Privacy Practices and Policies

THIS NOTICE. DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

THE PRIVACY OF YOUR INFORMATION IS IMPORTANT TO US.

This notice applies to benefit plans offered by Blue Cross Blue Shield of Wyoming (BCBSWY). BCBSWY is referred to as “we,” “us,” and “our” in this Notice. Persons insured as participants under our benefit plans are referred to as “you” and “your” in this Notice.

Our Legal Duty to Protect Your Protected Health Information

We understand the importance of keeping your protected health information (PHI) private and make it one of our top priorities. This Notice explains how, when, and why we collect, use and disclose your PHI. It also explains your rights concerning your PHI.

PHI information that identifies you, such as your name, address, telephone number, social security number, and benefit plan number. BCBSWY uses this information to carry out payment activities, health care operations, and other purposes permitted or required by law. We are required by applicable federal and state law to protect and maintain the privacy of your PHI. We are also required to provide you with notice of our legal duties and privacy practices with respect to your PHI. We must provide you with notice of a non-permitted use or disclosure of your unsecured PHI if your information has been compromised under state and federal standards.

We must follow the privacy practices described in this Notice while it is in effect. This Notice takes effect November 1, 2025, and will remain in effect until we replace it with a revised notice.

This Notice is intended to incorporate the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Wyoming law.

From time to time, it may become necessary for us to revise our privacy practices as described in this Notice. We reserve the right to revise the terms of this Notice and to make the new privacy practices applicable to all PHI we maintain, including PHI we created or received before we made the revision. When we make a significant revision to our privacy practices, we will revise this Notice and mail the revised Notice to our benefit plan subscribers.

You are entitled to receive a copy of this Notice in written form upon request. You may contact BCBSWY for a copy by using the contact information listed at the end of this Notice under the “Questions and Complaints” section. This Notice may also be viewed on our website at https://www.bcbswy.com/privacy/ and printed.

Our Uses and Disclosures of Your Protected Health Information

We use and disclose PHI for many reasons. Under some circumstances, we are allowed by law to use and disclose your PHI without your authorization. Under other circumstances, we need your authorization to use and disclose your PHI. Unless otherwise required by law, we use and disclose only the minimum amount of information necessary to satisfy the purpose of the use or disclosure. Described below are different categories of our uses and disclosures and some examples of each category.

Any PHI disclosed to an individual or entity not covered by the HIPAA Privacy Rule, such a family member or friend, is subject to redisclosure by the recipient and may no longer be protected by the Privacy Rule.

We are prohibited by federal law from using or disclosing any information about your treatment for substance use disorders (or providing testimony based on such information) for any civil, criminal, administrative, or legislative proceedings against you without your consent or a special type of court order. For any court order, you must first have notice and an opportunity to object. A court order must also be accompanied by a subpoena or similar legal mandate. If you wish to consent to such disclosures of your PHI involving treatment for substance abuse disorders, such consent is required to be given through your treating health care provider.

Our privacy policies set out in this Notice apply to your PHI regardless of whether your status as a participant in our benefit plan is active or has been terminated. In many cases, we are required by law to retain the PHI for a set amount of time. We will not destroy your PHI for that set amount of time, even if your coverage with us has terminated. Therefore, even after your coverage terminates, your PHI may be used for many of the purposes described in this Notice.

Uses and Disclosures of Protected Health Information Without Your Authorization

Abuse or Neglect: We may disclose your PHI to the appropriate authorities to report child abuse or neglect or when there is a concern that you have been a victim of abuse, neglect or domestic violence.

Business Associates: We may share your PHI with our accountants, consultants and other third parties who we hire for various business activities. These third parties also are required to keep your information private. For example, we may disclose your PHI to auditors who make sure we comply with the laws that affect us. In addition, we may disclose your PHI to consultants who help us review and improve the quality of the health care services that you receive.

Coroners, Funeral Directors and Organ Donations: We may disclose PHI of deceased members to coroners or funeral directors so they can carry out their duties. In addition, we may disclose PHI to organizations that arrange organ donations and transplants.

Genetic Information: We cannot use or disclose PHI that is an individual’s genetic information for underwriting.

Health Oversight: We may disclose your PHI to health oversight agencies that are responsible for auditing, investigating, inspecting and licensing health care entities. These activities are necessary for the government to monitor the health care system, government programs and compliance with laws.

Health Related Benefits and Services: Where permitted by law, we may use or disclose your PHI to contact you about health-related benefits and services, treatment alternatives that may be of interest to you or appointment reminders. For example, your name and address may be used to send you our newsletters that contain general health information. In addition, we may contact you about health-related products that may be added to or replace your existing benefit plan.

