Highmark Notice of Privacy Practices

Highmark · Official agreement

34 cards.

Notice of Privacy Practices

Sept. 2025 | Y0037_25_3475_C

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW HEALTH AND FINANCIAL INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our responsibilities

At Highmark Health, including its wholly-owned health plan subsidiaries and affiliates (Highmark), we value your privacy. When it comes to managing your information, we are required by law to maintain the privacy and security of your health and non-public personal (financial) information and to provide you with notice of your rights and our duties to keep your information safe and confidential. This Notice of Privacy Practices combines two required privacy notices:

In the normal course of doing business, we collect information as necessary to provide you with health insurance products, help manage the treatment you receive, pay for your health services, and to run our business. The information we collect is called Protected Health Information (PHI). PHI is health and financial information that identifies you, or could be used to identify you, and was created or received by a health care provider, a health plan, a health care clearinghouse, or vendor performing activities on behalf of one of these organizations, or your employer (if a group health plan), and is related to one of the following:

This Notice describes our privacy practices, which includes how we use, disclose (share), collect, manage, and protect your PHI and other non-public personal information. This Notice applies to all electronic and paper records we create, obtain, or maintain about you as a member, as well as all forms of communication (oral, written, and electronic) of this information. This Notice does not apply to Highmark in the context of being an employer.

How we protect your privacy

We understand the importance of protecting the confidentiality of your information. We restrict access to your PHI and personal information to those employees, agents, consultants, and health care providers who need to know the information to provide products or services. We maintain physical, electronic, and procedural safeguards that comply with state and federal regulations to protect personal information against unauthorized use, access, and disclosure. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI or non-public personal information.

How we use and share your information

We use and share PHI and other non-public personal information we collect only as necessary to deliver products and services to our members, to operate our business, or to comply with legal requirements. For example, we may use your PHI and non-public personal information internally to manage enrollment, process claims, or audit our operations. We share PHI and non-public personal information with our affiliated companies and non-affiliated third parties, as permitted by law, who assist us in administering our programs, coordinating care, and delivering products and services to our members. We may also share PHI and non-public personal information with other third-party service providers that cooperate with us to jointly promote or administer health insurance products or services. Our contracts with all such service providers require them to protect the confidentiality of our members’ information.

Please be advised that once information is shared with a third party other than a health care provider, health plan, or other person subject to federal privacy laws – for example, if you fill out an authorization form directing us to share your PHI with a life insurance carrier – the information may no longer be subject to privacy and security protections, and the recipient may use or share that information for other purposes.

Uses of PHI without your authorization

We have the right to collect, use, and share your PHI, if needed, without your written authorization while providing your health benefits. We have listed a few examples of how we use your information without authorization.

  • Help manage the health care you receive: To manage the health care you receive, we can use your PHI and share it with health care professionals that are treating you. For example, a doctor sends us information about your diagnosis and treatment plan so we can arrange additional services or assess the quality of your care.
  • Pay for your health services: We may use and share your PHI as we pay for your health services. For example, we share information about you with your health care provider to coordinate payment for your particular treatment.
  • Run our business: We may use and share your PHI to run our business and contact you when necessary. For example, we use information about you to develop and enhance products and services offered to our members, and we may share your information among our subsidiaries and affiliated entities for purposes permitted by applicable law.
  • Administer your benefits: We may share your PHI with your group health plan administrator to perform administrative functions for the benefit plan in which you participate. For example, your employer contracts with us to administer health coverage, and we provide your employer’s plan administrator with certain information to explain the premiums we charge, or to enroll or disenroll members in the benefit plan.

We may collect, use, and share your information in other ways without your authorization. We must meet certain conditions in the law before we can share your information for these purposes. The following are some of those examples.

