Workpartners Privacy

See the Optum products license agreement

Optum Products License Agreement

This privacy statement (“Privacy Statement”) explains what information UPMC Health Plan, Inc. and its affiliates (collectively, “UPMC Health Plan”) collect, how we collect personal information, and why we collect personal information when you visit or use our websites, applications, and other electronic services (“onlineservices”). It also explains when, why, and with whom we share that personal information when you use the online services. The term “personal information” means information about a natural person that identifies or describes such natural person. UPMC Health Plan's affiliates include, but are not limited to, UPMC Health Network, Inc., UPMC Health Options, Inc., UPMC Health Coverage, Inc., UPMC Health Benefits, Inc., UPMC for You, Inc., Community Care Behavioral Health Organization, UPMC Work Alliance, Inc., Workpartners National, Inc., UPMC Benefit Management Services, Inc. (dba “Workpartners”), and any other entity affiliated with UPMC's Insurance Services Division.

Your personal information is private and confidential. We take this pledge seriously. Whether you are a prospective, current, or former member-living or deceased-we respect and safeguard the privacy and confidentiality of the information that we create, collect, and maintain about you.

Privacy is one of your rights as a consumer as well as a UPMC Health Plan member or employee of a UPMC Benefit Management Services, Inc. (dba “Workpartners”) client. UPMC Health Plan members and beneficiaries and “Workpartners' members are collectively referred to herein as “Members.” It also is a right that you retain even when you are no longer a Member of UPMC Health Plan or Workpartners.

a. Collection and Use of Personal Information

Generally, members of the public can access our public online services, such as UPMCHealthPlan.com, without providing us with your personal information. For certain services, such when completing a registration form to access the MyHealthOnline portal, we may ask you to provide us with your personal information. This information is collected and used for the purposes described in this Privacy Statement, as indicated where and when the information is requested or collected, and as permitted by law.

When you provide us your personal information, you are also doing two important things:

• Verifying the correctness and truthfulness of the information that you have provided to us; and
• Acknowledging that UPMC Health Plan can use the information we collect or receive about you and your family for the purposes set forth in this Privacy Statement and without further authorization.

b. Information We Collect and Why We Collect It

We collect information you provide directly to us, such as when you create an account or profile to access your Member account on the UPMC Health Plan's MyHealthOnline Portal, or to complete and sign an online enrollment or renewal application form, use the interactive areas and features of the online services, subscribe to our email list, participate in a survey or events, pay a bill, request support, or otherwise communicate with us. Depending on the online services, when you access and use our online services, we may collect, and in the past twelve (12) months have collected, the following kinds of information from you:

• Account information, such as your name, email address, password, postal address, phone number, date of birth and any other information you choose to provide.
• Transaction information, such as your Member account number and limited payment information from you, such as payment method and payment card information.
• Information about others, such as the names and the contact information of your providers, your representatives, and any dependents in your care.
• Health information, such as your past and present medical condition, medication information, and treatment history.
• Other information you choose to provide, such as when you participate in a survey, assessment, contest, promotion or interactive area of the online services, live audio and video visit, or when you request technical or customer support.

We also automatically collect, including in the past twelve (12) months, the following information from you when you visit or use some of our online services:

• Membership information, to arrange for the provision of healthcare treatment and services to you and your family members that you are enrolling as dependents on your application.
• Claims and payment information, to make payments to doctors, hospitals, and other health care professionals for the treatment and services you and your family receive, and to process and assess claims we have received and paid for the services provided to you, or the health care premiums that you or your company have paid.
• Health care information, to perform certain health care operations that UPMC Health Plan uses to monitor the quality of the healthcare coverage and services that you have purchased for you and your family. These operations include measurement and review of all our data to see how many of our Members receive certain services, such as childhood immunizations, mammograms, and other preventive health services. All these measurements are used so that we can assess how well we are doing in providing quality health care to all our Members.
• Login information, where our servers record certain log file information, such as your Internet Protocol (“IP”) address, operating system, browser type and language, referring URLs, access times, pages viewed, links clicked and other information about your activities on the online services.
• Device information, such as the device used to access or use the online services, including the hardware model, operating system and version, unique device identifiers, and mobile network information. If your device settings permit, we may also collect information about the precise location of your device and access and collect information from certain native applications on your device to facilitate your use of certain features of the online services.
• Online tracking information, such as through the use of tracking technologies, including cookies, pixel tags, local stored objects, and web beacons to collect information about you when you interact with our online services. We may allow others to provide analytics services on our behalf using these technologies to collect information about your use of the online services and other websites. We also place Cookies of third parties in the online services that track your interactions with that third party's website, content, advertisements, website links, and/or other online services. For more information about how and why we use these technologies, and how to disable them, please see our cookies notice, which is incorporated here by reference. Additionally, you can opt-out of these online tracking technologies by broadcasting an opt-out preference signal, such as the Global Privacy Control (GPC); however, we do not support “Do Not Track” which is different from the GPC. Some of this information may be used for re-identification. Re-identification is a process by which anonymized data collected on our online services are matched with personally identifiable information. Re-identified data are used, among other ways, to provide website users with a more relevant and user-friendly online experience.

