If you purchased your own insurance on the Marketplace or you have a Medicare plan, you're entitled to access and share your health information. Blue Cross Blue Shield of Michigan and Blue Care Network now makes this process easier.
Your health information is available for other apps through a Patient Access Application Program Interface, or API. This technology allows applications to talk to each other by exchanging data.
As a member, you now have the ability to share your health information with third-party apps.
You can share your information dating back to Jan. 1, 2016, if you're enrolled in certain health plans. The following information is available as long as we maintain it in our records.
This includes clinical data collected while providing case management, care coordination, or other services to you.
Additional information can be found in our frequently asked questions (PDF) about Patient Access API.
The data made available, through the API, may include information about treatment for behavioral health, chronic illness and other sensitive information.
It's important for you to understand that the app you select will have access to all your information. The app is not subject to HIPAA rules and other privacy laws. These rules and laws protect your health information. You'll be subject to the app’s privacy policy for how they will use, disclose, and sell information about you. If you decide to share your information through the Patient Access API, you should review their privacy policy to ensure you're comfortable with what the app will do with your information.
To protect your data, it’s important to take steps to protect the privacy and security of your health information, including factors to consider in selecting an application including secondary uses of your data.
When selecting an app, ask yourself:
If the app's privacy policy doesn't answer these questions, you may want to reconsider. You should choose an app with strong privacy and security standards to protect your information.
The U.S. Department of Health and Human Services’ Office for Civil Rights, or OCR, enforces the HIPAA Privacy, Security, and Breach Notification Rules. Your Blue Cross health plan is subject to HIPAA as are most health care providers, such as hospitals, doctors, clinics, and dentists. You can find more information about your rights under HIPAA and who is obligated to comply with HIPAA.
You can learn more about filing a complaint with OCR related to HIPAA requirements. You may also file a complaint with Blue Cross by contacting the appropriate customer service office (PDF).
An app generally will not be subject to HIPAA. An app that publishes a privacy notice is required to comply with the terms of its notice, but generally is not subject to other privacy laws. The Federal Trade Commission Act protects against deceptive acts, such as an app that discloses personal data in violation of its privacy notice. An app that violates the terms of its privacy notice is subject to the jurisdiction of the Federal Trade Commission, or FTC. The FTC provides information about mobile app privacy and security for consumers.
If you believe an app inappropriately used, disclosed, or sold your information, you should contact the FTC. You may file a complaint with the FTC using the FTC complaint assistant.
On March 9, 2020, the Department of Health and Human Services, or HHS, released final rules outlining standards for interoperability and the secure exchange of health information. As part of these rules, the Centers for Medicare and Medicaid Services, or CMS, requires that the payers must maintain a process for the electronic exchange of member clinical data, which includes things like lab test results, vital signs, clinical notes and current medications.
CMS’s requirement says that with the approval of a current or former enrollee or the enrollee’s personal representative, the insurance carrier (payer) must:
If you're enrolled in a Blue Cross Medicare Advantage Plan or Individual Qualified Health Plan, or QHP, you have the option to request data transfer from your former insurance carrier (payer) to Blue Cross. Likewise, if you're a former enrollee in a Blue Cross Medicare Advantage or Individual QHP plan you have the option to request Blue Cross to send your data to your current insurance carrier.
This transfer will ensure that your clinical data stays with you in case you change insurance carrier.
However, CMS has indefinitely delayed this exchange requirement, so BCBSM can only send data to and receive data from health insurance carriers that are currently registered to facilitate data exchange.
Unfortunately, none of the health insurance carriers are registered and ready to transfer data right now. The health insurance carrier names will be added here once they are ready to transfer data.
You'll need an account on the Blue Cross member portal to request a data transfer. Please create an account if you don't have one.
Additional information about data transfer and insurance carrier registration can be found in our frequently asked questions (PDF).
Blue Cross Blue Shield of Michigan Interoperability APIs provide the functionality listed below:
This statement provides API syntax, function names, parameters supported, data types, and other required information necessary to develop your application. Anyone can open a query for BCBSM’s API Capability Statement. It shows the various aspects of FHIR that may be vitally important to someone such as a 3rd-party developer of a SMART on FHIR application trying to connect to BCBSM’s FHIR API.
To enable API connections, third-party developers must first create an account with InterOp Station and log in to access information.
Logging into the InterOp Station site will allow you to access:
To find out how to create an account, how to connect and test your application and how to properly attest, read the InterOp Portal User guide (PDF).
Access to API Endpoints requires credentials to the Developer Portal, and is accessible via access of any of the portals. It offers additional endpoints for testing and configuration to be used for attesting to access data and endpoints that are publicly accessible. View our publicly accessible endpoints under the Provider Directory and Drug Formulary.
Provider Directory:
Drug Formulary:
Privacy issues: To report a concern or if you think your protected health information has been compromised, please call us at 1-800-552-8278 or email us. Don't include any protected health information in your email.
Other issues: For customer service, call the number on the back of your member ID card.