information when needed to lessen a serious and imminent threat to health or safety. This appears alongside the statement that, if you cannot tell it your preference, it may share information it believes is in your best interest, but the threat sentence does not itself say it applies only when you cannot state a preference.
Supporting quotations
If you are not able to tell us your preference, for example, if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.
Qualifications & exceptions
Applies when sharing is "needed" to lessen a "serious and imminent" threat.
Not stated here
The notice does not say to whom information may be shared in this situation.
For marketing and for sale of your information, Blue Shield says it never shares without your written permission
In a list of cases where the notice says Blue Shield never shares your information unless you give written permission, two items are named: marketing purposes and sale of your information.
Supporting quotations
For these cases, we never share your information unless you give us written permission:
Marketing purposes
Sale of your information
Qualifications & exceptions
The rule is stated as "never ... unless you give us written permission".
Not stated here
A later sentence about authorization ends with "except as expressly allowed by law"; whether that exception reaches marketing and sale is not stated.
Use & Processing · Permission or license
Blue Shield typically uses or shares your health information without written authorization in four ways
Under the heading about its uses and disclosures, Blue Shield says it typically uses or shares your health information without your written authorization in the following ways. The four described are helping manage your treatment, running its organization, paying for your health services, and administering your plan.
Supporting quotations
We typically use or share your health information without your written authorization in the following ways.
Qualifications & exceptions
Described as how Blue Shield "typically" uses or shares information; other uses appear later in the notice.
Sharing & Disclosure · Permission or license
Blue Shield may use your health information and share it with professionals treating you
Blue Shield says it can use your health information and share it with professionals who are treating you. It gives the example of a doctor sending Blue Shield information about your diagnosis and treatment plan so it can arrange additional services.
Supporting quotations
Help manage the health care treatment you receive
We can use your health information and share it with professionals who are treating you.
Example: A doctor sends us information about your diagnosis and treatment plan so we can arrange additional services.
Use & Processing · Permission or license
Blue Shield may use and disclose your information to run its organization, including underwriting but not genetic data
Blue Shield says it can use and disclose your information to run its organization and contact you when necessary, including for underwriting purposes. It says it will not use or disclose PHI that is genetic information for underwriting, which it notes federal law prohibits. The example given is using health information about you to develop better services for you.
Supporting quotations
Run our organization
We can use and disclose your information to run our organization and contact you when necessary, including for underwriting purposes.
Please note, however, that we will not use or disclose your PHI that is genetic information for underwriting purposes – doing so is prohibited by federal law.
Example: We use health information about you to develop better services for you.
Qualifications & exceptions
Exception: PHI that is genetic information will not be used or disclosed for underwriting purposes.
The notice says doing so is prohibited by federal law.
Not stated here
The notice does not say what "run our organization" covers beyond the examples given.
Use & Processing · Restriction or exception
Blue Shield will not use or disclose genetic information in your PHI for underwriting
Blue Shield says it will not use or disclose your PHI that is genetic information for underwriting purposes and notes that federal law prohibits doing so. This limits the permission to use information for underwriting when running its organization.
Supporting quotations
Please note, however, that we will not use or disclose your PHI that is genetic information for underwriting purposes – doing so is prohibited by federal law.
Blue Shield may use and disclose your health information to pay for your health services
Blue Shield says it can use and disclose your health information as it pays for your health services. The example given is sharing information about you with your dental plan to coordinate payment for your dental work.
Supporting quotations
Pay for your health services
We can use and disclose your health information as we pay for your health services.
Example: We share information about you with your dental plan to coordinate payment for your dental work.
Sharing & Disclosure · Permission or license
Blue Shield may disclose your health information to your health plan sponsor for plan administration
Blue Shield says it may disclose your health information to your health plan sponsor for plan administration. The example given is an employer that contracts with Blue Shield for a health plan receiving certain statistics that explain the premiums charged.
Supporting quotations
Administer your plan
We may disclose your health information to your health plan sponsor for plan administration.
Example: Your company contracts with us to provide a health plan, and we provide your company with certain statistics to explain the premiums we charge.
