Digital Privacy Policy

Highmark · Official agreement

Read the agreement

32 of 32 cards

Legal Rights & Agreement Rules · Context

Policy covers Online Services owned or managed by Highmark Health

This Digital Privacy Policy describes information that Highmark Health and service providers on its behalf collect, use, and disclose when you use our Online Services, and it describes digital privacy practices and options across websites, mobile apps, member and patient portals, and related digital resources owned or managed by Highmark Health. Using any Online Service creates an agreement between you and Highmark Health under this Policy, and some Online Services may have separate or additional terms of use that also apply.

Supporting quotations

At Highmark Health, being clear and open with you is important to us. This guides our business choices and our relationship with you. This Digital Privacy Policy (“Privacy Policy”) describes the information we and service providers on our behalf collect, use, and disclose when you use our Online Services. It also describes our digital privacy practices and your options as you use our websites, mobile apps, member and patient portals, and related digital and online resources, owned or managed by Highmark Health (our “Online Services”).
This Privacy Policy creates an agreement between you and Highmark Health when you use any of our online services. These online services include our enterprise websites, mobile applications, member and patient portals, and our other online or digital resources, owned or managed by Highmark Health. Some of our online services may have separate or additional terms of use which will also apply. Please review those terms of use.

Qualifications & exceptions

  • Some online services may have separate or additional terms of use

Legal Rights & Agreement Rules · Restriction or exception

PHI is governed by the Notice of Privacy Practices, not this policy

HIPAA regulates PHI kept by covered entities and business associates and requires a Notice of Privacy Practices describing collection, use, and disclosure of PHI. PHI is part of the larger category of personal information, and the NPP terms apply to collection, use, and disclosure of PHI rather than this Privacy Policy. Individually identifiable health information collected on websites or mobile applications is generally PHI even without a current relationship or when information such as IP address or geographic location lacks specific treatment or billing details, and most information collected, used, and disclosed through online services is PHI subject to the applicable NPP.

Supporting quotations

The Health Insurance Portability and Accountability Act (HIPAA) regulates protected health information (PHI) kept by covered entities and business associates. HIPAA requires covered entities to have a Notice of Privacy Practices, which describes how entities collect, use, and disclose PHI.
PHI is part of the larger category of personal information, as defined below. The terms of the Notice of Privacy Practices will apply to the collection, use, and disclosure of PHI rather than this Privacy Policy. For example, individually identifiable health information collected on our websites or mobile applications is generally PHI, even if:
You do not have a current relationship with us and
The information, such as IP address or geographic location, does not include specific treatment or billing details.
Most of the information collected, used, and disclosed through use of our online services is PHI and is subject to the applicable Notice of Privacy Practices.

Qualifications & exceptions

  • even if you do not have a current relationship with us
  • even if the information, such as IP address or geographic location, does not include specific treatment or billing details

Data Access & Collection · Company practice

Personal information collected in several ways; mostly PHI

Personal information means individually identifiable information like your name, email address, and demographic information. Highmark collects it in several ways using tools, components, and features to conduct business operations, including understanding users, maintaining and improving online services, and customizing your user experience. Most information collected, used, and disclosed through online services is PHI. How you interact with the service determines the type and amount collected.

Supporting quotations

Section 1. Information That We Collect
We collect personal information about you in several ways. Personal information means individually identifiable information like your name, email address, and demographic information. We use various tools, components, and features (as described below) to collect this information to conduct our business operations. This includes understanding our users, maintaining and improving our online services, and customizing your user experience. Most of the information we collect, use, and disclose through our online services is PHI.
How you interact with our online service will determine the type and amount of personal information we collect. For general website browsing, we capture basic information such as:
What follows below are further details about the personal information we and service providers on our behalf collect, use, and disclose for our business purposes.

Qualifications & exceptions

  • Most of the information we collect, use, and disclose through our online services is PHI

Data Access & Collection · Company practice

Basic information captured during general website browsing

For general website browsing, Highmark captures basic information including browser types, IP addresses, device hardware models, referring URLs, user activity information, device and browser identifiers and characteristics, network and connection information, approximate (not precise) geolocation derived from IP address, technical signals and identifiers generated from device or browser, and security and fraud detection indicators.

