Policy covers Online Services owned or managed by Highmark Health
This Digital Privacy Policy describes information that Highmark Health and service providers on its behalf collect, use, and disclose when you use our Online Services, and it describes digital privacy practices and options across websites, mobile apps, member and patient portals, and related digital resources owned or managed by Highmark Health. Using any Online Service creates an agreement between you and Highmark Health under this Policy, and some Online Services may have separate or additional terms of use that also apply.
Supporting quotations
At Highmark Health, being clear and open with you is important to us. This guides our business choices and our relationship with you. This Digital Privacy Policy (“Privacy Policy”) describes the information we and service providers on our behalf collect, use, and disclose when you use our Online Services. It also describes our digital privacy practices and your options as you use our websites, mobile apps, member and patient portals, and related digital and online resources, owned or managed by Highmark Health (our “Online Services”).
This Privacy Policy creates an agreement between you and Highmark Health when you use any of our online services. These online services include our enterprise websites, mobile applications, member and patient portals, and our other online or digital resources, owned or managed by Highmark Health. Some of our online services may have separate or additional terms of use which will also apply. Please review those terms of use.
Qualifications & exceptions
Some online services may have separate or additional terms of use
Legal Rights & Agreement Rules · Restriction or exception
PHI is governed by the Notice of Privacy Practices, not this policy
HIPAA regulates PHI kept by covered entities and business associates and requires a Notice of Privacy Practices describing collection, use, and disclosure of PHI. PHI is part of the larger category of personal information, and the NPP terms apply to collection, use, and disclosure of PHI rather than this Privacy Policy. Individually identifiable health information collected on websites or mobile applications is generally PHI even without a current relationship or when information such as IP address or geographic location lacks specific treatment or billing details, and most information collected, used, and disclosed through online services is PHI subject to the applicable NPP.
Supporting quotations
The Health Insurance Portability and Accountability Act (HIPAA) regulates protected health information (PHI) kept by covered entities and business associates. HIPAA requires covered entities to have a Notice of Privacy Practices, which describes how entities collect, use, and disclose PHI.
PHI is part of the larger category of personal information, as defined below. The terms of the Notice of Privacy Practices will apply to the collection, use, and disclosure of PHI rather than this Privacy Policy. For example, individually identifiable health information collected on our websites or mobile applications is generally PHI, even if:
You do not have a current relationship with us and
The information, such as IP address or geographic location, does not include specific treatment or billing details.
Most of the information collected, used, and disclosed through use of our online services is PHI and is subject to the applicable Notice of Privacy Practices.
Qualifications & exceptions
even if you do not have a current relationship with us
even if the information, such as IP address or geographic location, does not include specific treatment or billing details
Legal Rights & Agreement Rules · Permission or license
Using Online Services confirms acceptance and express consent
Use of Online Services confirms acknowledgement and acceptance of the conditions in this Privacy Policy and any additional terms of use, and your express consent to collect, use, and disclose your information in accordance with applicable law. Privacy practices are subject to the laws of the places in which Highmark Health operates, and customers may see additional region-specific terms that apply only to customers located in those regions. Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, and references to "us," "we," and "our" mean Highmark Health.
Supporting quotations
Your Consent
We encourage you to fully read this Privacy Policy. This Privacy Policy creates an agreement between you and Highmark Health when you use any of our online services. These online services include our enterprise websites, mobile applications, member and patient portals, and our other online or digital resources, owned or managed by Highmark Health. Some of our online services may have separate or additional terms of use which will also apply. Please review those terms of use.
Your use of our online services confirms:
You acknowledge and accept the conditions contained in this Privacy Policy and any additional terms of use and
Your express consent to collect, use, and disclose your information in accordance with applicable law.
Please note, our privacy practices are subject to the laws of the places in which we operate. You may see more region-specific terms that apply only to customers located in those regions.
Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including, among others, Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.
Qualifications & exceptions
Some online services may have separate or additional terms of use
Privacy practices are subject to the laws of the places in which we operate
Region-specific terms may apply only to customers located in those regions
Legal Rights & Agreement Rules · Company practice
Disclosure to comply with law, legal requests, harm prevention, and rights protection
Highmark may disclose personal information to courts, law enforcement, governmental oversight agencies, and other regulatory bodies as permitted or required by applicable law, or if reasonably necessary to comply with legal obligations; comply with legal process and respond to claims asserted against it; respond to verified requests for a criminal investigation or alleged or suspected illegal activity, or any other activity that may expose Highmark or any users to legal liability; enforce and administer this Privacy Policy or applicable terms of use; or protect the rights of Highmark Health, its employees, customers, business partners, or the public.