Health Care Operations: We may use and disclose your PHI to operate our business and make sure that you receive quality care. Several examples of how we may use and disclose your PHI for health care operations include the following:

• To the extent permitted by law, determining if you are eligible to enroll in our benefit plan;
• To the extent permitted by law, determining the premium for your benefit plan;
• Reviewing your doctors’ treatment and services, and evaluating their performance;
• Assisting your doctor in the management of your ongoing care for a disease or medical condition;
• Reviewing for fraud, waste and abuse;
• Responding to your inquiries; and
• Surveying you on how well we meet your health insurance needs.

Law Enforcement: We may disclose your PHI to law enforcement officials in certain situations. For example, we may disclose PHI for legal proceedings, to help identify or locate a suspect, witness or missing person or to provide information concerning a crime on our property.

Legal Proceedings: We may disclose your PHI for legal proceedings if there is a court order, administrative order, subpoena, discovery request or other lawful process.

Marketing/Sale: We will obtain an authorization from you before we use or disclosure your PHI for marketing purposes unless our marketing is in the form of a face-to-face communication with you or we are providing you with a promotional gift of nominal value. In those two situations, an authorization is not required.  We will not sell your PHI to anyone without your authorization, except where expressly permitted by law.

Military Activity and National Security: We may disclose the PHI of military personnel to military authorities under certain circumstances. In addition, we may disclose your PHI to federal officials for national security or intelligence purposes, such as protecting the President of the United States or others.

Parental Access: Generally, parents, guardians or other people acting in a similar legal capacity may receive their minor child’s PHI. However, some state laws give minors special protections, and require that we cannot disclose the minor’s PHI to the parents, guardians or others without the written authorization of the minor.

Payment: We may use and disclose your PHI to pay for services that are covered under your benefit plan. For example, we may need to give your insurance information to doctors so they can bill us and receive payment for the treatment you received. We may also use and disclose your PHI to coordinate benefits with other insurance carriers such as your automobile insurance company or Medicare.

Plan Sponsors: If you are enrolled in a health plan through your current or previous employer, you are enrolled in a group health plan. Each group health plan has a “plan sponsor,” the person or group that established the group health plan. In many cases, the plan sponsor is your employer. If your plan sponsor needs PHI to administer their group health plan, they are required by law to establish privacy procedures for receiving PHI from us, and they may use it only as the law allows. If your plan sponsor establishes these privacy procedures, we may disclose PHI to them. Please refer to your benefit plan or other plan documents for an explanation of how your plan sponsor may use or disclose PHI to administer your group health plan.

Public Health and Safety: We may disclose your PHI to government officials in charge of collecting information about public health. For example, we may share PHI with state departments of health about births, deaths, diseases, injuries or disabilities. We also may disclose PHI to law enforcement or other officials to prevent or reduce a serious threat to the health or safety of you, another person or the public.

Required by Law: We may disclose your PHI when we are required to do so by law. For example, we must disclose your PHI to U.S. Department of Health and Human Services officials upon their request, so they can determine whether we are complying with federal privacy laws.

Research: We may disclose your PHI to researchers in limited situations. These researchers are required to establish measures to protect your privacy.

Treatment: We may disclose your PHI to doctors, nurses or other health care professionals who ask for it in order to treat you. For example we may use or disclose your PHI to determine whether services requested by your doctor are covered benefits under your health plan.

Underwriting: To the extent permitted by law, we may receive your PHI for underwriting, premium rating or other activities related to the creation, renewal or replacement of your benefit plan (although we are prohibited from using or disclosing any genetic information for underwriting purposes). We will not use or further disclose your PHI for any other purpose, except as required by law, unless the contract of health insurance or health benefits is placed with us. In that case, our use and disclosure of your PHI will only be as described in this Notice. If we receive your PHI to determine if you are eligible to enroll in our benefit plan and you do not enroll with us, we will only use or disclose your PHI as required by law.

Workers’ Compensation: We may disclose your PHI as required by workers’ compensation laws and other similar programs that provide benefits for work-related injuries or illnesses.

Uses and Disclosures of Protected Health Information With Your Authorization

Written Authorization: If you provide written authorization, we may disclose your PHI to anyone you authorize for any reason. You may revoke this authorization in writing at any time. Revoking your authorization will not affect any action that was taken before the authorization was revoked. Without your authorization, we may not use or disclose your PHI for any reason except as described in this Notice and/or as required by law. If we have them, we must get your written authorization before we disclose your provider’s psychotherapy notes.

Oral Authorization: Family members, friends or other persons may be assisting you with your health care. We may disclose your PHI to these family members, friends or others if you give us your oral authorization. If you are unable to give us your oral authorization, we may disclose your PHI to these family members, friends or others if there is a medical emergency or for disaster relief purposes to the extent we believe the disclosure of your PHI would be in your best interest to help with your health care or with payment for your health care.

