Digital Privacy Policy

Highmark · Official agreement

32 cards.

Digital Privacy Policy — Highmark Health1

At Highmark Health, being clear and open with you is important to us. This guides our business choices and our relationship with you. This Digital Privacy Policy (“Privacy Policy”) describes the information we and service providers on our behalf collect, use, and disclose when you use our Online Services. It also describes our digital privacy practices and your options as you use our websites, mobile apps, member and patient portals, and related digital and online resources, owned or managed by Highmark Health (our “Online Services”).

Note on HIPAA and Protected Health Information

The Health Insurance Portability and Accountability Act (HIPAA) regulates protected health information (PHI) kept by covered entities and business associates. HIPAA requires covered entities to have a Notice of Privacy Practices, which describes how entities collect, use, and disclose PHI.

PHI is part of the larger category of personal information, as defined below. The terms of the Notice of Privacy Practices will apply to the collection, use, and disclosure of PHI rather than this Privacy Policy. For example, individually identifiable health information collected on our websites or mobile applications is generally PHI, even if:

Most of the information collected, used, and disclosed through use of our online services is PHI and is subject to the applicable Notice of Privacy Practices.

Your Consent

We encourage you to fully read this Privacy Policy. This Privacy Policy creates an agreement between you and Highmark Health when you use any of our online services. These online services include our enterprise websites, mobile applications, member and patient portals, and our other online or digital resources, owned or managed by Highmark Health. Some of our online services may have separate or additional terms of use which will also apply. Please review those terms of use.

Your use of our online services confirms:

Please note, our privacy practices are subject to the laws of the places in which we operate. You may see more region-specific terms that apply only to customers located in those regions.

Section 1. Information That We Collect

We collect personal information about you in several ways. Personal information means individually identifiable information like your name, email address, and demographic information. We use various tools, components, and features (as described below) to collect this information to conduct our business operations. This includes understanding our users, maintaining and improving our online services, and customizing your user experience. Most of the information we collect, use, and disclose through our online services is PHI.

How you interact with our online service will determine the type and amount of personal information we collect. For general website browsing, we capture basic information such as:

For other features, such as use of a secure portal, we may need to verify your identity through a login process and collect enough personal information to respond to the service requested.

What follows below are further details about the personal information we and service providers on our behalf collect, use, and disclose for our business purposes.

Online Forms We have online inquiry forms on our Online Services for account questions or to learn more about our products and services. The personal information collected on these forms may include your name, address, phone number, email address, and the details of your inquiry. When you submit personal information, you give us and service providers on our behalf the right to transmit, monitor, retrieve, store and use your information to operate the Online Services and for other business purposes. We may use such information to review and respond to your request or use contracted service providers to do that for us.

Secure Portals When you access our secure portals, we and service providers on our behalf collect certain personal information like user ID and password, IP address, pages or screens visited, buttons and links clicked, click streams, and related session data. The information received and collected through these portals may also be recorded in transaction logs. The information helps to monitor and improve content and functionality of the Online Services and our other services and to comply with applicable law and regulations. We and service providers on our behalf may also use information collected through secure portals as stated in Section 2 below.

Interactive Chat The Online Services may offer interactive chat technology to help you. This technology collects personal information like name, date of birth, address, chat messages, and account number to verify you or to provide you with customized details. This technology may also capture session-related information, like web logs, to document the interaction. Additional terms of use may apply to interactive chat features in addition to this Privacy Policy. We encourage you to read such terms.

Biometric Login Your mobile device may permit you to use fingerprint, facial recognition, or similar biometric technology to login to our Online Service. When this is enabled, our Online Services can see that you have selected this as a preference and have been verified through your mobile device, and you may be permitted to access our Online Services with that technology. When you use a biometric login, we do not have access to or collect any of the actual biometrics (e.g., fingerprints or facial images). Your mobile device manufacturer manages and maintains that information (e.g., Apple, Samsung).

Geolocation Functionality With your consent through your mobile device, we may use the location services function on your mobile device to collect your precise geolocation data. We use this data to help you find local products and services, and to provide you with relevant content based on your location.

Mobile Device We collect certain personal information when run on a mobile device. For example, if you download one of our mobile applications, we collect information about the device type, its software/operating system, and the device identifier. We use this information to better understand who is using our Online Services and how they are using the Online Services and to improve our technical support capabilities.

Cookies and Other Similar Technologies A cookie is a small text file stored on a computer or other internet-connected device when it accesses a digital resource. There are also similar technologies, such as pixels, beacons, server logs, and others that collect information by automated means. When users visit our Online Services, cookies and similar technologies collect and process user information such as:

Our Online Services use first-party cookies and similar technology (that we create) to help them operate properly, monitor their performance, improve your experience, and better understand who is using our Online Services and how they are using the Online Services. We may also use the information we get from first-party cookies to provide visitors and users with personalized content and improve our offerings.

Our Online Services also use third-party cookies and similar technology (ones used and controlled by service providers on our behalf), as permitted by applicable law, to better understand who is using our Online Services and how they are using the Online Services (such as session time, pages or screens visited, buttons and links clicked, click streams, and crash reports), understand your digital journey from external sources to our Online Services, and improve our Online Services and other services. For example, we allow service providers, including AdobeAdobe and Freshpaint, to collect information through cookies and similar technologies on our behalf to collect the information described above to help us monitor, evaluate, and improve our Online Services, content, and services. These service providers are not allowed to use information they collect for any purpose other than providing their services to us.