Not stated here
The notice does not say which information the plan sponsor may receive beyond the example of certain statistics.
Sharing & Disclosure · Permission or license
Blue Shield says it is allowed and required to share information in other ways that serve the public good
Blue Shield says it is allowed and required to share your information in other ways, usually ways that contribute to the public good such as public health and research, without your written authorization. It says it must meet many conditions in the law before it can share your information for these purposes and points to a federal web page for more information.
Supporting quotations
How else can we use or share your health information? We are allowed and required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research, without your written authorization. We must meet many conditions in the law before we can share your information for these purposes. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.
Qualifications & exceptions
Blue Shield must meet many conditions in the law before sharing for these purposes.
"Usually" describes the purposes; the examples given are public health and research.
Not stated here
The conditions in the law are not listed; the linked federal page is not supplied.
Sharing & Disclosure · Permission or license
Blue Shield may share health information for public health and safety situations
Blue Shield says it may share health information about you for certain situations such as preventing disease, helping with product recalls, reporting adverse reactions to medications, reporting suspected abuse, neglect or domestic violence, assisting with disaster relief efforts, and preventing or reducing a serious threat to anyone’s health or safety.
Supporting quotations
Help with public health and safety issues
We may share health information about you for certain situations such as:
Preventing disease
Helping with product recalls
Reporting adverse reactions to medications
Reporting suspected abuse, neglect, or domestic violence
Assisting with disaster relief efforts
Preventing or reducing a serious threat to anyone’s health or safety
Qualifications & exceptions
The list is introduced by "such as" and is illustrative.
Sits within the public-good sharing for which many legal conditions must be met.
Not stated here
Who may receive the information in each situation is not stated.
Use & Processing · Permission or license
Blue Shield may use or share health information for research, but only as the law allows
Blue Shield says it may use or share your health information for health research, but only according to, and as allowed by, law.
Supporting quotations
Do research
We may use or share your health information for health research, but only according to, and as allowed by, law.
Qualifications & exceptions
Only according to, and as allowed by, law.
Not stated here
The legal conditions for research use are not described.
Sharing & Disclosure · Permission or license
Blue Shield may share information with organ procurement groups and, as law allows, coroners and funeral directors
Blue Shield says it may share health information about you with organ procurement organizations. It may also share health information with a coroner, medical examiner or funeral director when an individual dies, but only according to, and as allowed by, law.
Supporting quotations
Respond to organ and tissue donation requests and work with a medical examiner or funeral director
We may share health information about you with organ procurement organizations.
We may share health information with a coroner, medical examiner, or funeral director when an individual dies, but only according to, and as allowed by, law.
Qualifications & exceptions
The limit "only according to, and as allowed by, law" is stated for sharing with a coroner, medical examiner or funeral director.
Not stated here
The organ procurement item states no "as allowed by law" limit of its own.
Sharing & Disclosure · Permission or license
Blue Shield may share information for workers’ compensation, law enforcement and health oversight, as the law allows
Under a heading about workers’ compensation, law enforcement and other government requests, Blue Shield says it may use or share health information about you for workers’ compensation claims, for law enforcement purposes or with a law enforcement official, and with health oversight agencies for activities authorized by law. For law enforcement and health oversight it says this is only according to, and as allowed by, law. A further item in the same list, about special government functions, is carded with the next part of the notice.
Supporting quotations
Address workers’ compensation, law enforcement, and other government requests
We may use or share health information about you:
For workers’ compensation claims
For law enforcement purposes or with a law enforcement official, but only according to, and as allowed by, law
With health oversight agencies for activities authorized by law, but only according to, and as allowed by, law
Qualifications & exceptions
The law enforcement and health oversight items are limited to disclosures "only according to, and as allowed by, law".
The workers’ compensation item states no such limit in its own words.
Not stated here
The notice does not describe what counts as a law enforcement request or which agencies are health oversight agencies.
