Privacy Policy

Welcome! You have arrived at an online service location that is owned and operated by the Blue Cross and Blue Shield Association (“BCBSA” or “we,” “our” or “us”). This “Privacy Policy” governs your use the fepblue.org website and the MyBlue Portal (“Portal”) (collectively, the “Website”). 

The MyBlue Portal (“Portal”) is hosted and operated by Blue Cross Blue Shield Association (“BCBSA”) as part of its contract with the Office of Personnel Management (“OPM”) to administer the Federal Employee Program (“FEP”).   Some information collected through the Portal may be considered “protected health information” (“PHI”), as that term is defined in the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations.  To use all of the features of the Portal, you must have an active MyBlue account and sign in using that account information through the non-public section of the Website.

Your privacy is important to us. BCBSA maintains high standards for the protection of your privacy on the Website. Here is what you can expect when you visit the Website:

• Other than to fulfill a request from you or to provide you information or services as part of your contract for health benefits, we won’t sell, rent or share any individually identifiable personal information you provide without your consent or as allowed by applicable law.

• We won’t send you any unsolicited email (“spam”) without your consent.
• No personal information collected at this Website will ever be used to affect your health insurance coverage by or premiums paid to a Blue Cross and Blue Shield company.

Please remember that this Privacy Policy only covers the data collection and use practices for the Website.  BCBSA’s privacy policies may differ at its other websites or in its offline data collection and reporting practices. Questions regarding the privacy policy of your independent, local Blue Cross and Blue Shield company should be directed to that company.

HIPAA Notice of Privacy Practices

This Policy is in addition to the HIPAA Notice of Privacy Practices issued to all Service Benefit Plan contract holders when they enroll and whenever there is a material change to the privacy practices provided in the notice. In situations where there are material changes, the revised HIPAA Notice of Privacy Practices will be distributed to all contract holders within 60 days of the change. To review our current privacy practices please download the following:

Notice of Privacy Practices for the Service Benefit Plan

Notice of Privacy Practices for the US Office of Personnel Management (OPM)

The information we collect

When accessing or using features of this Website, our web servers automatically capture your domain name; the IP address of the web page from which you enter our site; the browser name, full version (major and minor), and plugins; the resolution (width/height) and color depth; the operating system; the pages you visit on our site; and the amount of time you spend here.

When you access the non-public section of the Website, we may access or collect personal and non-personal information about You, including but not limited to: (i) information you voluntarily provide, which may include account info, name, email address, user credentials, age, address, and/or phone number; (ii) health, medical, or therapy information, including PHI; and (iii) Information provided by BCBSA, an affiliate, or a business partner.

To the extent voluntarily permitted, we may obtain your location information to provide location-related services, e.g., finding a provider near you. We do not store information about your location after the service is performed.  Your location information may be shared with third-parties that we have hired to perform the location-based services, such as Provider Finder. You can withdraw consent to use precise, real-time or network location data at any time by turning off the location-based feature on your web browser or by opting out of using any location-based features, such as Provider Finder. If you withdraw consent, functionality associated with precise, real-time or network location, such as Provider Finder, may be limited. 

We may use your information that we collect unless restricted by this Policy or by law. We may use this information for a number of purposes, including but not limited to processing your requests, personalizing health products and services that may be of interest to you, and/or for site optimization and analytics. To the extent information is used consistent with this Policy or law, we may use the information directly or through third parties, including but not limited to business partners and third-party vendors. Personal information voluntarily provided by you will be retained in accordance with our record retention policies, subject to legal requirements, and for the purposes described in this Privacy Policy.

To the fullest extent permitted by applicable law, we may also disclose your information if we believe in good faith that doing so is necessary or appropriate to: (i) protect or defend the rights, safety or property of BCBSA or third parties (including through the enforcement of this Privacy Policy, and other applicable agreements and policies); or (ii) comply with legal and regulatory obligations (e.g., pursuant to law enforcement inquiries, subpoenas or court orders). To the fullest extent permitted by applicable law, we have complete discretion in electing to make or not make such disclosures, and to contest or not contest requests for such disclosures, all without notice to you.

