General use and sharing of PHI and non-public personal information
Highmark uses and shares PHI and other non-public personal information only as necessary to deliver products and services to members, operate its business, or comply with legal requirements. It shares with affiliated companies and non-affiliated third parties as permitted by law who assist in administering programs, coordinating care, and delivering products and services; contracts with service providers require confidentiality. Once information is shared with a third party other than a health care provider, health plan, or other person subject to federal privacy laws, it may no longer be subject to those privacy and security protections and the recipient may use or share it for other purposes.
Supporting quotations
We use and share PHI and other non-public personal information we collect only as necessary to deliver products and services to our members, to operate our business, or to comply with legal requirements.
Please be advised that once information is shared with a third party other than a health care provider, health plan, or other person subject to federal privacy laws – for example, if you fill out an authorization form directing us to share your PHI with a life insurance carrier – the information may no longer be subject to privacy and security protections, and the recipient may use or share that information for other purposes.
Sharing & Disclosure · Company practice
Uses of PHI without written authorization: overview
Highmark has the right to collect, use, and share PHI, if needed, without written authorization while providing health benefits, and lists examples. It may also collect, use, and share information in other ways without authorization where it meets certain conditions in the law.
Supporting quotations
We have the right to collect, use, and share your PHI, if needed, without your written authorization while providing your health benefits. We have listed a few examples of how we use your information without authorization.
We may collect, use, and share your information in other ways without your authorization. We must meet certain conditions in the law before we can share your information for these purposes. The following are some of those examples.
Sharing & Disclosure · Company practice
Uses of PHI without authorization: treatment, payment, and operations
Without written authorization, Highmark may use and share PHI to manage the health care the member receives (including sharing with treating professionals), to pay for health services, to run its business and contact the member when necessary (including sharing among subsidiaries and affiliated entities), and to administer benefits (including sharing with a group health plan administrator).
Supporting quotations
Help manage the health care you receive: To manage the health care you receive, we can use your PHI and share it with health care professionals that are treating you.
Pay for your health services: We may use and share your PHI as we pay for your health services.
Run our business: We may use and share your PHI to run our business and contact you when necessary.
Administer your benefits: We may share your PHI with your group health plan administrator to perform administrative functions for the benefit plan in which you participate.
Sharing & Disclosure · Company practice
Uses of PHI without authorization: legal and public purposes
Without written authorization, Highmark may share PHI as required by federal or state law (including with the U.S. Department of Health and Human Services for compliance oversight); for public health and safety issues; in response to certain legal requests such as court or administrative orders or compliant subpoenas; with coroners, medical examiners, funeral directors, and organ/tissue donation organizations; for health research subject to certain criteria; for workers' compensation, law enforcement, health oversight, and special government functions; and for underwriting, although pricing coverage or denying coverage based on genetic information is prohibited.
Supporting quotations
As required by law: We may share your PHI if federal or state law requires the use or disclosure.
Help with public health and safety issues: We can share your PHI for certain situations such as:
Respond to lawsuits and legal actions: We may share your PHI in response to certain legal requests.
Respond to requests from coroners, medical examiners, funeral directors, and organ donation
agencies: We may share PHI with a coroner or medical examiner to identify deceased persons and the cause of death.
Do research: We can use or share your information for health research purposes, subject to certain criteria.
Address workers’ compensation, law enforcement, health oversight activities, and other
government requests: We can use or share your PHI when needed:
Underwriting Purposes: We may use or disclose PHI for underwriting purposes, but we are prohibited from pricing your coverage or denying you coverage based on genetic information.
Qualifications & exceptions
Underwriting use is permitted but pricing coverage or denying coverage based on genetic information is prohibited.
Sharing & Disclosure · Company practice
Business associates and supplemental digital policies
Highmark may contract with outside entities performing business services that may require use or access to PHI. These business associates are under written contract requiring protection of privacy and security of health information. PHI may be shared with a business associate to analyze use of websites and mobile applications, and may be used to develop, operate, and improve machine learning and other artificial intelligence solutions. Members are directed to review the Digital Privacy Policy and applicable Terms of Use for supplemental details regarding online services, collected information, and terms associated with a particular website or application.
