PRIVACY POLICY

Reviewed and Updated on: 1st Jan, 2024

When you use our services, you’re trusting us with your information. We understand this is a big responsibility and work hard to protect your information and put you in control.

Protecting your privacy is very important to us. This privacy policy describes what information we collect, why we collect it, and what we do with it. This privacy notice is for Medicare.gov, es.Medicare.gov, and other Medicare.gov subdirectories, like Medicare.gov/physiciancompare/. These websites are referred to as “Medicare.gov” throughout the rest of this notice and are maintained and operated by the Centers for Medicare & Medicaid Services (CMS). This notice of privacy policy aligns with the CMS Website Privacy Policy.

Medicare.gov doesn’t collect name, contact information, Medicare Number, or other similar information through these websites unless you choose to provide it. We do collect other, limited, non-personally identifiable information automatically from visitors who read, browse, and/or download information from our website. We do this so we can understand how the website is being used and how we can make it more helpful. For more information, see Types of information we collect.

Personally identifiable information (PII), defined by the Office of Management and Budget (OMB), refers to information that can be used to distinguish or trace an individual’s identity, like their name, Medicare Number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, like date and place of birth, mother’s maiden name, etc. Medicare Fee-for-Service eligibility and enrollment information and claims data are considered protected health information (PHI) under the Health Insurance Portability and Accountability Act (1996) (HIPAA) regulations. Read more about our privacy practices regarding PHI.

For example, we collect PII/PHI if you elect to create a user account on Medicare.gov, use Medicare.gov to apply for Medicare coverage, enroll in a plan, or use other tools that provide personalized services or information through Medicare.gov. We collect this information to be able to provide you access to the personalized information and services that Medicare.gov is designed to offer you. We don’t sell any information you provide when you visit Medicare.gov. For information on how we share information, see How CMS uses information collected on Medicare.gov.

Types of information we collect
Information which is automatically collected:
When you browse:

Certain information about your visit can be collected when you browse websites. When you browse Medicare.gov, we, and in some cases, our third-party service providers, can collect the following types of information about your visit, including:

Domain from which you accessed the internet (like Verizon.com if you’re using a Verizon account).
IP address (an IP or internet protocol address is a number that’s automatically assigned to a device connected to the internet).
Approximate geographic location based on the IP address of the user’s local system.
Operating system for the device that you’re using and information about the browser you used when visiting the site. The operating system is software that directs a computer’s basic functions, like executing programs and managing storage.
Date and time of your visit.
Pages you visited.
Address of the website that connected you to Medicare.gov (like Google.com or Bing.com).
Device type (like desktop computer, tablet, or type of mobile device).
Screen resolution.
Browser language.
Geographic location.
Time spent on page.
Scroll depth (measures how much of a web page was viewed).
Your actions on Medicare.gov (like clicking a button).
For more information, see How CMS uses third-party websites & applications with Medicare.gov.

We use this information to:

Measure the number of visitors to Medicare.gov
Help make our website more useful for visitors
Improve our public education and outreach through digital advertising
Also, this information is sometimes used to personalize the content we show you on third-party sites. For more information on our practices, see How CMS uses third-party websites & applications with Medicare.gov.

Information you may provide:
When you request information:

We collect information, including your email address or mobile phone number, to deliver alerts or eNewsletters. We use this information to complete the subscription process and provide you with information. You can opt out of these communications at any time by editing your subscription preferences.

When you submit forms:

We collect PII/PHI on paper or electronic forms, like Medicare coverage enrollment, authorizations to disclose personal health information, medical payment requests or appeals. When you specifically and knowingly provide us PII/PHI, like your name, email address, Social Security Number, or other unique identifier, we only use this information to fulfill the stated purpose on the form. If you choose to provide us with PII/PHI through a paper or electronic form, we’ll maintain the information you provide only as long as needed to respond to your question or to fulfill the stated purpose of the communication.

When you enroll in Medicare:

When you apply for Medicare, you can sign up for Medicare Part A (Hospital Insurance) and Medicare Part B (Medical Insurance) through the Social Security Administration (SSA) website. All PII you provide to the SSA is subject to the SSA’s privacy policies. Any PII that you supply to SSA that qualifies as PHI will also be subject to the HIPAA regulations.

