Legal

We are required to provide certain information to you before you agree to receive electronic communications.

This notice applies to all Internet-based communications from us, including email, website and mobile applications.

Electronic communications include, but are not limited to:

• Regulatory Notices
• Plan Documents
• Benefit Determinations and/or Information (e.g.; Explanation of Benefits, Health Statements, Claim Letters)

Electronic delivery of communications

By choosing electronic delivery you will receive communications electronically instead of receiving a paper copy.

The types of communications available electronically are subject to change, and if additional communications become available in an electronic format, you will receive those communications electronically. Occasionally, in addition to electronic communications you may also receive a hard copy document.

Your consent remains in effect until you withdraw it.  You may withdraw your consent at any time and choose to receive paper mailings by resetting your mailing and email preferences in your Account Settings on myuhc.com.

You have the right to also receive a free paper copy of communications that we are required to provide to you. To request a paper copy of a specific communication, call the member phone number on your health plan ID card.

If we attempt to deliver information to an email address you provide and the message is returned as undeliverable after several attempts, we will assume that you have withdrawn consent for electronic delivery and will begin sending the information to you in paper format. To ensure that you continue to receive emails from us, add the email “from” address to your email address book or safe list. To update your email address, log in to myuhc.com and go to the Change Mailing and Email Preferences page under Account Settings.

Requirements to access and retain information

In order to receive and retain electronic communications, you must have access to a computer or other device which is capable of accessing the Internet and you must have software which permits you to receive and access Portable Document Format or “PDF” files, such as Adobe Acrobat Reader® version 6.0 or higher (Download Adobe Reader.) View the list of supported browsers.

UnitedHealth Group takes the protection of our customer and member data seriously. We are grateful for the investigative work into security vulnerabilities that is carried out by well-intentioned, ethical security researchers. We are committed to collaborating with the information security community to investigate and resolve security issues within our web sites, online services, and mobile applications that are reported to us in accordance with this Vulnerability Reporting Policy. If you have information related to potential security vulnerabilities of UnitedHealth Group, UnitedHealthcare or Optum products or services, we want to hear from you.

UnitedHealth Group does not offer a bug bounty program or other rewards for security disclosures. However, we appreciate the efforts of security researchers who take the time to investigate and report security vulnerabilities to us in accordance with this policy.

This program is not a means to submit complaints about UnitedHealth Group, UnitedHealthcare, Optum, or its subsidiaries’ (hereafter referred to as “UnitedHealth Group”) services or products, or for inquiries regarding the availability of company web sites or online services.

The following types of vulnerabilities are considered out of the scope for the purposes of this program:

• Volumetric vulnerabilities (e.g., Denial of Service or Distributed DoS);
• Reports of non-exploitable vulnerabilities and violation of “best practices” (e.g., missing security headers);
• Transport Layer Security (TLS) configuration weaknesses (e.g., support for “weak” cipher suites);
• Fingerprinting/banner disclosure on common/public services;
• Self-cross-site scripting (XSS);
• Internal IP disclosure;
• Cross-site request forgery (CSRF);
• Un-exploitable HTTP Methods (e.g., OPTIONS or HEAD);
• Error-messages with non-sensitive data; and
• Lack of secure/HTTP-only flags on non-session cookies.

UnitedHealth Group may update this policy at any time, including by making changes to list of out-of-scope vulnerabilities.

If you have discovered an issue that you believe is an in-scope vulnerability, please email securityreporting@optum.com. Please include the following, as applicable:

• A detailed description of the vulnerability
• Full URLs associated with the vulnerability
• A Proof of Concept (POC) or instructions (e.g., screen shots, video, etc.) on how to reproduce the vulnerability, or steps taken to exploit the vulnerability
• Entry fields, filters, or other input objects involved
• Your assessment of risk, or exportability assessment
• Instructions for how to reach you with follow up questions

Offering a solution is encouraged but not required to report a vulnerability. Lack of detailed vulnerability explanation may result in delays in our response and subsequent potential actions on the finding.

This policy prohibits the performance of the following activities:

• Hacking, penetration testing, or other attempts to gain unauthorized access to UnitedHealth Group software or systems;
• Active vulnerability scanning or testing;
• Disclosure or use of any proprietary or confidential UnitedHealth Group information or data, including customer data; or
• Adversely impacting the operation of UnitedHealth Group software or systems.

Security researchers must not violate any law, or access, use, alter or compromise in any manner any UnitedHealth Group data.

If you have any questions regarding this policy or the guidance above, please contact our security team for guidance: securityreporting@optum.com.

Upon receipt of the vulnerability report, UnitedHealth Group or one of it's representatives may send an automated response as acknowledgement. UnitedHealth Group may contact reporter(s) if additional information is needed to assist with a follow-on investigation. For the security of our customers, UnitedHealth Group will not disclose, discuss, or confirm security issues.

In order to protect our customers, UnitedHealth Group requests that security researchers not post or share any information about a potential vulnerability in any public setting until we have researched, responded to, and addressed the reported vulnerability and informed customers and stakeholders as needed. The time to address a valid, reported vulnerability will vary based on impact of the potential vulnerability and affected systems.

Vulnerability: A weakness in the design, implementation, operation or internal control of a process that could expose the system to adverse threats from threat events.

Denial of Service (DoS): An attack on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate.

Distributed Denial of Service (DDoS): An attack on a service from multiple compromised computer systems that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate, thereby denying service to legitimate users or systems.

Transport Layer Security (TLS): A protocol that provides communications privacy over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery.

Self-Cross-Site Scripting (XCSS): A social engineering attack to gain control of a victim's web accounts via the victim unknowingly running malicious code on their own web browser.

Cross-Site Request Forgery (CSRF): A type of malicious exploit of a web site where unauthorized commands are transmitted from a user that the web site trusts. This is also known as a one-click attack or session riding.

Effective date

The effective date of this policy is January 20, 2023.