Privacy policy

Main Content

Commonwealth Coordinated Care Plus Privacy Statement

Revised: December 11, 2020

Maximus Commitment to Privacy

Thank you for visiting the Commonwealth Coordinated Care Plus (“CCC Plus”) Web site (the “Site”) operated by Maximus Health Services, Inc. (“Maximus”) for the Virginia Department of Medical Assistance Services (“VA DMAS”). This Site is designed to make it easier for you to enroll and interact with VA Enrollment Broker online.

Confidentiality is a top priority at Maximus.  We are committed to ensuring the security and confidentiality of your information. Maximus respects your privacy and we have developed the following privacy statement to demonstrate our commitment to you. 

This privacy statement applies to:

  • Information we collect about you
  • How we use the information 
  • Choices you have about how we collect and use your information

This privacy statement does not apply to:

  • Privacy practices associated with any activities done outside your use of this Site
  • Websites other than this website
  • Applications other than this application 
  • Products and services not available or enabled through the Site

Information We Collect When You Enroll

In order to use some of this Site’s features, you may be asked to provide personal information. Maximus does not collect any personal information about you through this Site unless you provide that information voluntarily.

You provide personal information voluntarily when you enroll using this Site. We clearly identify data you must provide so we can deliver the services or information you have requested. Maximus may ask that you provide or verify the following personal information; the list is not exhaustive:

  • First and Last Name
  • Mailing Address (including ZIP/Postal Code)
  • County of Residence
  • Social Security Number
  • Date of Birth

Maximus uses the information collected to process your enrollment. It is your choice whether to provide this information to us. Providing this information is optional, but failure to do so in some cases will limit the services available to you.

Maximus maintains policies that protect the confidentiality of personal information obtained in the course of its regular business functions.  Maximus privacy policies impose a number of standards to guard the confidentiality, prohibit the unlawful disclosure, and limit access to personal information (such as Social Security Numbers and Medicaid ID numbers).  Maximus safeguards personal information by having physical, technical, and administrative safeguards in place.

Information We Collect to Stay Connected

This website allows you the opportunity to Stay Connected by signing up for email or phone updates about CCC Plus.  You provide personal information voluntarily when you elect to Stay Connected. Maximus may ask that you provide or verify the following personal information; the list is not exhaustive:

  • Email
  • Phone Number 
  • Whether you are electing to receive this information for yourself or for someone else
  • If you are a health care provider, administrator, or advocate
  • City 
  • County 

When you elect to Stay Connected, we may collect and process information about your actual location (geolocation).  Various technologies are used to determine location, including IP address, GPS, and other sensors that may provide information on nearby devices, such as Wi-Fi access points and cell towers. Please refer to your browser’s settings to disable geolocation tracking. 

If you sign up for text messages, the Granicus Wireless Terms and Conditions Apply. You can review the Terms and Conditions here.

How We Use and Share the Information Collected

Except as stated in this privacy policy, Maximus will only collect or disclose personal information collected through this Site if you have agreed to the collection or disclosure of that personal information. Choosing to provide personal information to Maximus, whether we request it or not, constitutes consent to the collection and sharing of the information with the Virginia Department of Medical Assistance Services for the reasons you shared the information with Maximus. You can view the Virginia Department of Medical Assistance Services privacy policy here.

The collection of information through this Site and the disclosure of that information are subject to the provisions of the Health Insurance Portability and Accountability Act (HIPAA) (Public Law 104-191).  To learn more about Health Information Privacy, visit HHS.gov.

Choosing to provide personal information to Maximus, whether we request it or not, constitutes consent to the collection and sharing of the information with VA DMAS for the reasons you shared the information with Maximus. 

Except as we state below or as otherwise authorized by law, Maximus will only collect or disclose personal information collected through this Site if you have agreed to the collection or disclosure of that personal information. Maximus may collect or disclose personal information without your agreement if it is:

  • necessary to perform our statutory duties as authorized by law, or authorized by state or federal statute or regulation
  • to comply with valid legal process such as a search warrant, subpoena or court order

Maximus may also disclose personal information to federal or state law enforcement authorities to enforce its rights against unauthorized access or attempted unauthorized access to Maximus information technology assets.

Maximus may disclose personal information to its agents, affiliates, and subcontractors to allow them to perform certain functions relating to your enrollment or your request to Stay Connected. 

Maximus does not share your personal information with unaffiliated third parties. We may use your information to improve the content, navigation, and efficiency of the Site. 

In order to make our Site better for you, we may use and share with others aggregated or anonymous (not personally identifiable) information that we have collected based on usage data, surveys, or statistical information that we have compiled about our users.

Virginia Law

Maximus protects our records in accordance with our obligations as defined by applicable Virginia Statutes, including, but not limited to, the Government Data Collection and Dissemination Practices Act (Code of Virginia § 2.2-3800), and the Administration of systems including personal information; Internet privacy policy; exceptions (Code of Virginia § 2.2-3803), and any applicable U.S. Federal laws.   

Web Site Time Out

For security purposes, your URL online session is set up to end after 30 minutes of user inactivity. You will receive a session timeout warning, allowing you to either continue your session or logout.  If you do not make a selection within one minute of the warning message, your session will automatically end. 