For specific details on the data collected by the systems that make up Medicare.gov, visit the Privacy Impact Assessments (PIAs).

How CMS uses information collected on Medicare.gov
If we maintain your PII/PHI in a system designed to retrieve information about you by personal identifier (name, personal email address, home mailing address, personal or mobile phone number, etc.), we’ll protect it in accordance with the Privacy Act of 1974 (5 U.S.C. Section 552a).

Prior to requesting PII/PHI on a form on Medicare.gov, we’ll provide you with a Privacy Act Statement.

Sending you Medicare messages:
We use the email address or the mobile phone number you provide us to send emails or Short Message Service (SMS) messages (text messages) related to Medicare. If you give us permission, we’ll send you emails and text messages. We also may use the phone number you provide to call you about Medicare services.

Responding to you through Live Chat:
We use web chat to collect name, email, phone number, and description of the request from Medicare.gov users who choose to provide this information to request a Medicare Call Center representative contact them.

Conducting surveys to improve services:
We also use online surveys to collect opinions and feedback. You don’t have to answer these questions. If you do answer these questions, don’t include any PII/PHI in your answers. We analyze and use the information from these surveys to improve the Medicare.gov websites. The information is available only to CMS managers, members of the CMS communications and web teams, and other designated federal staff and contractors who require this information to perform their duties.

Using third-party tools for website analytics:
We use a variety of third-party web tools for web analytics. We use these tools to collect basic information about visits to Medicare.gov. This information is then used to maintain the website, including:

Monitoring website stability
Measuring website traffic
Optimizing website content
Helping make the website more useful to visitors
CMS staff analyzes the data collected from these tools. Reports are available only to CMS managers, teams who implement programs represented on Medicare.gov, members of the CMS communications and web teams, and other designated federal staff and contractors who need this information to perform their jobs.

Using third-party tools for outreach and education through digital advertising:
We use third-party web services to conduct outreach and education through the use of digital advertising for Medicare.gov. These third-party services may collect information through the use of web beacons (also called pixels) that are located on our pages. A web beacon is a see-through graphic image (usually 1 pixel x 1 pixel) that’s placed on a web page and, in combination with a cookie, allows us to collect information regarding the use of the web page that contains the web beacon.

We use web beacons to tell when a user is redirected to Medicare.gov by clicking or otherwise interacting with a Medicare advertisement that we ran on another website. This is known as “click tracking” or “conversion tracking,” and we use it to better target Medicare advertisements (known as “retargeting”) to inform consumers or people with Medicare about Medicare deadlines and the services available through Medicare.gov. For more information on how these tools work, see How CMS uses third-party websites & applications with Medicare.gov.

We also use third-party tools to help deliver advertising. Vendors that operate the third-party tools may also gather information about your visits to third-party sites outside of Medicare.gov. While we don’t track your internet activity outside of Medicare.gov, our vendors may use information collected automatically by visiting Medicare.gov, and combine it with data they collect elsewhere for targeted advertising purposes. You can opt out of this type of data collection via Privacy Manager, Ad Choices, and Do Not Track. For methods to opt out of this type of collection, see Your choices about tracking & data collection on Medicare.gov.

The outreach and education analytics tools provide reports which aggregate data like the number of clicks on advertisements. The reports are available only to CMS managers, teams who implement programs represented on Medicare.gov, members of the Medicare.gov communications and web teams, and other designated federal staff and contractors who need this information to perform their duties.

How CMS uses cookies & other technologies on Medicare.gov
The Office of Management and Budget Memo M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies, allows federal agencies to use session and persistent cookies to improve the delivery of services.

When you visit a website, its server may generate a piece of text known as a “cookie” to place on your device. The cookie, which is unique to your browser, allows the server to “remember” specific information about your visit while you’re connected. The cookie makes it easier for you to use the dynamic features of web pages. Information that you enter into Medicare.gov isn’t associated with cookies on Medicare.gov. Depending on the third-party tool’s business practices, privacy policies, terms of service, and/or the privacy settings you selected, information you’ve provided to third parties could be used to identify you when you visit Medicare.gov. These third parties don’t/won’t share your identity with CMS or the Department of Health and Human Services (HHS).