  • As required by law: We may share your PHI if federal or state law requires the use or disclosure. For example, we must share your PHI with the U.S. Department of Health and Human Services if they want to see that we are following federal privacy laws.
  • Help with public health and safety issues: We can share your PHI for certain situations such as: o Preventing or controlling disease, injury, or disability; o Reporting abuse, neglect, or domestic violence; o Helping with product recalls; o Reporting adverse reactions to medications; o Preventing or reducing a serious threat to anyone’s health or safety.
  • Respond to lawsuits and legal actions: We may share your PHI in response to certain legal requests. For example, we may share your PHI in response to a court order, administrative order, or subpoena that complies with applicable law.
  • Respond to requests from coroners, medical examiners, funeral directors, and organ donation

agencies: We may share PHI with a coroner or medical examiner to identify deceased persons and the cause of death. If necessary, we will share PHI with funeral directors. Further, we may share PHI with organizations that handle organ, eye, or tissue donation and transplantation.

government requests: We can use or share your PHI when needed: o For workers’ compensation claims; o For law enforcement purposes or with a law enforcement official; o With health oversight agencies for activities authorized by law; o For special government functions such as military, national security, and presidential protective services.

  • Cookies and online services: We may collect information obtained when you visit and utilize Highmark websites (including My Highmark or other online benefit sites) or mobile device applications. Through the use of cookies, pixels, and other digital tracking technologies, we may collect and share information about your use of these digital services, pursuant to applicable laws, to operate our business and improve our product and service offerings.
  • Underwriting Purposes: We may use or disclose PHI for underwriting purposes, but we are prohibited from pricing your coverage or denying you coverage based on genetic information.
  • Business Associates: We may contract with outside entities that perform business services for us that may require them to use or access your PHI. These entities are called business associates. We will have a written contract in place with the business associate requiring protection of the privacy and security of your health information. For example, we may share your PHI with a business associate to analyze your use of our websites and mobile device applications including, but not limited to, access times, pages viewed, etc. We may also use your PHI to develop, operate, and improve machine learning and other artificial intelligence solutions, for example, to support transcription of customer service calls or claims processing. You should review our Digital Privacy Policy and any applicable Terms of Use for supplemental details regarding our online services, the information we collect, and the terms associated with a particular website or application.
  • Health Information Exchange (HIE): We may participate in certain Health Information Exchanges (HIEs), which may be an opt-in or opt-out model. An HIE is a secure electronic data sharing network which allows us to share health information electronically with other healthcare entities, such as insurers, health systems, hospitals, and physicians participating in your care for the purposes of treatment, payment, and healthcare operations. The health information we may share includes your claims, medical history, diagnosis, notes, test results, current medications, allergies, immunizations, and other vital information needed for your care. All providers who participate in an HIE have agreed to privacy and security rules to protect your health information from unauthorized access, use or disclosure. You cannot choose to have only certain providers access your information. If you do not want your health information to be accessed through an HIE, you may choose not to participate or “opt-out” where applicable. Even if you opt-out, this will not prevent your health information from being shared in other ways as authorized or allowed by law for purposes such as managing your health care, paying claims for services you received, or administering your benefits.
  • Organized Health Care Arrangement (OHCA): Highmark and its affiliated system of healthcare providers, Allegheny Health Network (AHN), participate in an OHCA to conduct analysis for quality assessment and improvement activities, utilization review and related activities to facilitate more effective and efficient health care services for our members and patients. Individual PHI may be accessed, used and/or disclosed as necessary to carry out treatment, payment, or health care operations relating to the OHCA.
  • Inmates. If you are an inmate of a correctional institution, we may share your PHI with the correctional institution to provide you with health care, or to protect your health and safety or the health and safety of others.

Uses of PHI that require your authorization

Sometimes we are required to obtain your written authorization for the use and disclosure of your PHI. For example, we would need your authorization:

Withdrawal

We will not use or share your information other than as described in this Notice, or as permitted or required by applicable law, unless you tell us we can in writing. You may change your mind at any time by letting us know in writing. Any change or withdrawal of authorization will be effective for future uses and disclosures of PHI. It will not impact use of information or disclosures that we have already made while your previous authorization was in effect.