Supporting quotations

How you interact with our online service will determine the type and amount of personal information we collect. For general website browsing, we capture basic information such as:
Browser types
IP addresses
Device hardware models
Referring URLs
User activity information (such as session time, pages or screens visited, buttons and links clicked, click streams, and crash reports)
Device and browser identifiers and characteristics (such as operating system, device type, browser configuration, and similar technical attributes)
Network and connection information (such as connection or session-level data)
Approximate (not precise) geolocation derived from IP address
Technical signals and identifiers generated from your device or browser (which may include probabilistic or statistical identifiers created from combinations of device, browser, and network characteristics)
Security and fraud detection indicators (such as signals or scores derived from the information above to help identify automated, malicious, or fraudulent activity)

Qualifications & exceptions

  • Approximate (not precise) geolocation derived from IP address

Data Access & Collection · Company practice

Identity verification for secure portal features

For other features, such as use of a secure portal, Highmark may need to verify your identity through a login process and collect enough personal information to respond to the service requested.

Supporting quotations

For other features, such as use of a secure portal, we may need to verify your identity through a login process and collect enough personal information to respond to the service requested.

Data Access & Collection · Company practice

Online inquiry forms collect contact and inquiry details

Online inquiry forms on Online Services for account questions or learning about products and services collect name, address, phone number, email address, and inquiry details. Submitting personal information gives Highmark and service providers on its behalf the right to transmit, monitor, retrieve, store, and use it to operate Online Services and for other business purposes; it may be used to review and respond to requests or contracted service providers may do so.

Supporting quotations

Online Forms We have online inquiry forms on our Online Services for account questions or to learn more about our products and services. The personal information collected on these forms may include your name, address, phone number, email address, and the details of your inquiry. When you submit personal information, you give us and service providers on our behalf the right to transmit, monitor, retrieve, store and use your information to operate the Online Services and for other business purposes. We may use such information to review and respond to your request or use contracted service providers to do that for us.

Qualifications & exceptions

  • When you submit personal information, you give us and service providers on our behalf the right to transmit, monitor, retrieve, store and use your information to operate the Online Services and for other business purposes.

Data Access & Collection · Company practice

Secure portals collect account, device, and session data

When accessing secure portals, Highmark and service providers on its behalf collect personal information like user ID and password, IP address, pages or screens visited, buttons and links clicked, click streams, and related session data; this may be recorded in transaction logs to monitor and improve content and functionality and comply with applicable law, and may also be used as stated in Section 2.

Supporting quotations

Secure Portals When you access our secure portals, we and service providers on our behalf collect certain personal information like user ID and password, IP address, pages or screens visited, buttons and links clicked, click streams, and related session data. The information received and collected through these portals may also be recorded in transaction logs. The information helps to monitor and improve content and functionality of the Online Services and our other services and to comply with applicable law and regulations. We and service providers on our behalf may also use information collected through secure portals as stated in Section 2 below.

Qualifications & exceptions

  • The information received and collected through these portals may also be recorded in transaction logs.

Data Access & Collection · Company practice

Interactive chat collects verification and session data

Interactive chat technology may collect name, date of birth, address, chat messages, and account number to verify you or provide customized details, and may capture session-related information like web logs; additional terms of use may apply.

Supporting quotations

Interactive Chat The Online Services may offer interactive chat technology to help you. This technology collects personal information like name, date of birth, address, chat messages, and account number to verify you or to provide you with customized details. This technology may also capture session-related information, like web logs, to document the interaction. Additional terms of use may apply to interactive chat features in addition to this Privacy Policy. We encourage you to read such terms.

Qualifications & exceptions

  • Additional terms of use may apply to interactive chat features in addition to this Privacy Policy.

Security & Safeguards · Company practice

Biometric login uses device-managed biometrics without collecting them

A mobile device may permit fingerprint, facial recognition, or similar biometric technology to log in. When enabled, Online Services can see the preference and that verification occurred through the mobile device and may permit access; Highmark does not access or collect actual biometrics, which the mobile device manufacturer manages and maintains.

Supporting quotations

Biometric Login Your mobile device may permit you to use fingerprint, facial recognition, or similar biometric technology to login to our Online Service. When this is enabled, our Online Services can see that you have selected this as a preference and have been verified through your mobile device, and you may be permitted to access our Online Services with that technology. When you use a biometric login, we do not have access to or collect any of the actual biometrics (e.g., fingerprints or facial images). Your mobile device manufacturer manages and maintains that information (e.g., Apple, Samsung).