If you use the features on this Website or on the websites of our business partners, you are “opting in” and agree to our collection of information as described above. You can “opt out” or prevent us from collecting PHI or personal information by not accessing this Website or using the interactive features of this Website or the websites of our business partners. You may “opt in” or “opt out” each time you access the Website. If you “opt out,” you cannot use the interactive features, such as the Provider Directory and Pharmacy Programs.

Information About Children Under 13

Any section of www.fepblue.org that is directed to children or teens is protected by a screening mechanism to help confirm parental consent is obtained before we collect or use personal information from children under 13. We do not knowingly collect or use personal information from children under 13 without the consent of a parent or guardian.

In the event that we become aware that we have collected Personal Information from any child, we will dispose of that information in accordance with the Children’s Online Privacy Protection Act and other applicable laws and regulations. If you are a parent or guardian and you believe that your child under the age of 13 has provided us with information without your consent, please contact us at bcbswebmaster@bcbsa.com, and we will take reasonable steps to confirm that such information is deleted from our files.

Information Security

We maintain administrative, technical, and physical safeguards designed to help us protect the personal information that you provide. Notwithstanding these efforts, we cannot guarantee the confidentiality and security of this Website.  Please be advised that the confidentiality of any communication or material being transmitted using the public Internet or non-secure Internet electronic communications cannot be guaranteed.  Notwithstanding our security safeguards, we cannot guarantee the confidentiality and security of electronic communications.  If you wish to keep your communications to us private, you should not communicate to us using the Website.   

Please be advised that the confidentiality of any communication or material being transmitted using the public Internet or non-secure Internet electronic communications cannot be guaranteed. Notwithstanding our security safeguards, we cannot guarantee the confidentiality and security of electronic communications. If you wish to keep your communications to us private, you should not communicate to us using the Website.

In addition to the administrative, technical, and physical safeguards that we employ, the confidentiality and security of your information depend on you, as well.  If you choose to use a persistent log-in, for example, having your user name or password be remembered, others may be able to access information through your web browser. Additionally, when you are no longer accessing features of the secured portion of the Website, you should log off of your Website session; rather than closing your web browser.  If you are concerned about the unauthorized use or disclosure of information via your web browser, you should elect to not use the persistent log-in feature.  Additionally, we recommend using a unique password for this Website and not one that is used for other websites.  You are responsible for keeping all passwords used to access the secure section of the Website confidential.  Under no circumstances should you share your password with or provide access to the Website for an unauthorized person or entity.

Use of the information this Website gathers/tracks

We gather and store information in the aggregate to maintain or improve our Website, and we may share that information with other areas in BCBSA, local Blue Cross and Blue Shield companies, our business partners, or with companies we hire to help us maintain or improve the Website. 

Additionally, any individually identifiable personal information you voluntarily give us, including Protected Health Information, will be stored in a secure environment and used to provide the product, service, or information you have requested or for which you registered. Unless you specifically consent to let us do so, your personal information, including your email address, will not be sold, rented, licensed or otherwise shared with third parties, other than Blue Cross and Blue Shield companies or business partners as required to fulfill a request from you to provide you information or services as part of your contract for health benefits or to personalize products and services for you. Personal information you voluntarily provide and the information we collect will not affect your insurance coverage, eligibility, premiums or claims payment by any Blue Cross and Blue Shield company.

This Website also uses the tool “Google Analytics” to collect data on the use of this Website and help us better understand our visitors’ usage. To access Google Analytics’ privacy policy and/or opt out of being tracked by Google Analytics, please visit http://tools.google.com/dlpage/gaoptout. Website Users can also enable a privacy browser to restrict tracking by Google.

Cookies and Similar Technology Policy

What are cookies?

A cookie is a small amount of data sent from a web server to your browser and stored on your computer’s hard drive.  We may use cookies to collect information and enhance your user experience on Website. The use of cookies is designed to augment your online experience via the information you provide. FEP uses and stores this information to provide you with more personalized and customized online services and to make our site more convenient, useful, valuable and appealing to you.