Compliance with State and Federal laws

We are required to comply with federal and state laws when they offer greater privacy protection for certain types of PHI. Where such laws apply, we will follow the stricter laws related to the use and sharing of sensitive PHI, such as:

Your personal information

We may also collect, use, and share other non-public personal information to administer our health and benefit programs. Personal information identifies you and may include such items as your name, address, telephone number, date of birth and Social Security number, or it may relate to health care services or premium payment history. We collect your personal information either directly from you or from others such as doctors, hospitals, or other insurers, as applicable. In some cases, we may also share your personal information with third parties and without your authorization as permitted or required by law. If sharing your personal information for a specific reason requires us to give you a chance to opt-out, we will give you that opportunity.

Your choices

For certain health information, you can tell us your choices about what we share. We may use and share your information in the situations described below but you have the right to limit or object to sharing information for these reasons.

  • Under certain circumstances, we may share your PHI with your family or close friends that you have identified as being involved in your health care or payment for your health care, unless you tell us not to do so. If you are unable to provide us permission, then we may provide the information we determine is in your best interest based on our professional judgement.
  • We may share your information in a disaster relief situation.
  • We may use or share your name, address, phone number, and the dates you received services to contact you to support our fundraising efforts, consistent with applicable laws.

Your individual rights

When it comes to your health information, you have certain rights. The following is a description of those rights. Any request must be in writing and signed by you or your authorized representative. You can obtain more information about how to submit your request by calling the Customer Service phone number on the back of your Member ID card. You may also request more information or submit your request in writing to the contact listed at the end of this Notice.

  • Get a copy of your health and claims records: You can ask to review or receive copies of your health and claims records that we have about you in a designated record set. We will provide a copy or summary of your health and claims records. We may charge a reasonable cost-based fee.
  • Get a list of those with whom we have shared information: You can ask for a list (an “accounting”) of the times we have shared your PHI that are for reasons other than treatment, payment, health care operations, or those which you authorized. You may request the date range you want to review; however, this is limited to 6 years before the date of your request.
  • Ask us to limit what we use or share: You can ask us not to use or share certain health information about you for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it is not consistent with the law, our policies, or our business operations.
  • Request confidential communications: You can ask us to contact you in a specific way, or at a different address, if you believe that sharing your PHI could place you in danger. For example, you may ask that we contact you only at your work address or your work email.
  • Ask us to correct or amend health and claims records: You can ask us to correct, or amend, your health and claims records if you believe they are incorrect or incomplete. Your request must explain why you believe the information needs to be corrected. We may say “no” to your request, but we will tell you why in writing.
  • Choose someone to act for you: If you have given someone medical power of attorney or if someone is your legal guardian or other authorized representative, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
  • Get a paper copy of this Notice: You can ask for a paper copy of this Notice, even if you have agreed to receive the Notice electronically.

Changes to the terms of this Notice

On an ongoing basis, it may become necessary to revise the terms of this Notice. Any changes will apply to all information we have about you. If the Notice significantly changes, the new Notice will be available upon request, on our website, and we will mail a copy to you in our annual mailing.

Complaints

If you want more information about our privacy practices or are concerned that we may have violated your privacy rights, you can complain to us using the following contact information:

Privacy Operations

120 Fifth Avenue Place

Suite 2114

Pittsburgh, PA 15222

1-800-985-2050

HighmarkHealthPrivacy@highmarkhealth.org

You may also file a complaint with the U.S. Department of Health and Human Services by using the following contact information:

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue S.W.

Washington, D.C. 20201

1-877-696-6775 hhs.gov/ocr/privacy/hipaa/complaints

We support your right to protect the privacy of your PHI. We will not retaliate in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

Effective date

We must follow the privacy practices described in this Notice while it is in effect. This Notice is revised and effective as of Sept. 2025 and will remain in effect unless we replace it.

ADDITIONAL PROVISIONS: PRIVACY PRACTICES RELATED TO SUBSTANCE USE DISORDER (SUD) RECORDS

These additional provisions to this Notice apply only to federally regulated SUD records. Your SUD records will be protected by federal and state privacy laws. Unless specifically indicated in these additional provisions, your SUD records will have the same protections and you will have the same rights as described elsewhere in this Notice. The following provisions identify added protections for SUD records, as required by law.

