MVP Health Care® (MVP) supports your ability to access your health information in a way that works best for you. In alignment with federal requirements from The Centers for Medicare & Medicaid Services (CMS), we make certain health information available through secure application programming interfaces (APIs), which allow you to connect your data to third-party applications of your choice.

Before you use a third-party application, it is important to understand how your information may be used and protected. The following information can help you make choices about how you share your health information with third-party applications.

What Is a Third-Party Application?

A third-party application (or “application”) is a software program developed by a company that is not affiliated with MVP. These applications may allow you to:

• Access claims, encounter, and certain clinical information made available by MVP
• Track medications or conditions using information from MVP or entered by you
• Share information with caregivers or providers
• Combine MVP information with data from other sources to support your health and wellness

You are not required to use any third-party application to access or utilize your MVP health benefit plan. MVP members can always access their plan and account details by using the secure member tools made available to all members at no additional cost.

Things to Consider Before Choosing an Application

Before connecting your health information to a third-party application, you should carefully review the application’s:

• Privacy Policy, including what information the application collects, how your data will be used, and whether your data will be shared with or sold to third parties.
• Security Practices, including whether the application uses encryption, requires strong passwords or multifactor authentication, and how it protects your data from unauthorized access.
• Secondary Uses of Data, including whether your data will be used for advertising or research and whether your health data can be combined with other personal information.
• Your Rights and Controls, including whether you can delete your data, revoke access to your data, and how you can close your account.

To further safeguard your information, experts recommend:

• Only downloading applications from trusted sources;
• Limiting the data you share to what is necessary;
• Using strong, unique passwords;
• Enabling multi-factor authentication where available;
• Regularly review connected applications and remove ones you no longer use; and
• Keeping your device software up to date.

HIPAA Enforcement and Protections

MVP is a Covered Entity under The Health Insurance Portability and Accountability Act (HIPAA), which protects the use and disclosure of Protected Health Information (PHI). The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules. Hospitals, providers, and other health care entities may also be covered under HIPAA.

Many third-party applications are not covered under HIPAA.

To learn more about your rights under HIPAA, visit the  U.S. Department of Health and Human Services website.

You can file a complaint to the OCR in their online portal or learn more about filing a complaint on the OCR website.

You can also contact OCR through these ways:

U.S. Department of Health and Human Services Office for Civil Rights
200 Independence Avenue, SW Room 509F HHH Bldg.
Washington, D.C. 20201

1-800-368-1019, TDD: 1-800-537-7697

Email: OCRMail@hhs.gov

Visit: hhs.gov/ocr/index.html

FTC Enforcement and Protections

Most applications are regulated by the Federal Trade Commission (FTC) which aims to prevent applications from engaging in deceptive actions such as sharing a user’s personal data without consent. If you suspect an application is in violation of the FTC, you can file a fraud report directly to the FTC. To learn more information from the FTC regarding how websites and applications collect and use your information, visit this FTC website.

You can also contact the FTC through these ways:

Federal Trade Commission Consumer Response Center
600 Pennsylvania Avenue, NW
Washington, D.C. 20580

Call: 1-877-IDTHEFT (438-4338)

Visit: www.ftc.gov/idtheft

If you have any questions or concerns, you can also contact MVP Member Services/Customer Care at the phone number on the back of your MVP Member ID card.