Supporting quotations
Business Associates: We may contract with outside entities that perform business services for us that may require them to use or access your PHI.
Not stated here
The Digital Privacy Policy and Terms of Use referenced for supplemental online-service details are not supplied in this source; this card cannot describe their contents.
Sharing & Disclosure · Company practice
Health Information Exchange (HIE)
Highmark may participate in Health Information Exchanges, which may be opt-in or opt-out. An HIE is a secure electronic data sharing network allowing sharing of health information with other healthcare entities participating in the member's care for treatment, payment, and healthcare operations. Even if a member opts out, information may still be shared in other ways authorized or allowed by law.
Supporting quotations
Health Information Exchange (HIE): We may participate in certain Health Information Exchanges (HIEs), which may be an opt-in or opt-out model.
Qualifications & exceptions
Opt-out prevents access through an HIE but does not prevent other authorized or legally allowed sharing.
Sharing & Disclosure · Company practice
Organized Health Care Arrangement (OHCA)
Highmark and its affiliated healthcare provider system Allegheny Health Network participate in an OHCA to conduct analysis for quality assessment and improvement, utilization review, and related activities. Individual PHI may be accessed, used, and/or disclosed as necessary to carry out treatment, payment, or healthcare operations relating to the OHCA.
Supporting quotations
Organized Health Care Arrangement (OHCA): Highmark and its affiliated system of healthcare providers, Allegheny Health Network (AHN), participate in an OHCA
Sharing & Disclosure · Company practice
Inmates of correctional institutions
If the member is an inmate of a correctional institution, Highmark may share PHI with the correctional institution to provide health care or to protect the health and safety of the member or others.
Supporting quotations
Inmates. If you are an inmate of a correctional institution, we may share your PHI with the correctional institution to provide you with health care, or to protect your health and safety or the health and safety of others.
Sharing & Disclosure · Restriction or exception
Uses and disclosures requiring written authorization
Highmark must obtain written authorization to use or disclose PHI for certain marketing purposes, to sell information, to share substance use disorder counseling notes, and to share psychotherapy notes.
Supporting quotations
Sometimes we are required to obtain your written authorization for the use and disclosure of your PHI.
To use your PHI for certain marketing purposes;
To sell your information;
To share your substance use disorder counseling notes; and
To share your psychotherapy notes.
Cross-references
narrows (model-proposed): Uses of PHI without written authorization: overview — exception_to: Certain uses and disclosures require written authorization even though PHI may otherwise be used and shared without authorization for treatment, payment, and operations.
Sharing & Disclosure · Company practice
SUD records: use and sharing
For PHI collected by a SUD program governed by federal regulations, consent is obtained for all future uses or disclosures for treatment, payment, and healthcare operations before sharing. Consent may also be obtained to disclose SUD records to prevent multiple enrollments in withdrawal management or maintenance treatment programs, or to persons within the criminal justice system who have made participation a condition of disposition of criminal proceedings or parole/release, as permitted by applicable privacy laws. Consent is usually obtained when treatment begins. Except as described, any other uses or disclosures of SUD records require written consent. Records shared with consent to a third party regulated by federal privacy laws may be further disclosed by that third party without written consent to the extent permitted by federal privacy laws. SUD records may be used and shared without consent for medical emergencies, scientific research, management audits, financial audits, program evaluation, and disclosures to public health authorities when records are de-identified.
Supporting quotations
For PHI collected by a SUD program governed by federal regulations, your consent will be obtained for all future uses or disclosures for treatment, payment, and healthcare operations before sharing such information consistent with applicable privacy laws.
Records that we share with your consent to a third party regulated by federal privacy laws may be further disclosed, without your written consent, by the third party, to the extent permitted by federal privacy laws.
We may use and share SUD records without your consent for the following reasons when all conditions required by federal law are met: medical emergencies, scientific research, management audits, financial audits, program evaluation, and disclosures to public health authorities when the health records are de-identified.