We may use cookies to collect information and enhance your user experience. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our Website. This type of information is collected to make the Website more useful to you and to tailor your experience with us to meet your special interests and needs.

We use two broad categories of cookies: (1) first party cookies, served directly by us to your computer or mobile device, which we use to recognize your computer or mobile device when it revisits our Website; and (2) third party cookies, which are served by service providers on our Website, and can be used by such service providers to recognize your computer or mobile device when it visits other websites.

Cookies we use

The Website uses the following types of cookies for the purposes set out below:

Disabling cookies

If you decide at any time that you no longer wish to accept cookies from our services for any of the purposes described above, then you can typically instruct your browser, by changing its settings, to remove or stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. In order to do this, consult your browser’s technical information (instructions are usually located within the “settings,” “help” “tools” or “edit” facility). Many browsers are set to accept cookies until you change your settings.

Further information about cookies, including how to see what cookies have been set on your computer or mobile device and how to manage and delete them, visit https://allaboutcookies.org/.

If you do not accept our cookies, you may experience some inconvenience or not be able to use all portions of the services or all functionality of the services. For example, we may not be able to recognize your computer or mobile device and you may need to log in every time you visit Website.

Pixel tags

In addition, we may use pixel tags (also referred to as clear GIFs, web beacons, or web bugs) on fepblue.org to track the actions of users on the Website. Pixel tags are tiny graphic images with a unique identifier, similar in function to cookies, which are used to track online movements of web users. In contrast to cookies, which are stored on a user’s computer hard drive, pixel tags are embedded invisibly in web pages. Pixel tags also allow us to send email messages in a format that users can read, and they tell us whether emails have been opened, for example, to help confirm that we are sending messages that are of interest to our users. We may use this information to reduce or eliminate messages sent to a user.

Do not track signals

Some internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to do not track signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Third party analytics providers and ad servers

We may work with certain third parties to provide us with information regarding traffic on Website, to serve advertisements elsewhere online, and to provide us with information regarding the use of our Website or services and the effectiveness of our advertisements. These third parties may automatically collect information about you using their own cookies or other technologies, or may otherwise collect or have access to, information about your visits to this and other websites, your IP address, your ISP, the browser you use to visit our Website and other usage information. Information collected may be used, among other things, to deliver advertising targeted to your health insurance coverage and services and to better understand the usage and visitation of our Website and the other sites tracked by these third parties. If you would like more information about this practice and to know your choices about not having this information used by these companies, you may visit: http://www.aboutads.info/choices (for website users), http://www.networkadvertising.org/managing/opt_out.asp (for website users), http://youronlinechoices.eu/ (for users in the EU), or http://youradchoices.com/appchoices (for mobile app users).

Sites we link to

If you choose to use any of the links we provide to our member companies, vendors, and other third party resources, you will be directed to a new website.  Protection of your privacy at all third party websites will be governed by the privacy policy at that third party’s website. Please take the time to read the privacy policies at their websites.

We have business relationships with Blue Cross and Blue Shield member companies and other third party vendors and resources. These linking relationships are not a form of advertising or promotion, but part of the unique set of benefits available under the Blue Cross and Blue Shield Service Benefit Plan and the Blue Cross Blue Shield Association.

Our Online Communication Practices

We send communications in accordance with this Policy and applicable laws. We may use cookies or other technologies to monitor whether you open and/or click on URLs in email communications and/or electronically transmitted newsletters.  We offer you appropriate consent mechanisms for communications, such as an opt-in or an opt-out. Please be aware that consent mechanisms may not apply to certain types of communications, such as account status, site updates, and other communications.

Changes to this policy

We may update this policy from time to time. When we do, we will post the current version on this site and we will revise the version date shown on this page. We encourage you to periodically review this policy so you will be aware of our privacy practices.

• Policy updated March 19^th, 2022.

Make a privacy complaint

You may submit a complaint to us if you believe that we have violated your privacy rights. To make a complaint, please write or call the customer service number for your local Blue Cross and Blue Shield company and ask for the privacy contact.