Cookies and similar technology used on our Online Services include the following types::

You can modify most internet browser settings to try to block cookies (e.g., choosing a “do not track” or “global privacy control” setting). You should be aware that blocking cookies could prevent certain online services or features from fully functioning. We are not responsible for and make no representations or claims regarding the success of third party opt-out mechanisms or programs. Please note that if you delete your cookies or upgrade your browser after opting out, you will need to opt-out again to reaffirm your choices.

Third-Party Widgets You may see third-party widgets (e.g., TwitterX, LinkedInLinkedIn) on our online services. These widgets (icons) are owned and controlled by third parties and not by us. These widgets are there for convenience only, and do not reflect an affiliation with or endorsement of the third-party. If you click a widget, you will be taken to the home page of that third-party. Any data collection, use, and disclosure activities will be subject to that third party’s privacy standards (and not this Privacy Policy). Here’s an example: We maintain a LinkedIn page, but we have no control over how LinkedIn, as a third party, collects, uses, or discloses information about you when you visit the LinkedIn platform.

When you click a third-party widget and leave our site, we make no representations or warranties regarding third-party platforms or components, their content, data management, or security. You should review the privacy standards of the applicable third parties.

Redirecting Hyperlinks and Embedded Third-Party Media Our online services may contain redirecting hyperlinks or embedded third-party media content. An example includes YouTubeYouTube videos which may be tile images that redirect to YouTube when clicked. Another example is an embedded file which will begin playing on our web pages when clicked. We do not manage or configure this third-party content. We do not control any code which may be linked to this content by the media host or any data collection which might occur as a result of such code. When you review this content on our online services, you acknowledge, accept, and expressly consent to any associated data collection, use, and disclosure which might occur between us and the media host.

Section 2. Use, Access, and Disclosure Of This Information

We use the information we get through our online services for the purposes stated in Section 1 above. Any additional uses may include:

We may also use your personal information to give you information about additional products, programs, and services offered by our family of companies or our business partners. You may remove yourself from certain communication channels or programs at any time — just follow the opt-out instructions included in those communications.

We do not sell your personal information for money or other consideration.

Disclosure To Service Providers We may disclose your personal information collected through our Online Services to service providers and may allow these service providers to directly collect your personal information in connection with our Online Services. For example, a service provider may have access to your information to send you a survey or a newsletter or to assist with security, fraud detection, analytics, or system operations on our behalf. We also have service providers, including Adobe and Freshpaint, collect personal information about users of our Online Services as described above. Our service providers are bound by contract to protect your personal information.

Links to External Websites Third parties include non-affiliated companies whose platforms or components we may use or present to our users. We do not control their data collection and usage activities and they are not governed by this Privacy Policy (like third-party widgets noted above). For example, we may use a third-party vendor to host certain informational videos. When you click on the link to the video, you are taken from our site to the platform of the video host. The host’s data collection and usage activities will control your interaction with that third-party site and content.

Third parties can also refer to other types of entities or bodies that we do not have a contractual or commercial relationship with, but that we share data with as permitted or required by law (e.g., government oversight agencies). We generally do not disclose personal information collected through our online services to third parties except as set forth in this Privacy Policy, or as permitted or required by law. At times, personal information may be disclosed to a third party if:

Disclosure To Comply With Law, Respond To Legal Requests, Prevent Harm, and Protect Our Rights We may disclose your personal information to courts, law enforcement, governmental oversight agencies, and other regulatory bodies as permitted or required by applicable law, or if such disclosure is reasonably necessary to:

Section 3. Other Relevant Data And Consumer Protection Laws

Children's Online Privacy Protection Act (COPPA) Our online services are not generally intended for, nor made available to, children under the age of 13. We typically do not try to collect, use, or disclose information from children under the age of 13, unless otherwise permitted or required by applicable law.

European Union General Data Protection Regulation (GDPR) Some of our entities or product lines may be subject to certain duties set by the GDPR. For those entities or product lines, a notice that meets GDPR’s requirements will be shown on the entities’ public websites.

State Consumer Privacy Laws Some of our entities may be subject to certain duties set by state consumer privacy laws, such as those set in California and Colorado. These laws require posting a consumer notice on data collection, use, and disclosure activities. For our entities that may be subject to these requirements, notices aligned to those specific state laws will be shown on those entities’ public websites.

Section 4. Changes To This Digital Privacy Policy and Questions

We reserve the right to change, modify, or update this Privacy Policy at any time and for any reason. We will promptly post such changes, modifications, or updates to our Online Services. Please review this Privacy Policy every so often to keep informed of any changes. Remember that continued use of our Online Services confirms i) your acknowledgement and acceptance of the conditions contained in this Privacy Policy, and ii) your express consent to collect, use, and disclose your information in accordance with applicable law.

Questions If you have questions about this Privacy Policy, please contact us by emailing HighmarkHealthPrivacy@highmarkhealth.org or calling 1-866-228-9424.

1 Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including, among others, Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.

(© 2026 Highmark Health — last revised July 2026)