We also collect some of the above information to:

• Provide, maintain and improve our online services and provide you with relevant information;
• Send you technical notices, updates, and alerts;
• Provide support, customer service, and administrative messages;
• Respond to your comments and inquiries, and provide customer services;
• Communicate with you about products and services offered by us and others, and to provide news and information about products, services, and events we think will be of interest to you;
• Plan, administer and coordinate events, community groups and outreach activities;
• Monitor and analyze trends, usage and activities in connection with our online services;
• Detect, investigate and prevent fraudulent transactions and other illegal activities and protect the rights and property of UPMC and others;
• Maintain appropriate records for internal administrative purposes;
• Comply with applicable laws, regulations, and court orders; and
• Carry out any other purpose described to you at the time the information was collected.

c. Social Media Plug-Ins

We may collect information that you have made public via your social media accounts. As a convenience to you, some of our public online services may use plug-ins from social media networks like Facebook, Twitter, and LinkedIn. These plug-ins are indicated by the social networks' respective logos on the online services and are used to establish a direct connection with these social networks. Integration of the plug-in may allow the social media network to receive information that you have loaded onto the online services. For example, if you are logged in with Facebook while you visit our online services, the plug-in may be able to assign your visit of our online service to your Facebook account. This information exchange takes place automatically. You may prevent this exchange if you log out of your social network before using the online services, disable this feature on your social network application or service, and/or disable cookies as described in our Cookies Notice.

d. How We Share Your Information

We may share the information we collect from or about you as follows:

• With our service providers to maintain, improve, and protect our online services. These providers may only use your information to accomplish the purposes described in this Privacy Statement and our Terms and Conditions.
• With other entities that are subsidiaries of UPMC.
• With our advertising partners in order to display advertisements that we think are relevant to you. While much of the information we share is anonymized, we may permit selected advertising partners to match and re-identify you.
• With social network platforms when you access our site while logged into a social network platform or when you post content from our online services to your social network platform.
• In the course of legal proceedings or in response to legal orders or government requests, and as otherwise required by law.
• As needed to support compliance and corporate governance functions.
• In connection with a transfer of ownership or assets, a corporate reorganization, merger, or acquisition.
• With your employer, provided we have your authorization. Otherwise, any reports to employers about the services provided to their employees are based only on total employee group percentages and totals-and not on any individual Member data or information that could be used to identify a past, present, or future health status or condition.

e. Your Choices

Marketing Communications.  If you do not want to receive marketing and promotional emails from us, you may click on the “unsubscribe” link in the email to unsubscribe and opt-out of marketing email communications. See How to Contact Us below for more information.

1. Opting Out of Direct Marketing by Third Parties. To exercise choices regarding the marketing information you receive, you may also review the following links:

• You may opt-out of tracking and receiving tailored advertisements on your mobile device by some mobile advertising companies and other similar entities by downloading the App Choices app at aboutads.info/appchoices
• You may opt-out of receiving permissible targeted advertisements by using the NAI Opt-out tool available at http://optout.networkadvertising.org/?c=1 or visiting About Ads at http://optout.aboutads.info

f. Notice of Privacy Rights for Residents of Certain U.S. States

Residents of certain U.S. states may have rights and choices regarding their Information.  To the extent any data protection law applies to our collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights you may be entitled to and how to exercise those rights. 

Depending on where you live and subject to certain exceptions, you may have some or all of the following rights.