Sharing & Disclosure · Permission or license
Blue Shield may share information for special government functions like national security, as the law allows
Continuing the list of disclosures for workers’ compensation, law enforcement and other government requests, Blue Shield says it may use or share health information about you for special government functions such as military, national security and presidential protective services, but only according to, and as allowed by, law. The notice says it must meet many conditions in the law before sharing information for these public-good purposes.
Supporting quotations
For special government functions such as military, national security, and presidential protective services, but only according to, and as allowed by, law
We must meet many conditions in the law before we can share your information for these purposes.
Qualifications & exceptions
Only according to, and as allowed by, law.
Blue Shield must meet many conditions in the law before sharing for these purposes.
Not stated here
The conditions in the law are not listed.
Sharing & Disclosure · Permission or license
Blue Shield may share information if state or federal law requires it, including with the federal health department
Blue Shield says it may share information about you if state or federal laws require it, including with the Department of Health and Human Services if that agency wants to see that Blue Shield is complying with federal privacy law. The notice says it must meet many conditions in the law before sharing information for these public-good purposes.
Supporting quotations
Comply with the law
We may share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
We must meet many conditions in the law before we can share your information for these purposes.
Qualifications & exceptions
Blue Shield must meet many conditions in the law before sharing for these purposes.
Not stated here
The notice does not list which laws require disclosure.
Sharing & Disclosure · Permission or license
Blue Shield may share information in response to a court or administrative order or a subpoena, as the law allows
Blue Shield says it may share health information about you in response to a court or administrative order, or in response to a subpoena, but only according to, and as allowed by, law. The notice says it must meet many conditions in the law before sharing information for these public-good purposes. Separate passages on reproductive health care and substance use disorder records set separate limits for those kinds of information.
Supporting quotations
Respond to lawsuits and legal actions
We may share health information about you in response to a court or administrative order, or in response to a subpoena, but only according to, and as allowed by, law.
We must meet many conditions in the law before we can share your information for these purposes.
Qualifications & exceptions
Only according to, and as allowed by, law.
Reproductive health care and substance use disorder records are covered by separate rules later in the notice.
Not stated here
The notice does not say whether you are told when information is shared in response to a subpoena or order.
Use & Processing · Restriction or exception
Otherwise Blue Shield needs your written authorization; it says it will not use PHI for marketing or sell it without one
Blue Shield says that other than for the purposes described above it must obtain your written authorization to use or disclose your PHI. For example, it says it will not use your PHI for marketing, sell your PHI, or use or disclose substance use disorder records or psychotherapy notes without your written authorization, except as expressly allowed by law.
Supporting quotations
Other than for the purposes described above, we must obtain your written authorization to use or disclose your PHI. For example, we will not use your PHI for marketing purposes, sell your PHI, nor use or disclose substance use disorder records or psychotherapy notes without your written authorization, except as expressly allowed by law.
Qualifications & exceptions
The sentence ends "except as expressly allowed by law".
Not stated here
The sentence does not say whether the "except as expressly allowed by law" clause reaches marketing and sale or only the substance use disorder records and psychotherapy notes.
Earlier the notice says it "never" shares for marketing or sale without written permission, without that clause.
You may cancel a written authorization; the cancellation applies only to future uses and disclosures
You may cancel a written authorization you previously gave Blue Shield. When submitted to Blue Shield in writing, the cancellation applies to future uses and disclosures of your PHI. It does not affect uses or disclosures made earlier while your authorization was in effect.
Supporting quotations
You may cancel a written authorization that you previously gave us. When submitted to us in writing, the cancellation will apply to future uses and disclosures of your PHI. It will not affect uses or disclosures made previously, while your authorization was in effect.
Qualifications & exceptions
Cancellation must be submitted in writing.
Earlier uses and disclosures made while the authorization was in effect are not affected.
Legal Rights & Agreement Rules · Restriction or exception
Blue Shield says your health information cannot be used to investigate or penalize lawful reproductive health care
Under a list of health information Blue Shield says it may not use or share without your written authorization unless otherwise allowed by law, the notice states that your health information cannot be used or disclosed to conduct any criminal, civil or administrative investigation of, or impose liability on, you or anyone else, or to identify you or anyone else in connection with seeking, obtaining, providing or facilitating reproductive health care. This applies where that care is lawful under Federal law and the law of the state in which it is provided. Reproductive health care includes, but is not limited to, abortion-related services. The notice describes an exception for a lawful attestation in the example that follows.
