Workplace Wellness Programs: Health Care and Privacy Compliance

In the wake of rising health care costs, employers are increasingly seeking ways to encourage employee wellness and thus reduce health risks. It has become common for companies to offer wellness programs aimed at promoting a healthier, more productive workplace. 

According to SHRM’s 2024 Employee Benefits Survey, 88% of employers rated health-related benefits as very important. However, there is a complex web of laws related to discrimination and privacy that employers need to be aware of before creating and implementing wellness programs. 

Types of Wellness Programs

The post-pandemic period has seen new trends in the wellness space. 

“I think when these programs first started, it was the employer trying to maybe change some behaviors” to get a healthier workforce, said Christy Tinnes, an attorney at Groom Law Group in Washington, D.C. But these days, people are now “more aware of the holistic person and health” and “employees do respond well and want to push for it.”

Some of these programs offer incentives for participation, such as gift cards, or a premium credit, such as through smoking-cessation programs. Others promote activities employees can do to get points, and those points accumulate to earn a reward. 

The increased interest in wellness programs has resulted in a wide variety of offerings. Along with the traditional tobacco-cessation incentive programs, there are now programs featuring nutrition logging and self-care regimes. “That might not even be considered medical care,” Tinnes said, but rather, care that “looks at the whole person.” 

Tinnes noted that because certain programs would not qualify as actual medical care, they therefore fall outside some regulations. However, “they might be part of a wellness program that has some of those medical care components, too,” she added. “I’m seeing a mix of those types of nonregulated programs that are more self-care and the ones that are related to the health plan.” 

But employers who offer wellness programs intended to boost general fitness rather than provide medical treatment are walking a tightrope. 

“One issue is that an employer might set something up” with the goal of staying out of the medical space in order to not fall under the purview of wellness regulations or other limitations, Tinnes said. However well-intentioned the program, employers “may not realize that some programs that they have could cross the line and trigger” medical privacy and anti-discrimination laws and regulations, she said. 

Coordinating Compliance

When offering a wellness program, employers need to be aware of the relevant legislation that may govern it. 

The first of these laws is the Employee Retirement Income Security Act (ERISA), which applies when an employer is offering a program that provides medical care. Under ERISA, the definition of medical care is very broad, which may cause concern for employers who wonder whether their program crosses the line into medical care. 

“There’s some guidance from the Department of Labor saying, in a different context, if you have a program that has trained health care professionals and it’s individualized in nature, like maybe a health coach who has medical training,” then this might be sufficient to trigger ERISA, Tinnes said. The employer’s intention is immaterial; if the program is designed to provide medical care, the employer must follow ERISA regulations. 

Assuming an employer’s program offers medical care and is therefore governed by ERISA rules, the employer must follow the Health Insurance Portability and Accountability Act (HIPAA) regulations. HIPAA, which amended ERISA, comes into play if an employer offers an incentive based on a health status. Smoking-cessation programs are a good example. 

“Nicotine addiction is a health status, and that would trigger the HIPAA wellness rules,” Tinnes said.  

The Americans with Disabilities Act (ADA) applies if the program asks employees disability-related questions or involves a medical examination. If an employer’s program is covered by the ADA, it must comply with the law’s standards. Regarding wellness programs, the ADA imposes confidentiality requirements, limitations on the information an employer can collect, and access to reasonable accommodations. 

The specific information being requested will also determine what regulations apply to the wellness program. Simply being a bit overweight is not a disability, so that won’t trigger the ADA. Severe obesity, however, is considered a disability. 

If an employer “were asking several questions — your weight and your height — and maybe some other issues about your condition, then maybe [they] do have enough information” to infer information about a disability, Tinnes said. In this case, the program is subject to ADA rules. 

Employers must also be careful to respect employees’ privacy when offering wellness programs. It is important to have “practical guardrails” to keep employers from having access to private medical data, Tinnes said. She used the example of a “Biggest Loser” type of program for weight loss. It would be necessary to keep it within a small group, one that knew it needed to keep the information confidential and outside of staff records and be clear with everybody that only the people administering the program were going to see the data. Not only does this practice ensure compliance, but it could make employees feel more comfortable and inclined to participate. 

It is essential for employers to analyze all the components of their wellness programs to see if any of the above legislation applies. If an employer unintentionally discriminates against an employee or violates their privacy, the employee can file a complaint with the U.S. Equal Employment Opportunity Commission, which enforces the ADA. The agency will investigate and issue penalties or give a right-to-sue letter to the employee. HIPAA and ERISA violations can likewise lead to penalties and litigation. 

Current Litigation

The last year has seen a spate of lawsuits concerning employer wellness programs, which may cause concern among employers keen to offer similar benefits. 

“We’ve started to see lawsuits filed regarding tobacco premium surcharges,” said Kara Wheatley, an attorney at Groom Law Group in Washington, D.C. More than 30 employers have been sued in the past year for alleged violations of tobacco-cessation programs, and Wheatley cautioned that employers may see liability on a class-action basis.  

The lawsuits allege that the defendants — the employers — violated HIPAA’s nondiscrimination provision and wellness program rules by requiring employees to stop smoking to get the reward. The plaintiffs argued they were not treated the same as people who were not using tobacco products. “If you have nicotine addiction, that’s an adverse health status,” Tinnes said. 

Employers have to end up giving employees the same reward; they can’t require employees to stop smoking as an outcome without running afoul of anti-discrimination laws, she added. 

According to Wheatley, most of the defendants have filed motions to dismiss the complaints, but “it’s still an open question about whether these cases will proceed.” She said she believes that these could function as test cases for further legislation targeting wellness programs. 

Rachel Zheliabovskii is a specialist, B2C content, at SHRM.