There are 2 types of cookies – single session (temporary) and multi-session (persistent). Single session cookies last only as long as your internet browser is open. Once you close your browser, the session cookie disappears. Persistent cookies are stored on your device for longer periods. Both types of cookies create an ID that’s unique to your device.

Session cookies: We use session cookies for technical purposes, like to allow better navigation through our website. These cookies let our server know that you’re continuing a visit to our website. The OMB Memo M-10-22 Guidance defines our use of session cookies as “Usage Tier 1—Single Session.” The policy says, “This tier encompasses any use of single session web measurement and customization technologies.”
Persistent cookies: We use persistent cookies to understand the differences between new and returning visitors to Medicare.gov. Persistent cookies remain on your device between visits to our website until they expire or are removed by the user. The OMB Memorandum M-10-22 Guidance defines our use of persistent cookies as “Usage Tier 2—Multi-session without personally identifiable information.” The policy says, “This tier encompasses any use of multi-session web measurement and customization technologies when no PII is collected.” We don’t use persistent cookies to collect PII. We don’t identify a user by using cookies.
CMS also uses these technologies on Medicare.gov:

Persistent cookies for digital advertising: Similar to persistent cookies identified above, CMS uses persistent cookies for outreach through digital advertising. These cookies can also be created on third-party websites and remain on your device between visits to our website until they expire or you remove them. Consistent with OMB guidance for “Usage Tier 2”, we don’t use persistent cookies for outreach to collect PII. CMS doesn’t identify a user by using such technologies.
Web beacons for digital advertising (also called pixels and/or tracking tags): See-through images placed on certain pages of Medicare.gov are typically used in conjunction with cookies and aren’t stored on your device. When you access these pages, web beacons generate a notice of your visit. For information on how we use web beacons, see How CMS uses third-party websites & applications with Medicare.gov.
Website log files: These are used as an analysis tool and to tell how visitors use Medicare.gov, how often they return, and how they navigate through the website.
Flash: Flash is used to assess the performance of the site and as a player for selected videos depending on the browser a device is using.
Local Storage Objects: We use Flash Local Storage Objects (“LSOs”) to store your preferences and to personalize your visit.

Your choices about tracking & data collection on Medicare.gov
Medicare.gov offers a Privacy Manager which gives you control over what tracking and data collection takes place during your visit. Third-party tools are enabled by default to provide a quality consumer experience.

The Privacy Manager provides you with the choice to opt in or to opt out of the different categories of third-party tools used by Medicare.gov: Advertising, Analytics, or Social Media. The Privacy Manager prevents cookies, web beacons, and Local Storage Objects from being placed on your device. The Privacy Manager also prevents third-party tools from loading regardless of your cookie settings, which provides you with an additional layer of privacy that prevents the tool from loading at all. Because the Privacy Manager creates a cookie in your browser, the opt in and opt out choices you make through the Privacy Manager will only be effective on the device and browser you used to make your choices, and your choices will expire when the cookie expires. Once the cookie is created, the Privacy Manager will retain your settings for 3 years from the date of your most recent visit. You may revisit the Privacy Manager to change or renew your choices at any time.

Modify privacy options

If you disable cookies in your browser, our Privacy Manager won’t be able to store your preferences and won’t function properly. If you don’t wish to use our Privacy Manager to opt out of the tools used by Medicare.gov, you can opt out of tools individually, or via the Digital Advertising Alliance (“DAA”) AdChoices icon, discussed in the next subsection.

If you opt out of the tools used by Medicare.gov via the Privacy Manager or by opting out of the tools directly, you’ll still have access to information and resources at Medicare.gov. Or, if you don’t want to use the website, you can get Medicare information by calling us at 1-800-MEDICARE (1-800-633-4227). TTY users can call 1-877-486-2048.

AdChoices: We include the AdChoices icon on all digital advertising that uses “conversion tracking” or “retargeting.” To learn about conversion tracking, targeted advertising, and retargeting, see How CMS uses third-party websites & applications with Medicare.gov. The AdChoices icon is usually at or near the corner of digital ads. When you click on the AdChoices icon, it will provide information on what company served the ad and information on how to opt out. Learn more about AdChoices.

