Sharing your health data

When authorized, your health data can be accessed through one or more application programming interfaces (APIs):

• Patient Access API — allows approved third-party apps you choose to access your health data.
• Provider Access API — allows any provider who has a current or future treatment relationship with you as a Wellmark member to access your health data.
• Payer-to-Payer API — allows Wellmark to gather data from your previous or current health insurer or send data to a current or future health insurer.

Under federal law (U.S. Department of Health and Human Services, 2024)¹, members enrolled in QHP coverage, as defined by the Affordable Care Act (ACA), may be automatically opted in to the Provider Access API, unless their records include sensitive medical information (see “Sensitive medical care opt out”). However, you are free to opt out of this or any other API at any time (see “How do I manage access to my health information?”).

Note: For the Provider Access API, changes apply to all providers, meaning you can't grant or remove access for a specific provider. If you opt out of the Provider Access API, the Health Insurance Portability and Accountability Act (HIPAA) and some state laws may still allow a provider to request and receive information necessary to treat you. If you have opted out, providers will only receive information relevant to their specific request. If you have opted in, providers will see all your QHP health data on file with Wellmark.

Sensitive medical care opt-out

Per federal law, if your data includes records related to mental health, substance use disorders, reproductive health, AIDS or genetics, you will be automatically opted out of the Provider Access API. If you grant access to providers, keep in mind they will be able to see this sensitive medical information.

Sharing data like this — also known as “interoperability” in health care — comes with several benefits. For example:

• Better outcomes — When you and your providers can see your medical history, it makes it easier to get the right care at the right time and improve your overall health care experience.
• Faster decisions — In some cases, data sharing can help providers make decisions about your care, including prior authorization requests, more timely.
• Lower costs — Sharing your data can help providers identify and address health issues early before they require expensive treatments, as well as reduce the risk of duplicate tests and procedures.

Data sharing enables access to records about you collected while you were a QHP member such as (but not limited to):

• Allergies and intolerances
• Care plans
• Claims history and details
• Immunization and medication records
• Test results
• Treatment history

If you’re ready to grant or remove access to your health information, there’s a few ways to do it:

• myWellmark^® — visit the Share data page to view and manage data access, imports and representatives.
• Interoperability: API Election form — complete and submit the Interoperability: API Election form by mail or through myWellmark.
• Appoint an interoperability personal representative— your interoperability representatives can grant or remove access to your information on your behalf. Visit the Interoperability personal representatives page to get started.
• Contact Wellmark Customer Service — send a secure message through myWellmark or call 800-990-7689 to manage data-sharing preferences.

You can ask Wellmark to request your available health data from another health insurance company. Once received, the data becomes part of your health profile and may be shared with apps, providers and other insurers, based on your permissions. If you're still actively covered by the other insurer, Wellmark will continue to import new data every three months.

Wellmark will only send your data to another insurer if you provide consent through that insurer's data-sharing process.

Parents and legal guardians can manage data-sharing preferences for their dependents age 17 or younger. However, if a dependent age 12 or older has sensitive health data, you will need to be appointed as their interoperability personal representative

to manage their data-sharing preferences, even if you are the parent or legal guardian. For more information, visit the Interoperability personal representatives page.

Sensitive medical care opt-out

Per federal law, if your data includes records related to mental health, substance use disorders, reproductive health, AIDS or genetics, you will be automatically opted out of the Provider Access API. If you grant access to providers, keep in mind they will be able to see this sensitive medical information.

When shared with health care providers or insurers:

Health care providers and insurers must follow the HIPAA Privacy Rule and other privacy laws designed to generally protect your health information.

When shared with third-party apps:

Third-party apps are not bound by HIPAA, meaning they only have to follow what’s in their own privacy policy. This means apps could potentially use, disclose and even sell your information.

If you’re thinking about sharing your health information with an app, review their privacy policy and consider the following:

• What security measures does the app use to protect your data?
• Will the app sell or disclose your data to third parties? If so, for what purposes, and can you control it?
• Can you control how the app uses, discloses or sells your data?
• What happens to your data if you revoke access, delete your account on the app, or leave Wellmark?
• Will the app collect non-health-related data, like your location or audio/voice recordings?
• How will the app notify you about changes to its privacy policy?
• Does the app have a process for collecting and responding to user complaints?

Note: Once data has been shared with a provider or app, they may retain copies of it even after you’ve removed access or are no longer a Wellmark member.

To report a concern or if you think your protected health information has been compromised, members should contact the Privacy Office to file a complaint with Wellmark at (877) 610-6395.

The Federal Trade Commission Act protects against deceptive acts, such as an app that discloses personal data in violation of its privacy notice. An app that violates the terms of its privacy notice is subject to the jurisdiction of the Federal Trade Commission (FTC). If you believe an app has inappropriately used, disclosed or sold your information, you should contact the FTC. You may file a complaint with the FTC using the FTC complaint assistant. The FTC provides information about mobile app privacy and security for consumers.

The U.S. Department of Health and Human Services' Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules. Along with most health care providers, such as hospitals, doctors, clinics and dentists, Wellmark is subject to HIPAA, so your health information is protected. Find more information about your rights under HIPAA and who is obligated to comply with HIPAA. Learn about filing a complaint with OCR related to HIPAA requirements or file a complaint with Wellmark by contacting Customer Service at the phone number listed on the back of your ID card.