Other Uses and Disclosures: Your written authorization is required for all other uses and disclosures of your PHI that are not described in this Notice.

Your Rights Regarding Your Protected Health Information

Access: You have the right to look at or get copies of your PHI in our control or possession, with limited exceptions. We will use the format you request unless we cannot practically do so. You must make your request to obtain access to your PHI in writing to the address listed at the bottom of this Notice. If you request a copy of the information, we may charge you a reasonable fee for the costs of copying, mailing, or other costs associated with your request. You may also request that BCBSWY create a summary of your PHI for a reasonable fee.

Amendment: You have the right to ask us to amend your PHI if you believe that it contains a mistake or that an important piece of information is missing. Your request must be in writing to the address listed at the bottom of this Notice and must explain why the information should be amended. It is important that you direct your request for an amendment to this address so that we can begin to process your request. If you send a request to another person, office, or address, our response may be delayed. We may deny your request in certain cases. For example, we may deny your request if we did not create the information, such as medical information received from your doctor. If we deny your request, we will provide you with a written explanation. You may respond with a statement of disagreement in writing to the address at the bottom of this Notice that we will append to the PHI you wanted amended. We will ensure your statement of disagreement is included with all future disclosures we make of that PHI. If we accept your request to amend your PHI, we will make reasonable efforts to inform all relevant persons and entities of the amendment and to include the amendment in any future disclosures of that PHI.

Confidential Communications: If you believe that sending your PHI to your regular address could endanger you, you may request that we communicate with you regarding your PHI in an alternative format or at an alternative location. For example, you may ask that we only contact you at your work address or at another secondary address.

Please send your request to us at the address listed at the bottom of this Notice. It is important that you direct your request for confidential communications to this address so that we can begin to process your request. If you send a request to another person, office, or address, our response might be delayed.

We will accommodate a written request for confidential communication that is reasonable and that states that the disclosure of all or a part of your PHI could endanger you when possible. Once a request for confidential communications goes into effect, all your PHI will be processed in accordance with your instructions. Documents that contain PHI about services you receive, such as letters or EOBs, will be addressed to you and not the contract holder. The contract holder will be entitled to access billing information and other PHI in connection with our contract, unless you request confidential communications in accordance with this section.

Even if you request confidential communications, the check we send to reimburse you for services you receive from a non-participating provider will be made payable to the contract holder, unless you have made other payment arrangements with us. In addition, accumulated payment information, such as deductibles and out-of-pocket maximums, which will be affected by services you receive, will continue to appear on all future EOBs we send to the contract holder. We urge you to discuss with us how we can arrange to pay your claims for services that you receive from a non-participating provider.

If you terminate your request for confidential communications, the restriction will be removed for all your PHI that we hold, including your PHI that was previously protected. Therefore, you should not terminate a request for confidential communications if you remain concerned that disclosure of your PHI would endanger you.

Disclosure Accounting: You have the right to ask us for a list of certain disclosures that we have made of your PHI. Your request include disclosures made up to six (6) years before the date of your request. We will provide you with a list of disclosures, including the date on which we made the disclosure, the name of the person or entity to whom we made the disclosure, a description of the PHI we disclosed and the reason for the disclosure. This list will not include the following:

• Disclosures for treatment, payment or health care operations;
• Disclosures to you or your legal representative;
• Disclosures that you or your legal representative authorized; and
• Certain other disclosures as allowed by law.

You may request an accounting by submitting your request in writing to us at the address listed at the bottom of this Notice. It is important that you direct your request for an accounting to this address so that we can begin to process your request. If you send this request to another person, office, or address, our response might be delayed. If you request this list more than once in a twelve (12) month period, we may charge you a reasonable cost-based fee for responding to these additional requests. We will notify you of the cost involved and you may choose to withdraw or modify your request before any costs are incurred. In most cases we must respond to your request within thirty (30) days.

Electronic Notice: If you receive this Notice on our website or by e-mail, you also may ask for this notice in written form. Please contact us at the address listed at the end of this Notice under the paragraph entitled “Questions and Complaints.”

Restrictions: You have the right to ask us to restrict the way we use or disclose your PHI for treatment, payment and health care operations, as described above. However, you may not request that we restrict the uses and disclosures of your PHI that we are required or allowed to make by law. We will consider your request for restrictions, but we are not required by law to agree to them. If we agree to restrictions, we will follow them, except in an emergency situation. Any agreement we make to restrict our use or disclosure of your PHI must be made in writing to the address listed at the bottom of this Notice and signed by a person authorized to make such an agreement on our behalf. We will not be bound to any agreement that is not in writing. We may terminate our agreement to restrict our uses and disclosures of your PHI upon notice to you.  If you do not agree to the termination of the agreement, the termination is only effective with respect to your PHI created or received after we have informed you of our decision to terminate our agreement to restrict our use or disclosure of your PHI.