• Right to Know and Access. You may have the right to request that we confirm whether we process your Information, and to request information about our collection and use of your Information, including whether we sell or share your Information.  You also have the right to request access to Information we may process about you.
• Right to Data Portability. Where the processing is carried out by automated means, and subject to certain exceptions, you may have the right to request and obtain a copy of your Information that you previously provided to us in a portable format.  In addition, to the extent technically feasible, you may have the right to obtain your Information in a readily usable format that allows you to transmit the Information to another data controller without hindrance.
• Right to request Correction of Inaccurate Information. To the extent that we may maintain inaccurate Information, you may have the right to request that we correct such inaccurate Information, taking into account the nature of the Information and the purposes of the processing of the Information. 
• Right to Request Deletion. You may have the right to request that we delete certain Information or records provided by or obtained about you, with certain exceptions and limitations as allowed under law. 
• Right to Opt-Out of the Sale and Sharing of Information. You may have the right to opt out of the processing of your Information for the purpose of selling or sharing of your Information for cross-context behavioral advertising.  We do not sell or share your Information as defined under applicable law nor have we done so in the past twelve (12) months.  Additionally, we have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age.
• Right to Opt-Out of the use of Information for Targeted Advertising and Profiling. You may have the right to opt out of the processing of your Information for purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not use your Information for targeted advertising or profiling purposes.
• Right to Limit Use and Disclosure of Sensitive Information. You may have the right to request that we limit the ways we use and disclose your sensitive Information to uses which are necessary for us to perform the Services, or deliver the goods reasonably expected by you, or and as authorized by law.  We do not use or disclose your sensitive information other than for the permitted business purposes outlined above and in our Terms and Conditions. 
• Right to Non-Discrimination. You may have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights.  We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services. 
• Right to Disclosure of Direct Marketers. You may have a right to know the categories and names/addresses of third parties that have received Information for their direct marketing purposes upon simple request, and free of charge. 
• Right to Appeal. You may have the right to appeal our denial of any request you make under this section.  To exercise your right to appeal, please submit an appeal request via the information in the How to Contact Us section below or using the Data Rights form (partners/indiv-rights-wp). Within the certain timeframe of receipt of your appeal, as proscribed by the applicable law we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions.  If we deny your appeal, you may contact the Attorney General or another authority which we will help you identify.

To learn more about whether you are guaranteed certain rights, to submit a request to exercise your rights, or to have an authorized agent make a request on your behalf, please call us, toll-free at 1-866-229-3507 or complete the data subject request form found at: work.partners/indiv-rights-wp.

A verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Information, or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

To help protect your privacy and maintain security, if you request access to or deletion of your Information, we will take steps and may require you to provide certain information to verify your identity before granting you access to your Information or complying with your request.  In addition, if you ask us to provide you with specific pieces of Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Information is the subject of the request. 

If permitted by the applicable data protection law, you may use an authorized agent to submit requests on your behalf provided that the authorized agent is a natural person or a business entity that you have authorized to act on your behalf.  If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, and identity verification from you; or (2) proof of power of attorney pursuant under applicable law.  Only you or your authorized agent may make a verifiable consumer request related to your Information. We may deny a request from an authorized agent that does not submit proper verification proof.

g. How we handle Protected Health Information under HIPAA

All health insurance carriers and health care providers may be subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable regulations that government agencies have issued for HIPAA implementation and compliance. HIPAA Privacy Regulations require certain employee benefit plans involved in your health care to have a "Notice of Privacy Practices." We collect, use and share your protected health information (PHI) as provided in the applicable UPMC Health Plan's Notice of Privacy Practices listed below.

We also share PHI as follows:

• In connection with UPMC Insurance Services Division's participation with ClinicalConnect HIE. The individual PHI and health information stored within ClinicalConnect HIE includes data such as test results, medication lists, consultation and progress notes, and clinical claims information. UPMC Insurance Services Division data will be shared only if the Member has been to a ClinicalConnect HIE provider or facility and, while there, did not choose to opt out of such information sharing. Members must notify their ClinicalConnect HIE provider if they do not wish to participate in the HIE.
• In connection with the Organized Health Care Arrangement (OHCA) between UPMC Insurance Services Division and UPMC to conduct analysis for quality assessment and improvement activities, utilization review, payment activities, and clinical solutions development to facilitate more effective and efficient delivery of health care services to patients and Members. This includes participation in various health care quality measures. Individual PHI may be accessed, used, and/or shared in the course of carrying out such OHCA activities.

In addition to this Privacy Statement, UPMC Health Plan's Notice of Privacy Practices will give you even more specific information and details about how we ensure the privacy of your health information Is covered by HIPAA. The UPMC Health Plan's Notice of Privacy Practices will also explain all the HIPAA rights that you have concerning the privacy of your health information, and how you can exercise those rights.

We continually review our policies and procedures to ensure that we are meeting the needs of privacy laws and our commitment to our Members. As new laws are passed and new regulations are issued or clarified, we will be providing you with revised information with any changes or updates.

If you have any questions concerning your right to the privacy and confidentiality of your personal information and data that have been entrusted to UPMC Health Plan, please contact our Member Services Department at the phone number on the back of your ID Card.

How to Contact Us:

Specific inquiries about this statement regarding HIPAA readiness and compliance as well as any questions regarding this Privacy Policy or the information that we have collected about you should be directed to:

UPMC Health Plan Privacy Officer
U.S. Steel Tower
600 Grant Street
Pittsburgh, PA 15219
Email: HealthPlanCPO@upmc.edu
Click here for general inquiries about UPMC Health Plan

Date last updated: 01/16/2025