Qualifications & exceptions

  • Your mobile device manufacturer manages and maintains that information (e.g., Apple, Samsung).

Data Access & Collection · Company practice

Precise geolocation collected with mobile consent

With your consent through your mobile device, Highmark may use the location services function on your mobile device to collect your precise geolocation data, and uses it to help you find local products and services and provide relevant content based on your location.

Supporting quotations

Geolocation Functionality With your consent through your mobile device, we may use the location services function on your mobile device to collect your precise geolocation data. We use this data to help you find local products and services, and to provide you with relevant content based on your location.

Qualifications & exceptions

  • With your consent through your mobile device

Data Access & Collection · Company practice

Mobile app collects device type, OS, and device identifier

When run on a mobile device, Highmark collects certain personal information; if you download a mobile application, it collects device type, software/operating system, and device identifier, used to better understand who is using Online Services and how, and to improve technical support capabilities.

Supporting quotations

Mobile Device We collect certain personal information when run on a mobile device. For example, if you download one of our mobile applications, we collect information about the device type, its software/operating system, and the device identifier. We use this information to better understand who is using our Online Services and how they are using the Online Services and to improve our technical support capabilities.

Data Access & Collection · Company practice

First-party cookies operate and personalize Online Services

Online Services use first-party cookies and similar technology that Highmark creates to help them operate properly, monitor performance, improve experience, better understand who is using Online Services and how, and may use information from first-party cookies to provide personalized content and improve offerings.

Supporting quotations

Our Online Services use first-party cookies and similar technology (that we create) to help them operate properly, monitor their performance, improve your experience, and better understand who is using our Online Services and how they are using the Online Services. We may also use the information we get from first-party cookies to provide visitors and users with personalized content and improve our offerings.

Sharing & Disclosure · Company practice

Third-party cookies used by service providers on Highmark's behalf

Online Services also use third-party cookies and similar technology used and controlled by service providers on Highmark's behalf, as permitted by applicable law, to better understand usage, understand digital journey from external sources, and improve Online Services and other services. Service providers including Adobe and Freshpaint may collect information through cookies and similar technologies on Highmark's behalf; they are not allowed to use collected information for any purpose other than providing their services.

Supporting quotations

Our Online Services also use third-party cookies and similar technology (ones used and controlled by service providers on our behalf), as permitted by applicable law, to better understand who is using our Online Services and how they are using the Online Services (such as session time, pages or screens visited, buttons and links clicked, click streams, and crash reports), understand your digital journey from external sources to our Online Services, and improve our Online Services and other services. For example, we allow service providers, including Adobe and Freshpaint, to collect information through cookies and similar technologies on our behalf to collect the information described above to help us monitor, evaluate, and improve our Online Services, content, and services. These service providers are not allowed to use information they collect for any purpose other than providing their services to us.

Qualifications & exceptions

  • as permitted by applicable law

Sharing & Disclosure · Company practice

Third-party widgets are governed by third parties' privacy standards

Third-party widgets such as Twitter and LinkedIn on Online Services are owned and controlled by third parties, are there for convenience only, and do not reflect affiliation or endorsement. Clicking a widget takes you to that third party's home page, and any data collection, use, and disclosure is subject to that third party's privacy standards, not this Policy. Highmark makes no representations or warranties regarding third-party platforms or components when you leave the site and recommends reviewing applicable third parties' privacy standards. Redirecting hyperlinks or embedded third-party media content may also be present; Highmark does not manage or configure that content or control code linked to it, and reviewing such content constitutes acknowledgement, acceptance, and express consent to associated data collection, use, and disclosure between Highmark and the media host.