Do Not Track: We automatically observe the “Do Not Track” browser setting for digital advertising that uses “conversion tracking” or “retargeting.” If “Do Not Track” is set before a device visits Medicare.gov, third-party conversion tracking and retargeting tools won’t load on the website. To learn more about conversion tracking and retargeting, see How CMS uses third-party websites & applications with Medicare.gov. Learn more about Do Not Track and how to set the Do Not Track setting in your browser.

How CMS uses third-party websites & applications with Medicare.gov
Medicare.gov uses a variety of technologies and social media services to communicate and interact with the public. These third-party websites and applications include popular social networking and media websites, open source software communities, and more.

Third-party websites:
Your activity on the third-party websites that Medicare.gov links to (like Facebook or Twitter) is governed by the security and privacy policies of those websites. You should review the privacy policies of all websites before using them so you understand how your information may be used. You may want to adjust your account privacy settings on any third-party website to match your preferences on Medicare.gov.

Website analytics tools:
These tools collect basic site usage information, like:

How many visits Medicare.gov gets
The pages visited by consumers
Time spent on Medicare.gov
The number of return visits to Medicare.gov
The approximate geographic location of the device used to access Medicare.gov
Types of devices used
This information is used to maintain the website, including:

Monitoring website stability
Measuring website traffic
Optimizing website content
Improving your experience
Use the Medicare.gov Privacy Manager to opt out of website analytics tools.

Digital advertising tools for outreach & education:
We use third-party tools to support our digital advertising outreach and education efforts. These tools enable us to reach new people and provide information to previous visitors. To use these tools, we use these technologies on Medicare.gov:

Click tracking: We use click tracking to identify the ads that are most helpful to consumers and efficient for outreach. This enables us to improve the performance of ads that consumers click on. When users click on links from ads, data about what ad was viewed is collected. Reports are generated about ad performance – including the total number of views and clicks an ad received.

Conversion tracking: We use conversion tracking to identify ads that are helpful to consumers and efficient for outreach. It enables us to improve the performance of ads viewed by consumers. When a Medicare.gov ad is viewed on a third-party site (like a banner ad), a cookie is placed in the browser of the device the ad was viewed on. If this device later visits Medicare.gov, the visit is linked to the ad viewed on the same device. Use the Medicare.gov Privacy Manager to opt out of advertising tools. Users can click on the “AdChoices” icon in the corner of our ads to opt out of this Ad Targeting. Users who have set their browser to “Do Not Track” will automatically be opted out of conversion tracking. For more information about AdChoices and Do Not Track, see Your choices about tracking & data collection on Medicare.gov.

Retargeting: We use retargeting to provide information to consumers who have previously visited Medicare.gov, like reminders about upcoming enrollment deadlines. Retargeting enables us to improve the performance of ads by delivering them to relevant audiences, like recent visitors to Medicare.gov. During a visit to Medicare.gov, a cookie is placed in the browser of the devices used to view the website. When that same device is used to visit third-party websites that are displaying Medicare.gov ads, ads for Medicare.gov may be shown to that device because it had previously visited Medicare.gov. Using these cookies, we don’t collect information about the third-party websites visited by a device. Reports are generated about ad performance – including the total number of views and clicks an ad received. Use the Medicare.gov Privacy Manager to opt out of advertising tools. Users can click on the “AdChoices” icon in the corner of our ads to opt out of this Ad Targeting. Users who have set their browser to “Do Not Track” will automatically be opted out of conversion tracking. For more information about AdChoices and Do Not Track, see Your choices about tracking & data collection on Medicare.gov.

Targeted advertising: We use third-party vendors to engage in targeted advertising (also called online behavioral or interest-based advertising) to provide information to consumers across their online activities. Targeted advertising involves the collection of data from a particular computer or device. Data regarding web viewing behaviors or application use is gathered to predict user preferences or interests. We can have ads delivered to computers or devices based on the preferences or interests inferred from the web-viewing behaviors or application use.