Information We Retain

Maximus retains the information collected through this Site, including personal information that you submit by enrolling, as required by our contract with the VA DMAS. To find out more about the rules for retaining your information, please mail your questions to the contact information provided below.

Website Privacy Statement

Our web server automatically collects and logs web usage data from when you visit the Site.  This information is collected for purposes related to the services we provide on behalf of VA DMAS. This information, including your Internet Protocol (IP) address, referring sites, pages viewed, browser type, operating system, CPU speed, referring or exit web pages, and length of visit, informs us about how visitors use and navigate the Site. Maximus will collect the information above from your visit to the Site only for these purposes and for purposes related to the services we provide on behalf of VA DMAS.  

govDelivery Analytics

Our application uses govDelivery analytics, a service which transmits traffic data to govDelivery analytics servers.  govDelivery does not identify individual users or associate your IP address with any other data held by govDelivery analytics. We use reports provided by govDelivery analytics to help us understand application traffic and webpage usage.  You may view the govDelivery analytics Privacy Statement located here.

Cookies and  “Do Not Track” Signals

Like most applications, We employ "cookies," "Web beacons," and similar devices to help you more efficiently use the application and to track your activities. A cookie is a small amount of data that is transferred to your browser by a Web server and can only be read by the server that gave it to you. It functions as your identification card and enables Maximus to record your activities and preferences. It cannot be executed as code or deliver viruses. A Web beacon is a small transparent gif image that is embedded in an HTML page or e-mail used to track when the page or e-mail has been viewed. Maximus uses cookies and similar devices to track your use of the application, types of Products and Services viewed, and information downloaded, and count visitors We receive daily. Our Web servers automatically log the IP/Internet address of your computer. Maximus does not generally use this information to identify you personally. 

Opt-Out of Cookies and govDelivery Analytics

If you do not want your device to accept cookies, you can modify the cookie option in your device’s settings. However, some application features or services may not function properly or be accessible without cookies.  For additional information on Opting-Out of govDelivery Analytics tracking cookies, please see govDelivery Analytics Cookie Management Statement here.

“Do Not Track”

"Do Not Track" is a preference you can set in your web browser to let the websites you visit know that you do not want them collecting information about you. The Site does not currently respond to a "Do Not Track" or similar signals.


Maximus is strongly committed to protecting personal information collected through this Site against unauthorized access, use or disclosure. Maximus limits employee access to personal information collected through this Site to only those employees who need access to the information in the performance of their official duties. Employees who have access to this information follow appropriate procedures in connection with any disclosures of personal information.

Maximus uses various technological and procedural security measures in order to protect the personal information we collect through the Site from loss, misuse, alteration or destruction. We have documented Information Security & Privacy policies to address data protection. We regularly provide information security and privacy awareness training to our employees.  However, you should be aware that, due to the open and unsecured character of the Internet, Maximus cannot be responsible for the security of transmissions of personal information over the Internet. We have prepared a formal incident response plan in case of a data breach.

To protect your communications through the Site, we authenticate, monitor, audit, and encrypt activity. You can tell when the site is secure by looking at the location (URL) field. If the URL begins with https:// (instead of http://), the document comes from a secure server. This means your personally identifiable information cannot be read or deciphered by unauthorized individuals. This is part of our continuing commitment to protecting your information. Please note, that despite our efforts, no security measures are completely secure. Use of this system constitutes consent to such monitoring and auditing.


Maximus is committed to complying fully with the Children's Online Privacy Protection Act. Although parents are free to use this website on behalf of their children, we don't direct this site to children or knowingly collect personal information from children. We're pleased to work with parents and guardians to delete from our records personal information that a child may have disclosed improperly on this website. Maximus appreciates your cooperation with this federally mandated requirement.

Reviewing and Correcting Your Information 

We try to keep information about you accurate and current. To change or update any personal information maintained by our program, you may write Maximus at the address below. In your correspondence, please indicate with as much detail as possible. Personal information maintained by any of our contracts administered on behalf of federal, state or local government entities should be corrected by contacting the customer service department in the individual program. Please refer to the section on “How to Contact Us.”

Information Disclaimer

Information provided on this Site is intended to allow the public immediate access to public information.  While all attempts are made to provide accurate, current, and reliable information, Maximus recognized the possibility of human and/or mechanical error.  Therefore, Maximus, its employees, officers, and agents make no representations as to the accuracy, completeness, currency, or suitability of the information provided by this Site and deny any expressed or implied warranty as to the same. 

Changes to this Privacy Statement

We will occasionally update this privacy statement. When we do, we will revise the "last updated" date at the top of the privacy statement. Please check the Site from time to time for the most current version of our privacy statement. Your continued use of the Site after we have notified you of changes as described above constitutes your acceptance of the changes.

How to Contact Us

If you have any questions or concerns about reviewing and correcting your Information, please contact us by:

Toll-free phone number: 1-844-374-9159 (TTY: 1-800-817-6608)

Attn: Aubrey Lucy, Project Manager
P.O. Box 2029
Richmond, VA 23219

If you have any questions or concerns about our privacy statement, please contact us by:


Maximus Privacy Official Office
1891 Metro Center Drive
Reston, VA 20190 USA