When we can use and share your SUD records

For PHI collected by a SUD program governed by federal regulations, your consent will be obtained for all future uses or disclosures for treatment, payment, and healthcare operations before sharing such information consistent with applicable privacy laws. We may also obtain your consent to disclose SUD records to prevent multiple enrollments in withdrawal management or maintenance treatment programs, or to persons within the criminal justice system who have made participation in the substance use disorder program a condition of the disposition of any criminal proceedings against you or of your parole, or other release from custody, provided the disclosure is permitted by applicable privacy laws. In most cases, your consent is obtained for this when you begin treatment with a program covered under federal regulations. Except as described in these additional provisions, any other uses or disclosures of your SUD records will require your written consent.

Records that we share with your consent to a third party regulated by federal privacy laws may be further disclosed, without your written consent, by the third party, to the extent permitted by federal privacy laws.

We may use and share SUD records without your consent for the following reasons when all conditions required by federal law are met: medical emergencies, scientific research, management audits, financial audits, program evaluation, and disclosures to public health authorities when the health records are de-identified.

Prohibition on sharing records in civil, criminal, administrative or legislative proceedings

We will not use or share your SUD records (or provide testimony based on such information) in any civil, criminal, administrative, or legislative proceedings against you, unless you have provided your written consent, or a special type of court order has been obtained, and you have had the opportunity to object.

Opt-out for fundraising

We will only use or share records to fundraise for the benefit of a SUD treatment program if you are first provided with an option to elect not to receive fundraising communications.

You can request to no longer receive fundraising communications following your participation in a SUD program, even if you initially permitted us to send such communications.

*Highmark Health includes the wholly-owned subsidiaries and affiliates making up the Highmark Health enterprise, including, among others, Highmark Inc., Highmark Wholecare, Highmark Health Options, Allegheny Health Network, and other affiliated businesses such as enGen, Helion, HM Insurance Group and United Concordia Companies Inc. References to “us,” “we,” and “our” in this Privacy Policy mean Highmark Health.

All references to “Highmark” in this document are references to the Highmark company that is providing the member’s health benefits or health benefit administration and/or to one or more of its affiliated Blue companies. Benefits and/or benefit administration may be provided by or through the following entities, which are independent licensees of the Blue Cross Blue Shield Association:

  • Western and Northeastern PA: Highmark Inc. d/b/a Highmark Blue Cross Blue Shield, Highmark Choice Company, Highmark Health Insurance Company, Highmark Coverage Advantage Inc., Highmark Benefits Group Inc., First Priority Health, First Priority Life, Highmark Senior Health Company, Highmark Care Benefits Inc., or Gateway Health Plan, Inc. d/b/a Highmark Wholecare.
  • Central and Southeastern PA: Highmark Inc. d/b/a Highmark Blue Shield, Highmark Benefits Group Inc., Highmark Health Insurance Company, Highmark Choice Company, Highmark Senior Health Company, or Gateway Health Plan, Inc. d/b/a Highmark Wholecare.
  • Pennsylvania: Your plan may not cover all your health care expenses. Read your plan materials carefully to determine which health care services are covered. For more information, call the number on the back of your member ID card or, if not a member, call 866-459-4418.
  • Delaware: Highmark BCBSD Inc. d/b/a Highmark Blue Cross Blue Shield or Highmark BCBSD Health Options Inc. d/b/a Highmark Health Options.
  • West Virginia: Highmark West Virginia Inc. d/b/a Highmark Blue Cross Blue Shield, Highmark Health Insurance Company, Highmark Senior Solutions Company, or Highmark Health Options West Virginia Inc. d/b/a Highmark Health Options and Highmark Blue Cross Blue Shield. Visit https://www.highmarkbcbswv.com/networkaccessplan to view the Access Plan required by the Health Benefit Plan Network Access and Adequacy Act. You may also request a copy by contacting us at the number on the back of your ID card.
  • Western NY: Highmark Western and Northeastern New York Inc. d/b/a Highmark Blue Cross Blue Shield.
  • Northeastern NY: Highmark Western and Northeastern New York Inc. d/b/a Highmark Blue Shield.