Protecting your privacy

Web and Mobile Privacy Statement

Welcome to our web and mobile experience. By using our websites and mobile apps, you agree to the terms of this Privacy Statement.

This statement describes how Aetna (“Aetna”, “we” or “us”) may collect information about you through your interactions with us on our website and mobile applications (“apps”) that contain a link to this statement (collectively, the “Services”).

If information collected through the Services is member information, please refer to your Notice of Privacy Practices and not this Privacy Policy. If you are a member covered by an Aetna insured policy, this Notice can be found on this app, if you are covered through an employer plan which is self funded, ask your employer for a copy of your Notice. Examples of member information are information collected when you enroll in an Aetna health plan or access services related to your health plan.

We do not knowingly collect personal information online from any person we know to be under the age of 13. We tell users under 13 not to send any information to us through the online Services without their parents’ consent.

We may collect two basic types of information:

Personal information is data that is unique to a person. It may include information such as your name, address, Social Security number, email address, telephone number and certain personal device information.
Non-personally identifiable information is data that doesn’t personally identify you. This may include demographic information, aggregated information or certain information collected automatically through your device. These may include what web browser you use, server log files, cookies, pixel tags, web beacons and other tracking methods, and other non-personally identifiable information collected by us or provided by you.

We collect your personal information when you:

Sign up or create a personal profile with us
Request products, services or information from us

We may also automatically collect certain personal device information. This may include your device’s physical location, internet protocol (IP) address, battery information, app activity, data usage, and malware information. This helps us identify you and your device to prevent fraud and data loss and keep our app secure.

In some cases, and in all cases required by law, you can update the information you give us. Just send us an email or update your online profile. Please revisit the specific place in the app where you first gave us your information.

We may use your personal information to:

Confirm it’s you so we can be sure our interactions with you are secure and confidential
Respond to your questions or requests
Deliver web-based products and services to you
Send you marketing messages that may interest you

Except during the sale, transfer, merger, or other transaction involving all or part of our company, we won’t sell, license, or otherwise transfer any rights to your personal information to a third party unless you expressly authorize it.

We may transmit or share your personal information with other parties:

If required by law, such as to comply with a subpoena, regulatory oversight or other legal process
When our contractors or vendors need to perform certain services, such as app maintenance or to improve performance

In all cases, we’ll require the other party to protect the information. They can use it only for the purpose we provided it.

We collect and aggregate non-personally identifiable information when you visit our website or use our apps. It helps us analyze and improve the services we provide you. Because this information doesn’t personally identify you, we may use and share it for any purpose permitted by law. We may:

Automatically collect certain web browser information. Web browsers collect and store data about your device and operating system when you use our apps. When we collect this information, as well as your device’s media access control (MAC) address, we use it to help create a secure and consistent connection to you and customize experience and content when you use our apps.
Perform page tagging. This is a way to log web page and visitor information when you use our apps. "Tagging" does include a JavaScript program running in your browser. But it’s limited to providing information about the page you’re requesting and the setup of your browser. It won’t read any of your data files, extract personal information about you, or run any other programs. You can disable JavaScript in your browser to stop tagging, but that may keep you from using all the functions on our app.
Use tracking pixels or beacons. These electronic files track your activity on our apps. They also track your completion of transactions and browsing behavior.

A "cookie" is a bit of data that we can send to your browser when you link to our apps. It isn’t a computer program. It can’t get any data or personal information on your computer. Your browser software can be set to reject or accept cookies.

Our use of cookies allows us to collect and retain certain information about a website user, such as the type of Web browser you use. Reviewing our Web server logs and site usage helps us monitor performance. Cookies also help us:

Enhance web and mobile navigation
Personalize your experience
Understand how you use our services
Diagnose problems
Measure the success of our marketing campaigns
Deliver online content on services/products that may interest you
Otherwise administer our services

Collecting IP addresses is also a standard practice and is done automatically by many websites and apps. We use IP addresses to administer our services, measure service levels and help diagnose server problems. Your IP address is a number that is automatically assigned to the computer that you are using by your Internet Service Provider. An IP address may be identified and logged automatically in our server log files whenever a user accesses our services, along with the time of the visit and the page(s) visited.

Our Services use tracking technologies to collect and record your activities and movements across our websites throughout your browsing session, including page hits, mouse movements, scrolling, typing, out-of-the-box errors and events, and API calls (“session data”). We use this information to provide us with analytics and to improve our products, services, and your experience. Such tracking may also include recorded sessions, which we may play back for these purposes. We may share session data with our vendors (which may change over time) for these purposes, who will use the session data solely on our behalf.

