Commitment to confidentiality

This notice describes how medical and dental information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Our commitment

We respect your right to privacy. We won't disclose personally identifiable information about you without your permission, unless the disclosure is necessary to provide our services to you or is otherwise in accordance with the law.

Use and disclosure of information

We're required by law to protect the confidentiality of information about you and to notify you in case of a breach affecting your information. We may use and disclose information about you without your written authorization for the following purposes, to the extent otherwise permitted or required by law:

• You or your representatives — to you or your “personal representative” upon request or to help you (or your personal representative) understand treatment options, benefits, or the rights available to you. Your “personal representative” is a person who has legal authority to make health-related decisions on your behalf, such as a person with a health-care power of attorney. Your request must be in writing. Please  complete the Documentation of Legal Representative Status for Members form available on our website. You also may designate a family member or friend to receive information and interact with us on your behalf. Your designation and any subsequent revocation must be in writing. Please complete the Member's Designation of an Authorized Representative form available on our website. You may also call Member Service for a copy of these forms.
• Treatment — to help health care providers manage or coordinate your health care and related services. For example, we may use and disclose information about you to inform providers of medications you take or to remind you of appointments.
• Payment — to obtain payment for your coverage, pay claims for your health benefits, or help another health plan or health care provider in its payment activities. For example, we may use or disclose information about you to make coverage determinations, administer claims, or coordinate benefits with other coverage you may have.
• Health care operations — to perform other activities necessary for the operation of our business, including customer service, disease management, and determining how to improve the quality of care. For example, we may use or disclose information about you to respond to your call to customer service, arrange for medical review of your claims, or conduct quality assessment and improvement activities.
• Legal compliance — to comply with applicable law. For example, we may be required to use or disclose information about you to respond to regulatory authorities responsible for oversight of government benefit programs or our business operations; to parties or courts in the course of judicial or administrative proceedings; or pursuant to workers’ compensation laws.
• Government agencies — under limited circumstances established by law, to public health authorities, coroners or medical examiners, law enforcement, or other government officials.
• Research — for health-related research studies that meet legal standards for protection of the individuals involved in the studies and their personal information. 

To carry out these purposes, we share information with entities that perform functions for us subject to contracts that limit use and disclosure for intended purposes.

The Health Insurance Portability and Accountability Act (HIPAA) generally doesn't override other laws that give people greater privacy protections. As a result, we must comply with any state or federal privacy laws that require us to provide you with more privacy protections.

For example, federal law provides special protections for substance use disorder information; Massachusetts state law restricts the disclosure of HIV and AIDS related information. In addition, we won't use (and are prohibited from using) your genetic information for underwriting purposes.

Other disclosures require your written authorization

Except as provided in this notice, we won't use or disclose information about you without your written authorization. For example, we must have your written authorization to use or disclose your information for marketing purposes or (in most cases) to use or disclose psychotherapy notes. Although we would need written authorization to sell information about you, we don't sell members’ information.

You may revoke your authorization at any time. Your authorization must be in writing. Your revocation won't affect any action that we have already taken in reliance on your authorization. If you would like us to disclose information about you to a third party, please complete the Permission for One-Time Disclosure of Information form available on our website or call Member Service for a copy of the form.

Your privacy rights

You have the following rights with respect to information about you. You may exercise any of these rights by calling the Member Service number listed on your member ID card or contacting us at the address listed at the end of this notice. The forms listed below are also available on our website.

• You have the right to receive information about privacy protections. Your member-education materials include a notice of your rights, and you may request a paper copy of this notice at any time.
• You have the right to inspect and get copies of information that we use to make decisions about you. This is your designated record set. Your request must be in writing. You may request to receive this information in electronic format or on paper. We may charge a reasonable fee for copying and mailing you this information. Please complete the Request for Access to Copies of Protected Health Information in Designated Record Set form to request copies of your information.
• You have the right to receive an accounting of certain disclosures that we make of information about you. Your request must be in writing. Please complete the Members Request for an Accounting of Disclosures form. Our response will exclude any disclosures made in support of treatment, payment, and health care operations or that you authorized (among others). An example of a disclosure that would be reported to you is our disclosure of your information in response to a court order.
• You have the right to ask us to correct or amend information you believe to be incorrect. Your request to correct or amend information must be in writing. Please complete the Members Request to Amend  Protected Health Information form. If we deny your request, you may ask us to make your request part of your records. 
• You have the right to ask that we restrict or refuse the disclosure of information about you and that we direct communications to you by alternative means or to alternative locations. While we may not always be able to agree to your request, we'll make reasonable efforts to accommodate requests. Unless you’ve notified us to request a different mailing address, Summary of Health Plan Payments statements for the subscriber, and all members listed on the subscriber’s plan, are generally delivered to the subscriber’s address. Under certain circumstances, you can request to not receive statements for a particular service, or to have statements delivered through an alternate method or to an alternate address, when required by state law. If you have concerns about protecting the privacy of your medical information in your statements, you can have these statements delivered to an address other than the plan subscriber’s address, or have them delivered only via electronic means. For help understanding your delivery options, please call Member Service at the number listed on your member ID card. Your request and any subsequent revocation must be in writing.

If you believe your privacy rights have been violated, you have the right to complain to us using the grievance process outlined in your benefit materials, or to the Secretary of the U.S. Department of Health and Human Services, without fear of retaliation.

About this notice

The original effective date of this notice was April 14, 2003. The effective date of the most recent revision is indicated in the footer of this notice. We're required by law to provide you with this notice of our legal duties and privacy practices and to abide by the notice for as long as it is in effect. We reserve the right to change this notice. Any changes will apply to all information that we maintain, regardless of when it was created or received. If we make a material change to this notice, we'll post the revised notice on our website and notify you of the change and how to obtain the revised notice in our next regular mailing to you. If you have any questions, please call the Member Service number listed on your member ID card, or write us at:

Blue Cross Blue Shield of Massachusetts
Privacy Officer
101 Huntington Ave.
Suite 1300
Boston, MA 02199-7611

Women's Health Cancer Rights Act (WHCRA) notice

Did you know that your medical plan provides benefits for many mastectomy-related services? This is the case even if you weren't covered by Blue Cross Blue Shield of Massachusetts at the time of the mastectomy. It’s required by the Women’s Health and Cancer Rights Act of 1998. If you're covered for a mastectomy and elect breast reconstruction in connection with a mastectomy, then benefits are also provided for:

• All stages of reconstruction of the breast on which the mastectomy has been performed;
• Surgery and reconstruction of the other breast to produce a symmetrical appearance; and
• Prostheses and treatment of physical complications at all stages of the mastectomy, including lymphedema.

Coverage will be provided as determined in consultation with you and your attending doctor. The costs that you pay for these services are the same as those you pay for other services in the same category. To learn more, please call the Member Service number on your member ID card.

Effective date:

December 19, 2023