HIPAA covers a wellness program only when it is offered as part of a group health plan, or run by a covered entity or its business associate. A program an employer runs directly, outside the plan, generally falls outside the HIPAA Rules. The ADA, GINA and ERISA/ACA rules may still apply, as the EEOC explains. Activity-only options, like ours at Charity Miles, focus on logged movement rather than health outcomes.
TL;DR:
- Classify each component separately: plan funded screenings and vendor assessments may involve HIPAA, while employer run activity challenges outside benefits generally do not.
- When a program collects medical information, give employees a notice explaining collection, use, access, and safeguards; participation must remain voluntary without penalties for opting out.
- Plans with health targets must offer and disclose a reasonable alternative; rewards cap at 30%, or 50% for tobacco cessation in some cases.
- Before PHI moves, confirm whether a vendor acts as a business associate and execute a BAA covering safeguards, breach reporting, subcontractors, and data destruction.
- Keep medical information separate from personnel files, restrict access, and use documented safeguards; plan sponsors need firewalls and certifications before using PHI for administration.
Table of Contents
- When does HIPAA apply to your wellness program?
- What counts as PHI, and who can see it?
- Which other federal rules shape your program?
- A practical HR checklist for a HIPAA-aware program
- How do business associate agreements fit in?
- Where do enforcement problems start?
- An author’s view on engagement and compliance
- How we support privacy-conscious activity challenges
- FAQ
- Sources
When does HIPAA apply to your wellness program?
The legal test turns on who offers the program. A group health plan is a covered entity under HIPAA, and the employer sponsoring that plan is a separate legal player. In its role as employer, it is not a covered entity. HHS says the employer becomes a plan sponsor with tightly limited access to health data when the program is offered through the plan, and the HHS workplace wellness guidance lays out that distinction.
Here is how common setups tend to sort out:
- HIPAA likely applies: a biometric screening paid for and run through your group health plan.
- HIPAA likely applies: a wellness vendor your plan hires running health risk assessments and report results to the plan.
- HIPAA generally does not apply: a step challenge you run yourself, with no link to plan benefits.
- HIPAA generally does not apply: a gym discount or lunch-and-learn the employer offers directly, outside the plan.
To classify your own program, ask questions such as: Who pays for it? Who administers it? Do rewards change plan premiums or cost sharing? Whether a program is part of a group health plan depends on its specific arrangement, including who offers and administers it.
Pro Tip: Map every program component separately. A single wellness portal can mix plan-run screenings with employer-run challenges, and each piece may fall under different rules.
What counts as PHI, and who can see it?
Protected health information, or PHI, is health data that a covered entity or its business associate creates or holds. In wellness programs, that usually means:
- Health risk assessment answers
- Biometric screening results such as blood pressure, cholesterol or glucose
- Blood tests and other diagnostic outputs
- Claims or participation records tied to a plan benefit
Whether those items are PHI depends on where they sit. The same cholesterol number is PHI when the group health plan holds it, but it is an employment record, covered by other laws, when the employer collects it outside the plan.
Plan sponsors must use safeguards, including firewalls and certifications, to prevent PHI misuse. See HHS workplace guidance. The information a plan sponsor may receive depends on the applicable safeguards and plan arrangements.
Plan sponsors are not covered entities in their employer capacity; HHS says they must implement strict firewalls and certifications before PHI can be used for administration.
In practice, that means your HR team should not see individual screening results unless your plan documents say so and the safeguards are in place.
Which other federal rules shape your program?
HIPAA is one layer. Other rules may also apply, including rules covering employer-run programs.
ADA. Programs that ask for medical information must be voluntary. You cannot penalize anyone for opting out, and you must give a notice explaining what is collected, how it is used, who sees it and how it is protected. The EEOC sample notice is a ready starting point.
GINA. Genetic information is tightly restricted, including family medical history and, in some cases, information about spouses and children. The EEOC’s small business fact sheet covers inducements involving spouse information.
ERISA/ACA. Plan-based programs fall into two types: participatory and health-contingent. DOL guidance, including its chart of required notices, points to these requirements:
- Offer a reasonable alternative standard to anyone who cannot meet a health target.
- Cap total rewards at 30% of the cost of employee-only coverage, or 50% for tobacco cessation programs in some cases.
- Disclose the alternative standard in your plan materials.