Supporting quotations
Are there instances when we will not share your health information? We are not allowed to use or share the following types of health information without your written authorization unless otherwise allowed by law:
Reproductive health care
Your health information cannot be used or disclosed to conduct any criminal, civil, or administrative investigation or impose any liability on you or anyone else, or identify you or anyone else in connection with seeking, obtaining, providing, or facilitating reproductive health care, provided that the reproductive health care is lawful under Federal law and the law of the state in which the reproductive health care is provided. Reproductive health care includes, but is not limited to, abortion-related services.
Qualifications & exceptions
Applies only if the reproductive health care is lawful under Federal law and the law of the state in which it is provided.
The lead-in says these types of information may not be used or shared without written authorization "unless otherwise allowed by law".
An exception for a lawful attestation is described in the example that follows.
Not stated here
The bullet itself does not mention written authorization or any other exception; the lead-in and the example do.
Sharing & Disclosure · Restriction or exception
Lawful abortion-related information will not go to other-state or federal inquiries without your authorization
Blue Shield says any of your health information relating to lawful abortion-related services will not be released in response to a subpoena, request or court order, nor in cooperation with an inquiry or investigation by an individual or government entity in another state or a federal law enforcement agency, without your written authorization, except as expressly permitted or required by law.
Supporting quotations
Any of your health information relating to lawful abortion-related services will not be released in response to a subpoena, request, or court order, nor in cooperation with an inquiry or investigation by an individual or government entity in another state or a federal law enforcement agency, without your written authorization, except as expressly permitted or required by law.
Qualifications & exceptions
The exception is "as expressly permitted or required by law".
Not stated here
The notice does not say how this relates to the lawful attestation exception described in the example; the example lists disclosures for health oversight, judicial or administrative proceedings, law enforcement and coroner or medical examinations.
Abortion-related information will not be made available through electronic records or an HIE to people in another state
Blue Shield says any of your health information relating to you seeking, obtaining, providing, supporting or aiding in the performance of a lawful abortion will not be disclosed, shared or made available in an electronic health records system or through a Health Information Exchange to any individual in another state, without your written authorization, except as expressly permitted or required by law.
Supporting quotations
Any of your health information relating to you seeking, obtaining, providing, supporting, or aiding in the performance of a lawful abortion will not be disclosed, shared, or made available in an electronic health records system or through an HIE to any individual in another state, without your written authorization, except as expressly permitted or required by law.
Qualifications & exceptions
The exception is "as expressly permitted or required by law".
With a lawful attestation, Blue Shield may disclose information possibly related to reproductive care for four purposes
Using an example of a person who lives in one state and travels to California for lawful reproductive health care such as an abortion, Blue Shield says it is not allowed to and will not share that information if someone tries to investigate the person for obtaining that care. It adds that if it receives a lawful attestation from the person requesting it, it may disclose PHI potentially related to reproductive health care, such as an abortion, for health oversight activities, judicial or administrative proceedings, law enforcement, or coroner or medical examinations.
Supporting quotations
Example: If you live in one state and travel to California to receive lawful reproductive health care, such as an abortion, we are not allowed to and will not share that information if someone tries to investigate you for obtaining that care. However, if we receive a lawful attestation from the person requesting it, we may disclose your PHI potentially related to reproductive health care (such as an abortion) for the following purposes:
Health oversight activities
Judicial or administrative proceedings
Law enforcement
Coroner or medical examinations
Qualifications & exceptions
The exception depends on receiving a "lawful attestation" from the requester.
Not stated here
The notice does not define a lawful attestation or say what it must state.
The four listed purposes follow the word "following" in the example; the notice does not say whether other purposes are possible.
