The Health Insurance Portability and Accountability Act and its implementing regulations (HIPAA) regulates protected health information (PHI) kept by covered entities and business associates. HIPAA requires covered entities to have a Notice of Privacy Practices (NPP), which describes how entities collect, use, and disclose PHI.
The terms of our NPP will apply to the collection, use, and disclosure of PHI rather than this Privacy Policy. Most of the information collected, used, and disclosed through use of our Online Services is PHI and is subject to our NPP. For example, individually identifiable health information collected on or through our Online Services is generally PHI, even if:
We encourage you to fully read this Privacy Policy. This Privacy Policy creates an agreement between you and Highmark Health when you use any of our Online Services. Some of our Online Services may have separate or additional terms of use which will also apply, and this Privacy Policy is hereby incorporated into and made a part of those terms of use by this reference. Please review those terms of use.
Your use of our Online Services confirms:
We collect personal information about you in several ways. Personal information means individually identifiable information like your name, email address, and demographic information. We and service providers on our behalf use various tools, components, technologies, and features (as described below) to collect this information to conduct our business operations. This includes understanding how our Online Services are used by you, maintaining and improving our Online Services, and customizing your user experience.
How you arrive at, use, and interact with our Online Service will determine the type and amount of personal information we collect. For general access, browsing, and use of Online Services, we and service providers on our behalf capture and generate information such as:
For other features, such as use of a secure portal, we may need to verify your identity through a login process and collect enough personal information to respond to the service requested.
What follows below are further details about the personal information we and service providers on our behalf collect, use, and disclose for our business purposes.
We have online inquiry forms on our Online Services for account questions or to learn more about our products and services. The personal information collected on these forms may include your name, address, phone number, email address, and the details of your inquiry. When you submit personal information, you give us and service providers on our behalf the right to transmit, monitor, retrieve, store and use your information to operate the Online Services and for other business purposes. We may use such information to review and respond to your request or use contracted service providers to do that for us.
When you access our secure portals, we and service providers on our behalf collect certain personal information like user ID and password, IP address, pages or screens visited, buttons and links clicked, click streams, and related session data. The information received and collected through these portals may also be recorded in transaction logs. The information helps to monitor and improve content and functionality of the Online Services and our other services and to comply with applicable law and regulations. We and service providers on our behalf may also use information collected through secure portals as stated in Section 2 below.
The Online Services may offer interactive chat technology to help you. This technology collects personal information like name, date of birth, address, chat messages, and account number to verify you or to provide you with customized details. This technology may also capture session-related information, like web logs, to document the interaction. Additional terms of use may apply to interactive chat features in addition to this Privacy Policy. We encourage you to read such terms.
Your mobile device may permit you to use fingerprint, facial recognition, or similar biometric technology to login to our Online Service. When this is enabled, our Online Services can see that you have selected this as a preference and have been verified through your mobile device, and you may be permitted to access our Online Services with that technology. When you use a biometric login, we do not have access to or collect any of the actual biometrics (e.g., fingerprints or facial images). Your mobile device manufacturer manages and maintains that information (e.g., Apple, Samsung).
With your consent through your mobile device, we may use the location services function on your mobile device to collect your precise geolocation data. We use this data to help you find local products and services, and to provide you with relevant content based on your location.
We collect certain personal information when Online Services operate on your mobile device. For example, if you download one of our mobile applications, we collect information about the device type, its software/operating system, and the device identifier. We use this information to better understand who is using our Online Services and how they are using the Online Services and to improve our technical support capabilities.
A cookie is a small text file stored on a computer or other internet-connected device when it accesses a digital resource. There are also similar technologies, such as pixels, beacons, server logs, and others that collect information by automated means. When users visit our Online Services, cookies and similar technologies collect and process user information such as:
Our Online Services use first-party cookies and similar technology (that we create) to help them operate properly, monitor their performance, improve your experience, and better understand who is using our Online Services and how they are using the Online Services. We may also use the information we get from first-party cookies to provide visitors and users with personalized content and improve our offerings.
Our Online Services also use third-party cookies and similar technology (ones used and controlled by service providers on our behalf), as permitted by applicable law, to better understand who is using our Online Services and how they are using the Online Services (such as session time, pages or screens visited, buttons and links clicked, click streams, and crash reports), understand your digital journey from external sources to our Online Services, and improve our Online Services and other services. For example, we allow service providers, including Adobe and Freshpaint, to collect information through cookies and similar technologies on our behalf to collect the information described above to help us monitor, evaluate, and improve our Online Services, content, and services. These service providers are not allowed to use information they collect for any purpose other than providing their services to us.