- Reconsider outcome-based goals, since they carry the most requirements of any program type.
An activity-only challenge, where people simply log movement, sits at the low-risk end of this spectrum. An outcome-based program that rewards a target cholesterol number sits at the high-risk end and needs the full set of safeguards. DOL’s self-compliance tool walks through the design tests.
Pro Tip: Put the reasonable alternative in writing in every plan document and enrollment communication, not just in the program FAQ.
A practical HR checklist for a HIPAA-aware program
Work through these steps before launch, then revisit them each year:
- Classify the program: inside the group health plan, or employer-run?
- Inventory every data point you collect and where it is stored.
- Keep medical information in separate files from personnel records.
- Update plan documents and summary plan descriptions with wellness language and reasonable alternatives.
- Adopt a version of the EEOC sample notice.
- Limit incentives to the permitted caps.
- Train anyone who touches program data, and document the training.
- Prepare a breach response plan with legal and IT.
On the technical side, ask IT for encryption, role-based access, audit logs and firewalls between plan administration systems and general HR systems. Our own wellness data privacy guide goes deeper on those controls.
| Step | Owner | When |
|---|---|---|
| Classify program and map data | HR, legal | Before launch |
| Segregate records, set access controls | IT, HR | Before launch |
| Update plan documents and notices | Benefits, legal | Before launch |
| Review incentives and alternatives | Benefits | Annually |
How do business associate agreements fit in?
A vendor may be a business associate when it handles PHI on behalf of a covered entity, depending on the arrangement. You need a business associate agreement, or BAA, in place before any PHI moves, as HHS guidance describes.
A solid BAA covers:
- Permitted uses and disclosures of PHI
- Required technical and administrative safeguards
- Breach reporting timelines
- Obligations that flow down to subcontractors
- Return or destruction of PHI when the contract ends
Before signing, confirm the vendor will sign a BAA, ask how it encrypts and restricts access, and request evidence of its compliance program. Vendors that hesitate on a BAA are telling you something.
Pro Tip: Ask each vendor which of your program components it believes make it a business associate. Their answer shows whether they understand their own obligations.
Where do enforcement problems start?
HHS’s Office for Civil Rights addresses HIPAA, the EEOC addresses ADA and GINA, and DOL’s EBSA addresses ERISA and ACA rules. Their published FAQs show how those laws interact.
Common triggers include:
- Incentives so large that participation is not truly voluntary
- Health data stored alongside personnel files
- Missing or weak BAAs with vendors
- Missing notices to employees
- Wearables or screenings that quietly collect medical data nobody reviewed, a risk that disability rights experts point to
Potential consequences depend on the law involved and the circumstances. If a concern is flagged, pause data collection, separate any misplaced records, tell legal, and document each step you take.
An author’s view on engagement and compliance
I have seen programs stall not because the incentive was too small but because people did not trust where their data would end up. Employees join when they believe their health information stays private. Inclusive, activity-only challenges, where a lunchtime walk counts as much as a marathon, reach more people and put far less PHI at risk. Bring legal, benefits, IT and HR to the table before launch, not after.
— Gene
How we support privacy-conscious activity challenges
Our Employee Empowerment Program lets you create private teams, run friendly challenges and set your own sponsorship rate and cap, all based on logged movement rather than health outcomes. The program can support wellness and CSR goals. See how it works on our Employee Empowerment program page.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
Does HIPAA apply to every employer wellness program?
No. HIPAA applies only when the program is part of a group health plan or run by a covered entity or its business associate. Programs offered directly by an employer, outside the plan, generally fall outside HIPAA.
Do employers have to give employees a wellness notice?
When a program collects health information, the ADA requires a notice explaining what is collected, how it is used and how it is protected. The EEOC sample notice can be adapted for your program.
Can employees be penalized for skipping a wellness program?
Programs that collect medical information must be voluntary, and employees cannot be penalized for not taking part. The EEOC final rules set out that requirement.
How large can wellness incentives be?
For health-contingent programs, DOL guidance caps total rewards at 30% of the cost of employee-only coverage, and up to 50% for tobacco cessation in some cases. The DOL chart gives the details.
Sources
- Hhs
- EEOC Issues Final Rules on Employer Wellness Programs | U.S. Equal Employment Opportunity Commission
- Appendix B: Chart of Required Notices