As permitted by law, we may also sell or disclose patient or member information that has been deidentified. This means data that can be used to identify a patient or member has been removed or changed according to one of the methods described in the Code of Federal Regulations. These are known as the HIPAA expert determination and HIPAA safe harbor methods. (See Section 164.514(b)(1) or (b)(2) of Title 45 of the Code of Federal Regulations.)

We understand that the security, integrity and confidentiality of your information are very important to you. And we want to protect it. Here’s how:

We seek to use technical, administrative and physical security measures to protect your personal information from unauthorized access, disclosure, use or changes.
We regularly review our security practices. We test our apps regularly to mimic attempts to breach our security. We also have robust disaster recovery plans in place. Despite our best efforts, though, note that no security measures are perfect or 100 percent secure.

We don’t show you third parties’ ads on our apps. But we may use third-party advertising companies to serve you our ads on other sites based on the web pages you may have visited or your online activity. These are known as interest-based or personalized ads. They may also be known as targeted ads.

We (Aetna) show you these ads so you can see products and services that might interest you. We don’t direct ads to children. Or where we know a user is under 13 years old.

In order to serve up information related to our Services, the third-party companies may place or recognize a unique cookie on your browser (including through the use of pixel tags). We follow the guidelines of the Digital Advertising Alliance (DAA) Self-Regulatory Principles for Online Behavioral Advertising. These help you understand and have greater control over the ads you see based on your online behavior. The DAA has a web site where you can opt out from getting targeted ads from some or all of the companies in the program. Our apps don’t respond to “Do Not Track” signals from browsers.

We may use analytics providers that use cookies, pixel tags and other, similar technologies to collect information about your use of the Services and your use of other websites and online services. Aetna and these other parties use these details to understand your online activity. We also use it to deliver ads and web site content based on your interests.

This policy doesn’t apply to, and we aren’t responsible for, the cookies or web beacons, or other tracking methods used by third parties. You can check out the privacy policies of these other companies to learn more.

We welcome the comments and questions you send to the email address given in our apps. We’ll share them with our Member Services team and other employees who can best help you.

Keep your information safe. Don’t email us information you consider confidential. If you’re a health plan member, call us at the number on your member ID card instead. Or call the number in the app you’re using. There are also some secure areas of our apps to share this type of information.

The Services may contain links to, or otherwise make available, third-party websites, services, or other resources not operated by us or on our behalf (“Third-Party Services”). We aren’t responsible for the privacy practices, content or accuracy of websites or apps of the Third-Party Services. We also don’t review or endorse their content or the products or services they describe.

We are not responsible for the privacy or security of any information you provide to them or their handling of information. We recommend that you review the privacy policy of any third party to whom you provide personal information online.

In addition, we aren’t responsible for the information, collection, use, disclosure or security policies and practices of other organizations. These include companies such as Apple, Google, Microsoft, RIM, or any other app developer, app provider, operating system provider, wireless service provider, or device manufacturer.

We may change this Privacy Statement. You can find the date changes were last made at the bottom of the page. Any changes become effective when we post the revised Privacy Statement. Your use of our websites or mobile apps following these changes means you accept the revised version. This isn’t intended to, and doesn’t create, any contractual or other legal rights in, or on behalf of, any party.

Privacy Statement update: August 11, 2021

Privacy notices

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule affords members the right to receive a notice that describes how health information may be used and disclosed and how to get access to this information. Aetna is required to send a notice ("Notice of Privacy Practices") to members of our insured Health and Long Term Care plans and Mail Order Pharmacy customers.

Aetna is also required to send a privacy notice ("Notice of Information Practices") to our insured Life and Disability plan members and to our Large Case Pension payees.

Notice of privacy practices by plan type

Document name	Language
Medical, Dental, Pharmacy, Managed Behavioral Health and Vision plans Notice of Privacy Practices	English (PDF) Spanish (PDF)
Aetna Senior Supplemental Health Notice of Privacy Practices	English (PDF) Spanish (PDF)
Aetna Student Health Notice of Privacy Practices	English (PDF) Spanish (PDF)
Employee Assistance Plan Notice of Privacy Practices	English (PDF) Spanish (PDF)
Long-Term Care Notice of Privacy Practices	English (PDF) Spanish (PDF)
Aetna Voluntary Notice of Privacy Practices	English (PDF) Spanish (PDF)
Aetna International – U.S. Based Plans Notice of Privacy Practices	English (PDF) Spanish (PDF)

Document name	Medical, Dental, Pharmacy, Managed Behavioral Health and Vision plans Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Document name	Aetna Senior Supplemental Health Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Document name	Aetna Student Health Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Document name	Employee Assistance Plan Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Document name	Long-Term Care Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Document name	Aetna Voluntary Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Document name	Aetna International – U.S. Based Plans Notice of Privacy Practices
Language	English (PDF) Spanish (PDF)