Legal Rights & Agreement Rules · Restriction or exception
Substance use disorder records are not used against you in proceedings without authorization or a qualifying court order
Blue Shield says any substance use disorder treatment records will not be used or disclosed in civil, criminal, administrative or legislative proceedings against you unless you give written authorization, or unless a court orders the disclosure after giving you notice and an opportunity to object and the order is accompanied by a subpoena or other legal requirement compelling disclosure. Its example is a lawsuit in which someone asks for your substance use disorder treatment records: it will not provide them unless you tell it to in writing or a court orders it and issues a legal document requiring it.
Supporting quotations
Substance use disorder treatment
Any substance use disorder treatment records will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you give written authorization, or unless a court orders the disclosure after giving you notice and an opportunity to object and the order is accompanied by a subpoena or other legal requirement compelling disclosure.
Example: If you are involved in a lawsuit and someone asks us for your substance use disorder treatment records, we will not provide them unless you tell us to in writing or a court orders it and issues a legal document requiring it.
Qualifications & exceptions
The rule concerns use or disclosure in proceedings against you.
A court order must follow notice to you and an opportunity to object, and be accompanied by a subpoena or other legal requirement compelling disclosure.
Not stated here
The passage addresses proceedings against you; it does not say here how these records are treated for other purposes, which an earlier passage says need written authorization except as expressly allowed by law.
Blue Shield says it keeps physical, technical and administrative safeguards and limits access to trained staff
Blue Shield says it is required by law to maintain physical, technical and administrative safeguards to ensure the privacy of your PHI. To protect your privacy, it says only authorized and trained workforce members are given access to its paper and electronic records and to non-public areas where this information is stored. Training topics include privacy and data protection policies and procedures, including how paper and electronic records are labeled, stored, filed and accessed, and the physical, technical and administrative safeguards in place to maintain the privacy and security of PHI.
Supporting quotations
We are required by law to maintain physical, technical, and administrative safeguards to ensure the privacy of your PHI. To protect your privacy, only Blue Shield workforce members who are authorized and trained are given access to our paper and electronic records and to non-public areas where this information is stored. Workforce members are trained on topics including:
Privacy and data protection policies and procedures, including how paper and electronic records are labeled, stored, filed, and accessed
Physical, technical, and administrative safeguards in place to maintain the privacy and security of your PHI
Qualifications & exceptions
Access is for workforce members who are authorized and trained.
The training topics are introduced by "including" and may not be a complete list.
Not stated here
The specific safeguards in use are not described.
Security & Safeguards · Company practice
Blue Shield says its corporate Privacy Office monitors compliance with privacy policies and educates the organization
Blue Shield says its corporate Privacy Office monitors how it follows its privacy policies and procedures and educates the organization on this topic.
Supporting quotations
Our corporate Privacy Office monitors how we follow our privacy policies and procedures and educates our organization on this important topic.
Legal Rights & Agreement Rules · Company commitment
Blue Shield says it will obey privacy laws, including HIPAA and California law, and special laws for sensitive data
Blue Shield says it will obey any and all laws that require it to give you privacy protections, including HIPAA and any other federal or California privacy law. It notes there are special laws that protect some types of health information, such as, but not limited to, psychotherapy notes, reproductive and sexual health information, gender affirming care, mental health services, treatment for substance use disorders, genetic information, and HIV/AIDS testing and treatment, and says it will follow those laws.
Supporting quotations
We will obey any and all laws that require us to give you privacy protections, including HIPAA and any other federal or California privacy law. For example, there are special laws that protect some types of health information, such as, but not limited to, psychotherapy notes, reproductive and sexual health information, gender affirming care, mental health services, treatment for substance use disorders (SUD), genetic information, and HIV/AIDS testing and treatment. We will follow those laws.
Qualifications & exceptions
The list of specially protected types of information is introduced by "such as, but not limited to" and is illustrative.
Not stated here
The special laws are not named or described.
Legal Rights & Agreement Rules · Company commitment
Where federal and California standards differ, Blue Shield applies the one that gives your information more protection
Blue Shield says that to the extent federal and California privacy laws set different standards for certain health information, it will apply the standard that gives your health information the greater degree of protection and security, unless otherwise required by law. It adds that any disclosure of PHI beyond the provisions of the law is prohibited.
