Workplace wellness programs and HIPAA: when the rules apply.
Whether HIPAA covers a wellness program depends on how it is offered. Run through the group health plan, the information collected is protected health information. Run by the employer on its own, it is not. The difference changes who can see the data.
Two ways a program can be set up.
Offered Through The Plan
HHS says information collected from or created about participants in a wellness program offered as part of a group health plan is protected health information. In that case the privacy rules for health information are likely to apply, so employers should ask the carrier, the vendor and counsel how the program is structured and what the vendor may share with the employer.
Offered By The Employer Alone
If the employer runs the program directly, apart from the plan, the health information it collects is not protected by the HIPAA Rules. Other laws may still apply. The privacy treatment can differ from a plan-connected program, and other laws may apply instead, so employers should ask counsel to review the arrangement and the communications to employees.
Incentives Tied To Plan Benefits
Premium reductions or cost-sharing rewards in exchange for participation are a common sign the program is part of the plan. Because rewards that touch plan benefits bring additional rules into play, employers should write down how the reward works and ask counsel or the carrier to review it before launch.
Nondiscrimination Rules Also Apply
Programs connected to a group health plan must also meet HIPAA and Affordable Care Act nondiscrimination rules, including that they be available to all similarly situated individuals. Employers should check the program’s reward design, notices and any alternative ways to earn a reward, and ask counsel to confirm the arrangement fits all of the rules before employees are invited to enroll.
Keeping wellness data where it belongs.
Decide Which Type You Have
Confirm in writing whether the program is part of the plan, and tell your vendor. A one-page summary of the program, the vendor, who receives which data and how rewards work gives counsel and the carrier a clear base for review, and helps new HR staff understand the setup.
Limit Employer Access
Where the employer administers parts of the plan, HHS says access to protected health information without authorization generally requires amended plan documents and a certification from the sponsor. Put the access rules in writing, limit who sees information, and check that reports to the employer are limited to what is needed. Counsel can help confirm what applies to your plan.
Share Only Summary Information Otherwise
Without plan administration functions, the plan generally may disclose to the sponsor only who is enrolled and summary health information for plan changes or premium bids. Ask the vendor to provide summary reports that do not identify individuals, confirm this in the contract, and keep the reports in a limited-access file. Counsel can confirm the approach for your plan.
Check The Incentive Design
Participatory programs, such as reimbursing a gym membership, are allowed if available to all similarly situated individuals. Health-contingent programs have additional requirements. If a reward depends on a health result rather than participation, additional rules apply, so have counsel and the carrier review the design, the notice and the alternative standard before launch.
Three questions for your vendor.
What Does The Vendor Send Us
Ask whether reports to the employer are aggregate or identify individuals. Ask for sample reports before launch, confirm in writing what the employer will receive, and make sure managers are not given any employee-level health details. Counsel can review the data flow.
Is There A Business Associate Agreement
A wellness vendor working for the plan is typically a business associate. Ask counsel or the carrier whether an agreement is needed, who signs it and what it covers, and keep a copy in the compliance file along with the vendor’s security information.
Does A Reward Depend On A Health Result
If it does, additional nondiscrimination requirements may apply, including a reasonable alternative standard. Describe the reward, the health measure and the alternative in plain language, and ask counsel to review the notice and the design before employees are asked to take part.
Participatory Versus Health Contingent Wellness Programs
Participatory Programs
No reward depends on meeting a health standard. Examples include gym reimbursement and rewards for completing a health risk assessment, open to all similarly situated individuals.
Activity Only Programs
A reward requires completing an activity such as walking or an exercise program, without requiring a specific health outcome.
Outcome Based Programs
A reward requires attaining or maintaining a health outcome, such as a target blood pressure or not using tobacco, and an alternative must be offered to those who miss the standard.
Five Requirements
Health contingent programs must give an annual opportunity to qualify, limit the reward size, be reasonably designed, offer reasonable alternatives, and provide notice of those alternatives.
Reward Limits
The general limit is 30 percent of the total cost of coverage, rising to 50 percent for programs designed to prevent or reduce tobacco use.
Reasonable Alternatives
Anyone for whom meeting the standard is unreasonably difficult or medically inadvisable must be given a reasonable alternative or waiver.
Source: 29 CFR 2590.702.
Common Questions About Wellness Programs And HIPAA
Does HIPAA apply to every wellness program?
No. HHS says it applies when the program is offered as part of a group health plan, and not when an employer offers a program directly.
Can we see which employees participated?
It depends on the setup and the plan documents. Without the required plan language or an authorization, the plan’s disclosure to the sponsor is limited.
What if a wellness vendor has a breach?
If the plan learns of a breach of unsecured protected health information, it must follow the Breach Notification Rule, including notice to affected individuals and HHS.
What is the difference between participatory and health-contingent?
Participatory programs reward participation. Health-contingent programs reward meeting a health-related standard and carry extra requirements.
Is a very small plan covered?
HHS notes that a self-administered plan with fewer than 50 participants is not a group health plan under the HIPAA definition. Confirm your facts with counsel.
Is this legal advice?
No. For your own program, involve your counsel. We can help you sort out how it is structured.
Related guides.
Wellness Incentives and Tobacco Surcharges
Reward limits and the alternatives a plan must offer.
ADA and GINA Rules for Employer Wellness Programs
Voluntary participation, notice and the vacated incentive limits.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. Part 164, Subpart E — HIPAA Privacy Rule.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.