Cookies and similar technology used on our Online Services include the following types:
You can modify most internet browser settings to try to block cookies and similar technology (e.g., choosing a “do not track” or “global privacy control” setting). You should be aware that blocking cookies and similar technology could prevent certain Online Services or features from fully functioning. We are not responsible for and make no representations or claims regarding the success of third party opt-out mechanisms or programs. Please note that if you delete your cookies and similar technology or upgrade your browser after opting out, you will need to opt-out again to reaffirm your choices.
You may see third-party widgets (e.g., LinkedIn) on our Online Services. These widgets (icons) are owned and controlled by third parties and not by us. These widgets are there for convenience only, and do not reflect an affiliation with or endorsement of the third-party. If you click a widget, you will be taken to the website of that third-party. Any data collection, use, and disclosure activities taking place on those third-party websites will be subject to that third party’s privacy standards (and not this Privacy Policy). Here’s an example: We maintain a LinkedIn page, but we have no control over how LinkedIn, as a third party, collects, uses, or discloses information about you when you visit the LinkedIn platform.
When you click a third-party widget and leave our site, we make no representations or warranties regarding third-party platforms or components, their content, data management, or security. You should review the privacy standards of the applicable third parties.
Our Online Services may contain redirecting hyperlinks or embedded third-party media content. By way of example, our Online Services may contain YouTube videos which may be tile images that redirect to YouTube when clicked. Another example is an embedded file which will begin playing on our web pages when clicked. We do not manage or configure this third-party content. We do not control any code which may be linked to this content by the media host or any data collection which might occur as a result of such code. When you review this content on our Online Services, you acknowledge, accept, and expressly consent to any associated data collection, use, and disclosure which might occur between us and the media host.
We use the information we receive through our Online Services for the purposes stated in Section 1 above. Additional uses may include:
We may also use your personal information to give you information about additional products, programs, and services offered by our family of companies or our business partners. You may remove yourself from certain communication channels or programs at any time -- just follow the opt-out instructions included in those communications.
We do not sell your personal information for money or other consideration.
We may disclose your personal information collected through our Online Services to service providers and may allow these service providers to directly collect your personal information in connection with our Online Services. For example, a service provider may have access to your information to send you a survey or a newsletter or to assist with security, fraud detection, analytics, or system operations on our behalf. We also have service providers, including Adobe and Freshpaint, collect personal information about users of our Online Services as described above. Our service providers are bound by contract to protect your personal information.
Third parties include non-affiliated companies whose platforms or components we may use or present to our users. We do not control their data collection and usage activities, and they are not governed by this Privacy Policy (like third-party widgets noted above). For example, we may use a third-party vendor to host certain informational videos. When you click on the link to the video, you are taken from our site to the platform of the video host. The host’s data collection and usage activities will control your interaction with that third-party site and content.
Third parties can also refer to other types of entities or bodies that we do not have a contractual or commercial relationship with, but that we share data with as permitted or required by law (e.g., government oversight agencies). We generally do not disclose personal information collected through our Online Services to third parties except as set forth in this Privacy Policy, or as permitted or required by law. At times, personal information may be disclosed to a third party if:
We may disclose your personal information to courts, law enforcement, governmental oversight agencies, and other regulatory bodies as permitted or required by applicable law, or if such disclosure is reasonably necessary to:
Our Online Services are not generally intended for, nor made available to children under the age of 13. We typically do not try to collect, use, or disclose information from children under the age of 13, unless otherwise permitted or required by applicable law.
Some of our entities or product lines may be subject to certain duties set by the GDPR. For those entities or product lines, a notice that meets GDPR’s requirements will be shown on the entities’ public websites.
Some of our entities may be subject to certain duties set by state consumer privacy laws, such as those set in California and Colorado. These laws require posting a consumer notice on data collection, use, and disclosure activities. For our entities that may be subject to these requirements, notices aligned to those specific state laws will be shown on those entities’ public websites.
We reserve the right to change, modify, or update this Privacy Policy at any time and for any reason. We will promptly post such changes, modifications, or updates to our Online Services. Please review this Privacy Policy every so often to keep informed of any changes. Remember that continued use of our Online Services confirms i) your acknowledgement and acceptance of the conditions contained in this Privacy Policy, and ii) your express consent to collect, use, and disclose your information in accordance with applicable law.
If you have questions about this Privacy Policy, please contact us by emailing “HighmarkHealthPrivacy@highmarkhealth.org” or calling 1-866-228-9424.
(© 2026 Highmark Health — last revised July 2026)
Highmark Health includes the wholly owned subsidiaries and affiliates making up the Highmark Health enterprise, including, among others, Highmark Inc., Allegheny Health Network, HM Health Solutions d/b/a enGen, HM Home and Community Services d/b/a Helion, and other affiliated businesses such as HM Insurance Group and United Concordia Companies Inc. References to "us," "we," and "our" in this Privacy Policy mean Highmark Health.