Supporting quotations
To the extent federal and California privacy laws set forth different standards for certain health information, we will apply the standard that affords your health information the greater degree of protection and security, unless otherwise required by law. Any disclosure of PHI beyond the provisions of the law is prohibited.
Qualifications & exceptions
The greater-protection rule applies "unless otherwise required by law".
It applies to "certain health information" where the two standards differ.
Blue Shield says it will promptly tell you if a breach may have compromised the privacy or security of your information
Under its responsibilities, Blue Shield says it will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
Supporting quotations
Our responsibilities
We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
Not stated here
"Promptly" is not tied to a number of days, and the notice does not say how you will be told.
Legal Rights & Agreement Rules · Company commitment
Blue Shield says it must follow the duties and privacy practices in this notice and give you a copy
Blue Shield says it must follow the duties and privacy practices described in this notice and give you a copy of it.
Supporting quotations
We must follow the duties and privacy practices described in this notice and give you a copy of it.
Use & Processing · Company commitment
Blue Shield will not use or share your information beyond this notice without your written okay, which you can withdraw
Blue Shield says it will not use or share your information other than as described in the notice unless you tell it that it can in writing. If you tell it that it can, you may change your mind at any time by letting it know in writing.
Supporting quotations
We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
Qualifications & exceptions
Permission and any change of mind must be in writing.
Not stated here
The sentence does not mention the legal exceptions that other passages describe, such as disclosures required by law.
Sharing & Disclosure · Restriction or exception
Information Blue Shield properly discloses may be redisclosed by the recipient, then falls outside this notice
Blue Shield says it is possible that information it has properly disclosed under the notice will be redisclosed by the recipient and, if so, it is no longer protected by the policies in the notice.
Supporting quotations
Please note that it is possible that information that we have properly disclosed pursuant to this Notice will be redisclosed by the recipient and, if so, it is no longer protected by the policies in this Notice.
Qualifications & exceptions
Applies to information disclosed "properly ... pursuant to this Notice".
Not stated here
The sentence says the notice’s own policies no longer protect redisclosed information; it does not say whether other laws or the recipient’s own rules apply.
The notice points to a federal web page for more information on notices of privacy practices
At the end of its responsibilities section the notice points to a web page of the U.S. Department of Health and Human Services for more information. That page is a link only and its content is not part of this source.
Supporting quotations
For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.
Not stated here
The linked page is not supplied, so its content is not part of this analysis.
Legal Rights & Agreement Rules · Permission or license
Blue Shield can change the notice and the changes apply to all information it has about you
Blue Shield says it can change the terms of the notice and that the changes will apply to all information it has about you. It says the new notice will be available on request and on its website, and that it will mail a copy to you.
Supporting quotations
Changes to the Terms of This Notice
We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, on our web site, and we will mail a copy to you.
Qualifications & exceptions
Changes apply to all information Blue Shield has about you, not only information collected after the change.
Not stated here
No notice period before a change takes effect is stated, and the notice does not say when the copy will be mailed.
Legal Rights & Agreement Rules · Context
This notice states an effective date of 05/21/2025
The notice states its effective date as 05/21/2025. An earlier line carries the text "Approved 02252025", and the notice does not explain how the two relate.
Supporting quotations
Effective Date of this Notice: 05/21/2025
Not stated here
How the effective date relates to the earlier line "Approved 02252025" is not explained.
Legal Rights & Agreement Rules · Procedure
The notice repeats the Privacy Office mailing address, phone, hotline, fax and e-mail at its end
The notice ends by repeating the contact details of the Blue Shield of California Privacy Office: P.O. Box 272540, Chico, CA 95927-2540, phone (888) 266-8080, hotline (855) 296-9086, fax (800) 201-9020 and e-mail Privacy@blueshieldca.com.
Supporting quotations
Blue Shield of California Privacy Office P.O. Box 272540 Chico, CA 95927-2540 Phone: (888) 266-8080 Hotline: (855) 296-9086 Fax: (800) 201-9020 E-mail: Privacy@blueshieldca.com