Supporting quotations

Third-Party Widgets You may see third-party widgets (e.g., Twitter, LinkedIn) on our online services. These widgets (icons) are owned and controlled by third parties and not by us. These widgets are there for convenience only, and do not reflect an affiliation with or endorsement of the third-party. If you click a widget, you will be taken to the home page of that third-party. Any data collection, use, and disclosure activities will be subject to that third party’s privacy standards (and not this Privacy Policy). Here’s an example: We maintain a LinkedIn page, but we have no control over how LinkedIn, as a third party, collects, uses, or discloses information about you when you visit the LinkedIn platform.
When you click a third-party widget and leave our site, we make no representations or warranties regarding third-party platforms or components, their content, data management, or security. You should review the privacy standards of the applicable third parties.
Redirecting Hyperlinks and Embedded Third-Party Media Our online services may contain redirecting hyperlinks or embedded third-party media content. An example includes YouTube videos which may be tile images that redirect to YouTube when clicked. Another example is an embedded file which will begin playing on our web pages when clicked. We do not manage or configure this third-party content. We do not control any code which may be linked to this content by the media host or any data collection which might occur as a result of such code. When you review this content on our online services, you acknowledge, accept, and expressly consent to any associated data collection, use, and disclosure which might occur between us and the media host.

Qualifications & exceptions

  • Third-party widgets are there for convenience only, and do not reflect an affiliation with or endorsement of the third-party.

Use & Processing · Company practice

Additional uses of personal information

Information obtained through Online Services is used for the purposes stated in Section 1; additional uses may include providing product, program, and service updates, event notices, details about new offerings, and announcements; updating and maintaining information about you; monitoring the value of online services and features; ensuring digital resources run as intended and meet expectations; verifying you as an authorized user and unique individual including through device, browser, and network-related signals; evaluating your individual experience; helping assess and improve products, programs, services, and digital offerings; carrying out marketing, advertising, and general commercial business purposes; and detecting, preventing, and investigating security incidents, automated activity, or fraudulent or malicious actions using technical signals, identifiers, or risk indicators derived from device, browser, and network information.

Supporting quotations

Section 2. Use, Access, and Disclosure Of This Information
We use the information we get through our online services for the purposes stated in Section 1 above. Any additional uses may include:
Providing product, program, and service updates, event notices, details about new offerings, and announcements of interest.
Updating and maintaining information about you.
Monitoring the value of our online services and features.
Ensuring our digital resources run as intended and meet your expectations.
Helping us verify you as an authorized user and unique individual, including through the use of device, browser, and network-related signals.
Evaluating your individual experience across our Online Services and content.
Helping us assess and improve our products, programs, services, and digital offerings.
Carrying out our marketing, advertising, and general commercial business purposes.
Detecting, preventing, and investigating security incidents, automated activity, or fraudulent or malicious actions, including through the use of technical signals, identifiers, or risk indicators derived from device, browser, and network information.

Qualifications & exceptions

  • We use the information we get through our online services for the purposes stated in Section 1 above.

Use & Processing · Company practice

Marketing and partner communications with opt-out

Highmark may use personal information to give information about additional products, programs, and services offered by its family of companies or business partners; you may remove yourself from certain communication channels or programs at any time by following opt-out instructions in those communications.

Supporting quotations

We may also use your personal information to give you information about additional products, programs, and services offered by our family of companies or our business partners. You may remove yourself from certain communication channels or programs at any time — just follow the opt-out instructions included in those communications.

Qualifications & exceptions

  • You may remove yourself from certain communication channels or programs at any time — just follow the opt-out instructions included in those communications.

Sharing & Disclosure · Company commitment

Personal information is not sold

Highmark does not sell your personal information for money or other consideration.

Supporting quotations

We do not sell your personal information for money or other consideration.

Sharing & Disclosure · Company practice

Disclosure to service providers bound by contract

Highmark may disclose personal information collected through Online Services to service providers and may allow them to directly collect personal information in connection with Online Services, for example to send surveys or newsletters or assist with security, fraud detection, analytics, or system operations. Service providers including Adobe and Freshpaint may collect personal information as described above, and are bound by contract to protect personal information.

Supporting quotations

Disclosure To Service Providers We may disclose your personal information collected through our Online Services to service providers and may allow these service providers to directly collect your personal information in connection with our Online Services. For example, a service provider may have access to your information to send you a survey or a newsletter or to assist with security, fraud detection, analytics, or system operations on our behalf. We also have service providers, including Adobe and Freshpaint, collect personal information about users of our Online Services as described above. Our service providers are bound by contract to protect your personal information.

Qualifications & exceptions

  • Our service providers are bound by contract to protect your personal information.