Notice of information practices by plan type

Document name	Language
Large Case Pension Notice of Information Practices	English (PDF)
Life and Disability Notice of Information Practices	English (PDF) Spanish (PDF)
Life and Disability Privacy Notice for Aetna Voluntary Notice of Information Practices	English (PDF) Spanish (PDF)
Life Privacy Notice for American / Continental Notice of Information Practices	English (PDF) Spanish (PDF)

Document name	Large Case Pension Notice of Information Practices
Language	English (PDF)

Document name	Life and Disability Notice of Information Practices
Language	English (PDF) Spanish (PDF)

Document name	Life and Disability Privacy Notice for Aetna Voluntary Notice of Information Practices
Language	English (PDF) Spanish (PDF)

Document name	Life Privacy Notice for American / Continental Notice of Information Practices
Language	English (PDF) Spanish (PDF)

Complaints

If you think your HIPAA Privacy Rights have been violated, you can contact us using the toll-free Member Services number on your ID card or you may contact the Aetna Privacy Office directly at the address below:

HIPAA Member Rights Team
Aetna Inc.
P.O. Box 14079
Lexington, KY 40512-4079

You also may write to the Secretary of the U.S. Department of Health and Human Services.

Security highlights

Aetna takes information security seriously and we diligently safeguard your personal information. Here are some ways Aetna protects your information and steps you can take to help.

A list of steps we take to secure your health information.

17 steps for securing health information (PDF)

Our effort to reduce the use of SSNs

Protect your medical records and identity

Because we’re committed to protecting the privacy of our members, we’re moving away from the use of Social Security numbers whenever possible. Thieves often steal Social Security numbers when they hack websites and computers. A Social Security number is not required for health care services.

Here's how you can help

If you're a health care professional working with us:

Collect the patient's member ID number, rather than a Social Security number.
For your own transactions, use your Employer Identification Number (EIN), rather than a Social Security number.

If you're an Aetna member:

Give your member ID number -- not your Social Security number -- when you go to the doctor, dentist or hospital.

If you're an employer working with us:

Work with your Aetna Contact or Account Rep to reduce the transmission of SSNs

Protecting the privacy and security of sensitive information is one of our highest priorities. Accordingly, Aetna encrypts all Internet e-mails that contain member-specific health and financial information -- examples include, but aren't limited to, personal and demographic information (e.g., name, SSN, address), employment information, information about payment of benefits, provider information, diagnostic or treatment information, claims status information and information related to behavioral health and/or sexually transmitted disease services.

Use of encrypted e-mail enables us to send quick, reliable communications while maintaining our commitment to protecting the confidentiality of member-specific information.

What is encrypted e-mail?

Encrypted e-mail is scrambled by the sender's e-mail program, which renders it unreadable until it is descrambled or "decrypted" by the recipient. Unencrypted e-mail is similar to a postcard - the message can be viewed by anyone who picks it up. Encrypted e-mail is similar to a sealed letter -- the content cannot be viewed until the envelope is opened - except, in this case, the envelope has a lock on it to which only the recipient has a key.

How does Aetna's use of encrypted e-mail impact recipients?

Whenever Aetna transmits member-specific health or financial information via Internet e-mail, the e-mail includes a message indicating that the content has been secured via encryption.
Encrypted e-mails from Aetna include instructions on how to decrypt the message for viewing - this requires the recipient to perform a few simple clicks.
Anyone who receives an encrypted e-mail from Aetna is able to send an encrypted reply.
Third party messages that are sent to Aetna via the "Contact Us" feature on Aetna.com are also encrypted.

Who can receive member-specific health and financial information?

Aetna has strict procedures in place for determining if a third party can receive member health and financial information i.e., Aetna employees are required to verify whether a requestor is authorized to receive the information before it is released.

Whom can the recipient of an Aetna encrypted e-mail call with questions?

Each encrypted e-mail from Aetna includes instructions on how to open the message and view the secure content. In the event a recipient receives an error message while in the process of trying to open an Aetna-generated encrypted e-mail, the error message provides guidance for troubleshooting the problem. In addition, the error message includes the following contact information:

If you experience any problems, please contact 1-800-237-7476 (TTY: 711), option 4 (Secure Email) during normal business hours; 8AM to 6PM ET.

Medical identity theft is a growing problem

Medical identity theft happens when someone steals your personal or health insurance information. They use it to get medical care, prescriptions, insurance payouts, even surgery. It’s a lot like regular identify theft. It can damage your credit rating. Cost you money and take time to clear up. Even hurt your chances to get some jobs. And it's happening more and more in the United States.

