The BCBSM/BCN Notice of Privacy Practices (PDF) complies with updated regulations under the Health Insurance Portability and Accountability Act of 1996, or HIPAA. The Notice of Privacy Practices applies to all Blue Cross Blue Shield of Michigan, Blue Care Network and Blue Cross Complete of Michigan members, except for members who get a separate Notice of Privacy Practices from their employer. 

Our Notice of Privacy Practices tells you that:

• We won’t use your protected health information for marketing communications except where the law permits.
• You have the right to be notified if there’s a security breach that involves your protected health information.
• We won’t use or disclose genetic information for underwriting purposes.
• In certain circumstances, you have the right to make a written request for an electronic copy of information that we keep in a designated record set.
• We won’t use or disclose your protected health information in any way other than those described in our Notice of Privacy Practices unless we have a signed authorization.

To get more information about your rights under HIPAA, visit our HIPAA compliance page. To get copies of individual rights forms, please visit our Protected Health Information and Privacy Forms page.

Blue Cross Blue Shield of Michigan is HITRUST CSF® Certified. The certification covers Electronic Data Interchange system and infrastructure.

HITRUST is an organization that’s responsible for creating and maintaining a comprehensive and flexible framework of prescriptive and scalable security controls in the health care sector, among others. HITRUST CSF Certification is frequently required by organizations that handle sensitive data, including protected health information or PHI.

We keep your protected health information, or PHI, safe according to state and federal regulations. We have the following measures in place to protect all verbal, written and electronic PHI: 

• Security and privacy training for all employees
• Access is limited to business needs
• Background checks for all employees and contracted staff
• Verification of callers
• Required use of headsets during phone calls
• Voicemail messages that include members’ PHI are erased daily
• Strong passwords required within the electronic system
• Passwords are changed frequently
• Hard drives are encrypted
• PHI is stored in a locked environment
• Secured printers that require badge access
• Employees are trained to be mindful of public conversations so they don't accidentally disclose any PHI

If you purchased your own insurance on the Marketplace or you have a Medicare plan, you're entitled to access and share your health information. Learn about your ability to share and how Blue Cross Blue Shield of Michigan makes the process easier through a Patient Access Application Program Interface, or API.

When you use our online services, you may be asked to provide personal information that is necessary for us to process your request. To ensure your transaction remains confidential, the information is sent to us using an encrypted form in a "secure session" established with Secure Socket Layer (SSL). We also require the use of authentication, such as user ID and password, which allows us to verify your identity when you access our online services. Many of our sites also use multi-factor authentication and firewall technology to better protect your information.

Security tips

• Choose unique passwords. Don't use your Social Security number, birth date, middle name, names of spouse or children, or anything else that someone could easily guess as a password.
  
• Do not share your user ID and password with anyone else.
  
• After you have submitted information online, we recommend that you close your browser before leaving your computer. This practice ensures you are not leaving personally identifiable information on the computer for those who may use it after you. This is especially important if you are using a computer in a public place.
  
• Do not leave your computer unattended during an online session.
  
• Contact us immediately at 1-888-417-3479 if you suspect that someone has accessed your information online without your authorization.

We do not offer encrypted email. As a result, when our website users send email inquiries to us, the return email address may be used to respond to the email inquiry. We do not use the return email address for any other purpose, nor will we share it with any third parties.

For private inquiries including those containing Protected Health Information, contact customer service. 

We have links from our website to a number of different health care-related sites. We provide these links as a courtesy to help you find information. We are not responsible for the performance or content of sites linked from BCBSM.com since they are beyond our control. We recommend you read the privacy statements on the sites you visit to understand their individual privacy practices. 

In compliance with the Children's Online Privacy Protection Act of 1998 (COPPA), we do not knowingly solicit data from children under 18 years of age and we do not knowingly market to children under 18 years of age.

We recognize that protecting children's identities and privacy online is important and that the responsibility to do so rests with both the online industry and with parents.