Sharing & Disclosure · Restriction or exception

Personal information disclosed to third parties only in limited cases

Third parties can also refer to entities or bodies with which Highmark has no contractual or commercial relationship but shares data as permitted or required by law, such as government oversight agencies. Highmark generally does not disclose personal information collected through online services to third parties except as set forth in this Privacy Policy or as permitted or required by law. At times, personal information may be disclosed to a third party if there is a specific legal need, a need to complete a transaction requested by you, or it is needed to provide a service or benefit to you.

Supporting quotations

Third parties can also refer to other types of entities or bodies that we do not have a contractual or commercial relationship with, but that we share data with as permitted or required by law (e.g., government oversight agencies). We generally do not disclose personal information collected through our online services to third parties except as set forth in this Privacy Policy, or as permitted or required by law. At times, personal information may be disclosed to a third party if:
There is a specific legal need,
There is a need to complete a transaction requested by the you, or
It is needed to provide a service or benefit to you.

Legal Rights & Agreement Rules · Restriction or exception

COPPA: online services not intended for children under 13

Online services are not generally intended for, nor made available to, children under the age of 13, and Highmark typically does not try to collect, use, or disclose information from children under 13, unless otherwise permitted or required by applicable law.

Supporting quotations

Children's Online Privacy Protection Act (COPPA) Our online services are not generally intended for, nor made available to, children under the age of 13. We typically do not try to collect, use, or disclose information from children under the age of 13, unless otherwise permitted or required by applicable law.

Qualifications & exceptions

  • unless otherwise permitted or required by applicable law

Legal Rights & Agreement Rules · Context

GDPR duties for certain entities or product lines

Some Highmark Health entities or product lines may be subject to certain duties set by the GDPR; for those entities or product lines, a notice that meets GDPR's requirements will be shown on the entities' public websites.

Supporting quotations

European Union General Data Protection Regulation (GDPR) Some of our entities or product lines may be subject to certain duties set by the GDPR. For those entities or product lines, a notice that meets GDPR’s requirements will be shown on the entities’ public websites.

Qualifications & exceptions

  • Some of our entities or product lines may be subject to certain duties set by the GDPR.

Not stated here

  • Which entities or product lines are subject to GDPR is not specified.

Legal Rights & Agreement Rules · Context

State consumer privacy laws for certain entities

Some Highmark Health entities may be subject to certain duties set by state consumer privacy laws, such as those in California and Colorado, which require posting a consumer notice on data collection, use, and disclosure activities; for entities subject to these requirements, notices aligned to those specific state laws will be shown on those entities' public websites.

Supporting quotations

State Consumer Privacy Laws Some of our entities may be subject to certain duties set by state consumer privacy laws, such as those set in California and Colorado. These laws require posting a consumer notice on data collection, use, and disclosure activities. For our entities that may be subject to these requirements, notices aligned to those specific state laws will be shown on those entities’ public websites.

Qualifications & exceptions

  • such as those set in California and Colorado

Not stated here

  • Which entities are subject to these laws is not specified.

Legal Rights & Agreement Rules · Company practice

Policy may change at any time; continued use confirms consent

Highmark reserves the right to change, modify, or update this Privacy Policy at any time and for any reason, and will promptly post such changes to Online Services. Users should review the Policy periodically to stay informed. Continued use of Online Services confirms acknowledgement and acceptance of the conditions in this Privacy Policy and express consent to collect, use, and disclose information in accordance with applicable law.

Supporting quotations

We reserve the right to change, modify, or update this Privacy Policy at any time and for any reason. We will promptly post such changes, modifications, or updates to our Online Services. Please review this Privacy Policy every so often to keep informed of any changes. Remember that continued use of our Online Services confirms i) your acknowledgement and acceptance of the conditions contained in this Privacy Policy, and ii) your express consent to collect, use, and disclose your information in accordance with applicable law.

Qualifications & exceptions

  • We reserve the right to change, modify, or update this Privacy Policy at any time and for any reason.

Legal Rights & Agreement Rules · Procedure

Questions about the Privacy Policy

Questions about this Privacy Policy can be directed to Highmark by emailing HighmarkHealthPrivacy@highmarkhealth.org or calling 1-866-228-9424.

Supporting quotations

Questions If you have questions about this Privacy Policy, please contact us by emailing HighmarkHealthPrivacy@highmarkhealth.org or calling 1-866-228-9424.

Legal Rights & Agreement Rules · Context

Highmark Health includes subsidiaries and affiliates

Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.

Supporting quotations

1 Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including, among others, Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.