Third-party vendors engaged by us may also target advertising based on information automatically collected (not information you provide) when you browse our websites or other websites on the internet. You can opt out of this type of data collection via our Privacy Manager, Ad Choices, and Do Not Track. For methods to opt out of this type of collection, see Your choices about tracking & data collection on Medicare.gov.

We may consider new third-party tools or the use of new third-party websites, but we’ll first assess the tool or website before it’s used in connection with Medicare.gov. We’ll provide notice to the public before adding any new tool to Medicare.gov. These assessments include a description about how information will be collected, accessed, secured, and stored. See a list of the third-party tools currently being used on Medicare.gov. See risk assessments for third-party websites and applications.

How CMS protects your personal information
We’re committed to protecting information entrusted with us at Medicare.gov. If you visit Medicare.gov and choose to provide us with PII/PHI, we store your PII/PHI in a record system that can retrieve information about you by personal identifier (like name, personal email address, home mailing address, or personal or mobile phone number, etc.). We’ll protect the information you provide in accordance with applicable law, including the requirements of the Privacy Act of 1974 (5 U.S.C. Section 552a) and the regulations promulgated under HIPAA as amended (45 CFR 160-164). Privacy Act protections include the publication of Privacy Act System of Record Notices (SORN) in the Federal Register, which provide public notice about how we’ll use and disclose PII. SORN are also available on CMS.gov.

The original system of records notice entitled, “1-800 Medicare Choice (HELPLINE)” was published in the Federal Register on February 26, 2008. View the system of records and modifications.

For more information about Medicare.gov’s privacy policy, email Privacy@cms.hhs.gov.

Third-party services are web-based technologies that aren’t exclusively operated or controlled by a government entity, or that involve significant participation of a nongovernment entity. These services may be separate websites or may be applications embedded within our websites. The list of third-party services includes links to relevant third-party privacy policies.

How long CMS keeps data & how it’s accessed
We’ll keep data collected long enough to achieve the specified objective for which they were collected. Once the specified objective is achieved, the data will be retired or destroyed in accordance with published draft records schedules of CMS as approved by the National Archives and Records Administration.

We don’t store information from cookies on our systems. The persistent cookies used with third-party tools on Medicare.gov can be stored on a user’s local system and are set to expire at varying time periods depending upon the cookie. We assess whether the expiration date of a cookie exceeds one year and provides an explanation as to why cookies with a longer life are used on the site in the associated Third-Party Website or Application Privacy Impact Assessment.

Children & privacy on Medicare.gov
We believe it’s important to protect the privacy of children online. The Children’s Online Privacy Protection Act (COPPA) governs information gathered online from or about children under the age of 13. Medicare.gov isn’t intended to solicit information of any kind from children under age 13. If you believe that we’ve received information from a child under age 13, call us at 1-800-MEDICARE (1-800-633-4227). TTY users can call 1-877-486-2048.

Links to other sites
Medicare.gov may link to other HHS websites, other government websites, and/or private organizations (like health care providers). We link to other websites solely for your convenience and education. When you follow a link to an external site, you’re leaving Medicare.gov and the external site’s privacy and security policies will apply. Non-federal websites don’t necessarily operate under the same laws, regulations, and policies as federal websites. Other than third-party websites highlighted in this privacy notice, we aren’t responsible for the contents of external web pages and a link to a page doesn’t constitute an endorsement.

Social media & other sites that require registration
We use social media websites (listed below) to:

Increase government transparency
Improve information sharing
Promote public participation
Encourage partnership with CMS

Social media websites aren’t government websites or applications. They’re controlled or operated by the social media website. We don’t own, manage, or control social media websites. In addition, we don’t collect, maintain, or disseminate information posted by visitors to those social media websites. If you choose to provide information to a social media website through registration or other interaction with the website, the use of any information you provide is controlled by your relationship with the social media website. For example, any information that you provide to register on Facebook is voluntarily contributed and isn’t maintained by us. This information may be available to our social media page administrators in whole or part, based on a user’s privacy settings on the social media website. However, we won’t use PII, if provided by you to a social media website or other website that requires registration, for targeted advertising or retargeting. Although you may voluntarily contribute to a social media website with the intent to share the information with others on a CMS social media page, to protect your privacy, don’t disclose PII about yourself or others.