Here are a few steps to protect yourself

Be careful with your member ID card

It could be used to get medical services or drugs. And these will be on your medical record permanently. If your card is missing, lost or stolen, notify Aetna Member Services right away.

Keep personal information personal

Don’t give out your insurance ID, Social Security or driver’s license numbers on the phone or by mail to just anyone. Make sure you initiated the contact. And make sure there is a valid reason for giving out the number.

Be on guard even if someone claims to be from Aetna

We avoid asking for your Social Security number. However, there are times we need it. For example, if you:

Sent us a form that requested your Social Security number but you didn’t provide it or it is not readable, we might call you to ask for it.
Left a voice mail for someone at Aetna that did not include enough information to identify you, we might ask for additional information when returning your call.

Review health care information

Take time to read mailed Explanation of Benefits (EOB) statements or online claims. Even if they are marked, “This is not a bill." Look for:

Wrong group or identification numbers
Unfamiliar provider offices or hospitals
Dates for services on which you did not receive care
Prescriptions you did not fill

Make sure “free” is free

If you visit a free clinic, make sure it’s free. Don’t show your ID card for any reason.

Check your credit report

Identity thieves can run up medical costs in your name. The bills can be mailed to another address. You won’t know unless you check your report. Or you get a call from a collection agency.

Find out how you can get a credit report for free visit the Federal Trade Commission.

Health care privacy FAQs

Simple, direct answers to common questions about health care privacy.

If you don't believe your health information is protected, you may be less likely to visit or talk to your doctors and other health care experts about health issues because you are afraid of who else may learn about your conditions. This may place you at greater risk: Your doctor needs to know as much as possible about your health to give you the best possible care.

The Health Insurance Portability and Accountability Act (“HIPAA”) includes a privacy rule that require people who manage your health care keep your information private (other federal and state laws include privacy protections as well). Health care companies must follow the HIPAA privacy rule as well as health care providers. Examples of health care companies and health care providers include:

Doctors
Dentists
Psychologists
Chiropractors
Hospitals
Clinics
Nursing homes

Here are some examples of protected information:

Anything your doctors, nurses, and others put in your medical record
Conversations your doctor has about your care or treatment with nurses and others
Information about you in an insurer's computer system
Billing information about you at a doctor's office, clinic or hospital

You have the right to:

Know who has your personal health information
Request limits on who can see this information
Get a copy of this information
Be provided with privacy notices that explain our use and disclosure of your information
Have this information safeguarded
Request corrections to your information
Decide if you want to give your permission before your information can be used or shared for certain purposes, such as for marketing
Get a report on when and why your information was shared for certain purposes
File a complaint if you feel your right to privacy has been violated

We have the responsibility to:

Put safeguards in place to protect your information
Limit the use and disclosure of your information to the minimum needed to accomplish our goals
Enter into agreements with our contractors and others to make sure they use and disclose your information properly and safeguard it appropriately
Have procedures in place to limit who can see your information
Hold training programs for employees to learn how to protect your information

Call us at the number on your member ID card. Tell us what you need. For example, you may want to:

Request information on how we may use or share your health information
See what health information we have about you
Authorize someone else to see your private health information
Ask us to refrain from sharing your information under certain circumstances. You may need to complete and send in a form depending on your request. Our response will depend on the nature of your request.

Do you get your health insurance where you work? If so, where you go for privacy information depends on the kind of plan you joined.

There are two kinds of health plans offered by employers. One kind of plan is called "insured" because an insurance company pays for claims. The other kind of plan is called "self-insured" because your employer actually pays for claims and hires another company only to run the systems that support the plan. If you are a member of a self-insured plan, you may need to work with your employer to address your privacy concerns.

To find out whether to address a privacy issue with your employer or with Aetna, call the number on your member ID card or talk to your company HR representative.

Contact us if you think your rights are being denied or your health information isn't being protected. Call the number on your member ID card. Or write to:

HIPAA Member Rights Team
P.O. Box 14079
Lexington, KY 40512-4079

You may also write to the Secretary of the U.S. Department of Health and Human

Services. You will not be penalized for filing a complaint.

You have the right to ask us to communicate with you in a certain way or at a certain location.

If you are on someone else's insurance and would like us to send your Explanation of Benefits statements and other claim information to an address that's different from the primary subscriber's, please call Member Services at the number on your ID card.

To stop paper mailings of Explanation of Benefits and claim information, log in to your secure account and use the "Profile" link in the upper right corner to change your paper saving preferences. Your Explanation of Benefits and claim information will still be available in your secure account.

You also can use the "Profile" link to opt in or out of receiving emails from us, or to add or change a phone number.

Aetna’s privacy center