Supporting quotations
Disclosure To Comply With Law, Respond To Legal Requests, Prevent Harm, and Protect Our Rights We may disclose your personal information to courts, law enforcement, governmental oversight agencies, and other regulatory bodies as permitted or required by applicable law, or if such disclosure is reasonably necessary to:
Comply with legal obligations.
Comply with legal process and to respond to claims asserted against us.
Respond to verified requests for a criminal investigation or an alleged or suspected illegal activity, or any other activity that may expose us or any of our users to legal liability.
Enforce and administer this Privacy Policy or any applicable terms of use.
Protect the rights of Highmark Health, its employees, customers, business partners, or the public.
Legal Rights & Agreement Rules · Restriction or exception
COPPA: online services not intended for children under 13
Online services are not generally intended for, nor made available to, children under the age of 13, and Highmark typically does not try to collect, use, or disclose information from children under 13, unless otherwise permitted or required by applicable law.
Supporting quotations
Children's Online Privacy Protection Act (COPPA) Our online services are not generally intended for, nor made available to, children under the age of 13. We typically do not try to collect, use, or disclose information from children under the age of 13, unless otherwise permitted or required by applicable law.
Qualifications & exceptions
unless otherwise permitted or required by applicable law
Legal Rights & Agreement Rules · Context
GDPR duties for certain entities or product lines
Some Highmark Health entities or product lines may be subject to certain duties set by the GDPR; for those entities or product lines, a notice that meets GDPR's requirements will be shown on the entities' public websites.
Supporting quotations
European Union General Data Protection Regulation (GDPR) Some of our entities or product lines may be subject to certain duties set by the GDPR. For those entities or product lines, a notice that meets GDPR’s requirements will be shown on the entities’ public websites.
Qualifications & exceptions
Some of our entities or product lines may be subject to certain duties set by the GDPR.
Not stated here
Which entities or product lines are subject to GDPR is not specified.
Legal Rights & Agreement Rules · Context
State consumer privacy laws for certain entities
Some Highmark Health entities may be subject to certain duties set by state consumer privacy laws, such as those in California and Colorado, which require posting a consumer notice on data collection, use, and disclosure activities; for entities subject to these requirements, notices aligned to those specific state laws will be shown on those entities' public websites.
Supporting quotations
State Consumer Privacy Laws Some of our entities may be subject to certain duties set by state consumer privacy laws, such as those set in California and Colorado. These laws require posting a consumer notice on data collection, use, and disclosure activities. For our entities that may be subject to these requirements, notices aligned to those specific state laws will be shown on those entities’ public websites.
Qualifications & exceptions
such as those set in California and Colorado
Not stated here
Which entities are subject to these laws is not specified.
Legal Rights & Agreement Rules · Company practice
Policy may change at any time; continued use confirms consent
Highmark reserves the right to change, modify, or update this Privacy Policy at any time and for any reason, and will promptly post such changes to Online Services. Users should review the Policy periodically to stay informed. Continued use of Online Services confirms acknowledgement and acceptance of the conditions in this Privacy Policy and express consent to collect, use, and disclose information in accordance with applicable law.
Supporting quotations
We reserve the right to change, modify, or update this Privacy Policy at any time and for any reason. We will promptly post such changes, modifications, or updates to our Online Services. Please review this Privacy Policy every so often to keep informed of any changes. Remember that continued use of our Online Services confirms i) your acknowledgement and acceptance of the conditions contained in this Privacy Policy, and ii) your express consent to collect, use, and disclose your information in accordance with applicable law.
Qualifications & exceptions
We reserve the right to change, modify, or update this Privacy Policy at any time and for any reason.
Legal Rights & Agreement Rules · Procedure
Questions about the Privacy Policy
Questions about this Privacy Policy can be directed to Highmark by emailing HighmarkHealthPrivacy@highmarkhealth.org or calling 1-866-228-9424.
Supporting quotations
Questions If you have questions about this Privacy Policy, please contact us by emailing HighmarkHealthPrivacy@highmarkhealth.org or calling 1-866-228-9424.
Legal Rights & Agreement Rules · Context
Highmark Health includes subsidiaries and affiliates
Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.
Supporting quotations
1 Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including, among others, Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.