Breach Notification: In the event of a breach of your unsecured PHI, we will provide you notification of such a breach as required by law or where we otherwise deem notice to be appropriate.

Protecting Your Data

BCBSWY wants to help empower members to protect their privacy. Here are a few simple ways you can better secure your privacy data.

• Learn how online tracking works and what you can do about it. 
• Secure your devices
• Know about online abuse and harassment
• Change your password frequently
• Use trusted internet networks

Find more information about the topics above at https://consumer.ftc.gov/consumer-alerts/2021/06/your-guide-protecting-your-privacy-online

Know About Online Abuse and Harassment

Learn about what you can do if someone tracks your phone without permission or shares your personal imagery without your consent.

Find more information about the topics above at https://consumer.ftc.gov/consumer-alerts/2021/06/your-guide-protecting-your-privacy-online

How You Can Use HIPAA to Protect Your Information

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. Covered entities, such as doctors, clinics, dentists, etc., must comply with all HIPAA rules. Whereas entities such as fast-food restaurants, car washes or arcades would not be considered covered entities as they do not deal with health information. Learn more about what at covered entity is at https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules, and the Patient Safety Act and Rule.

You can find more information about patient rights under HIPAA and who is obligated to follow HIPAA here: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html

Please visit the OCR webpage to understand their responsibilities  https://www.hhs.gov/ocr/about-us/index.html

File a complaint with OCR at https://www.hhs.gov/ocr/complaints/index.html 

Please visit the FTC website to understand their responsibilities https://www.ftc.gov/about-ftc

File a complaint with the FTC at reportfraud.ftc.gov

Third-party apps

We want to help our members consider the pros and cons of allowing a third-party app to retrieve their health care data. It is important for health care patients to take an active role in protecting their health information. Knowing what to look for when choosing an app can help patients make more informed decisions. Patients should look for an easy-to-read privacy policy that clearly explains how the app will use their data. If an app does not have a privacy policy, patients should be advised not to use the app. Patients should consider the following:

What to Consider

Before using a third-party app, use caution and watch for these things.

An easy-to-read privacy and security policy that clearly explains how the app will use your data and answers the following questions to your satisfaction:

What health data will this app collect? Will this app collect non-health data from my device, such as my location?

Will my data be stored in a de-identified or anonymized form?

How will this app use my data?

Will this app disclose my data to third parties?

Will this app sell my data for any reason, such as advertising or research?

Will this app share my data for any reason? If so, with whom? For what purpose?

How can I limit this app’s use and disclosure of my data?

What security measures does this app use to protect my data?

What impact could sharing my data with this app have on others, such as my family members?

How can I access my data and correct inaccuracies in data retrieved by this app?

Does this app have a process for collecting and responding to user complaints?

If I no longer want to use this app, or if I no longer want this app to have access to my health information, how do I terminate the app’s access to my data.

How does this app inform users of changes that could affect its privacy practices?

What is the app’s policy for deleting my data once I terminate access? Do I have to do more than just delete the app from my device?

Learn more at https://www.bcbswy.com/third-party-apps/

Questions and Complaints

For more information about your privacy rights or BCSBWY’s privacy practices, or if you want additional copies of this Notice, you may visit our website at https://www.bcbswy.com/privacy/notice or call the telephone number on your Member ID card. You may also contact BCBSWY Member Services at 4000 House Avenue, P.O. Box 2266, Cheyenne WY 82003 or at 1-800-442-2376. To provide you with the best possible customer service, Member Services may need to transfer your call to the service unit that specializes in your benefit plan. You have a right to get a new copy, including a paper copy, of this Notice at any time.

If you believe that your privacy rights have been violated, you may file a written complaint with our Compliance Officer by contacting us at the address listed at the end of this Notice. You also have the right to complain to the U.S. Secretary of Health and Human Services. We support your right to protect the privacy of your PHI. We will not retaliate against you in any way if you choose to file a complaint with us or the U.S. Department of Health and Human Services.

We reserve the right to change our privacy practices and the terms of this Notice at any time. We reserve the right to make the changes in our privacy practices and the new terms of our Notice effective for all PHI that we maintain, including PHI we created or received before we made the changes. If we make a material change to our Notice, we will change this Notice and post the new notice on our website. We will provide a copy of the new notice (or information about the changes to our privacy practices and how to obtain the new notice) in our next annual mailing to enrollees who are then covered by one of our health plans.

If you have any questions about the complaint process, wish to file a complaint with us, or need the address of the U.S. Secretary of Health and Human Services, please contact our Compliance Officer at the following address and telephone number:

BCBSWY
4000 House Avenue
P.O. Box 2266
Cheyenne, WY 82003

Effective Date of This Notice: November 1, 2025