Last week (while I was on vacay), the Equal Employment Opportunity Commission issued proposed regulations on wellness programs and the Americans with Disabilities Act and the Genetic Information Nondiscrimination Act.

This has been a longstanding area of controversy and question, and I have written about it many times. Many wellness programs ask participants for medical information about themselves, which could violate the ADA. Sometimes the programs ask employees' family members for their medical information, which -- under the GINA -- equates to "genetic information" about the employee.

Under the ADA and GINA (with additional hoops), it is generally lawful to request employee medical or genetic information in connection with a "voluntary wellness program." 

So the question arose, if employees get money or other benefits for participating in a wellness program -- or if employees have to pay higher health insurance premiums or are otherwise penalized for not participating -- is the program really "voluntary"? If not, it could violate the ADA or GINA for the program to conduct health assessments or take other measures to get medical information from an employee or the employee's family member.

During the Obama Administration, the EEOC issued regulations that tried to strike a balance between the ADA and GINA restrictions on an employer's right to get employee medical and family health information, on the one hand, and the general goals of wellness programs and provisions regarding incentives in the Affordable Care Act and the Health Insurance Portability and Accountability Act, on the other.

But a federal court ruled that portions of the regulations were invalid, so the EEOC withdrew them, and then the EEOC lost its quorum so it couldn't do anything for a pretty long while, and then finally in early 2020 the EEOC got its quorum back, and they've probably been working on these proposed regulations ever since.

Here is a summary of what they say, in "Q and A" format:

Are there any wellness programs that are not covered by the regulations?

Yes! If a wellness program doesn't make any medical inquiries or conduct medical assessments (for example, a program that is purely educational), then you can stop reading this blog post because these regs do not apply to you. You're good.

Alas, I'm still here. Our wellness program does make medical inquiries and conduct medical assessments. How do we know whether it is considered "voluntary"?

Under the proposed regulations, a wellness program is "voluntary" if (1) employees are not required to participate, (2) employees are not denied health insurance coverage or get only limited coverage if they refuse to participate, (3) the employer doesn't take adverse action against an employee for refusing to participate, and (4) any incentives offered for participation are "de minimis," which means trivial and of little value. (The EEOC gives the examples of a water bottle or a "gift card of modest value.")

Wellness programs that are part of a group health insurance plan can offer more generous incentives, as will be discussed below.

How should information obtained from the employee be treated?

Confidentially, natch! The information must be kept on separate forms and in the employee's confidential medical file. As with other employee medical information under the ADA, there are exceptions for supervisors and managers who may need to know about an employee's medical restrictions, for first aid personnel, and for government officials investigating ADA compliance.

Apart from these exceptions, any medical information obtained by the wellness program should be disclosed to the employer only in aggregated, "de-identified" form.

It is unlawful for a wellness program to require an employee to "agree to the sale, exchange, sharing, transfer, or other disclosure of medical information" with very limited exceptions.

Our wellness program is part of our group health plan, and you said those programs can offer more incentives. Tell me more!

There is a "safe harbor" under the ADA for health-contingent wellness programs that are part of the employer's group health plans. These programs are allowed to offer participation incentives of more than "de minimis" value. Instead, their incentives can match (but not exceed) the levels in the HIPAA/ACA regulations issued in 2013.

To qualify for the safe harbor, the program must meet all the HIPAA/ACA requirements and be (1) "offered only to employees who are enrolled in an employer-sponsored group health plan," (2) "ties any incentive offered to cost-sharing or premium reductions (or increases)" under the plan, (3) "offered by a vendor that has contracted with the group health plan or insurer," and (4) "a term of coverage under the terms of a group health plan."

According to interpretive guidance issued along with the proposed ADA regulations, to qualify for the "safe harbor," the wellness program must actually use the medical information gathered "and require[] employees to satisfy a standard related to [a] health factor, such as achieving a certain blood pressure or cholesterol level, to receive an award or avoid a penalty." If the program merely gathers information and doesn't use it, then it will not qualify for the safe harbor.

What are the HIPAA/ACA limits on wellness incentives?

Under regulations issued in 2013, if only the employee is allowed to participate in the wellness program, the maximum incentive is "30 percent of the total cost of self-only coverage (50 percent if the program is designed to prevent or reduce tobacco use)." This is the case even if the employee's family members are covered under the employee's group health insurance, if the family members are not eligible to participate in the wellness program.

And, tell me again -- what's a "health-contingent" wellness program?

It's a wellness program "that requires an individual to satisfy a standard related to a health factor to obtain a reward." It can also require an individual to do more to obtain a reward than a "similarly situated individual," based on a health factor. It can be an "activity-only" program (for example, walk one mile a day to get a reward) or an "outcome-based" program (for example, lose 20 pounds to get a reward).

What does GINA have to do with wellness programs?

GINA generally prohibits employers from getting or using employees' "genetic information." The trap is that the law's definition of "genetic information" includes an employee's family members' medical information. And the family members don't even have to be related by blood to the employee. For example, under the law, a spouse is considered a "family member," as are adopted children.

In the context of wellness programs, GINA creates a problem because an employee may have family members on his or her group health insurance. If the family member participates in a wellness program that gathers medical information, then the family member's participation could result in an unlawful disclosure of the employee's "genetic information."

(Hey, I didn't write this law. I'm just telling you what it says.)

Fortunately, GINA does provide that "genetic information" may be gathered in connection with a voluntary wellness program if the employee provides "prior, knowing, voluntary, and written authorization," the information obtained is kept confidential, and only aggregated, "de-identified" information is provided to the employer.

Under the proposed regulations, a wellness program would be able to provide a "de minimis" incentive, such as a water bottle or "gift card of modest value" to an employee whose family member provides information about "the manifestation of a disease or disorder."

Are there any requirements related to the GINA authorization?

Yes. It must be written in plain language, it must describe the "genetic information that will be obtained and the general purposes for which it will be used," and it must describe "the restrictions on the disclosure of genetic information."

Do the GINA proposed regulations have a safe harbor provision, allowing employers to offer the 30 percent/50 percent incentive?

No, and that is because the law has no "safe harbor" provision like the one in the ADA. Because GINA has no "safe harbor" provision, any incentives for family members who provide information must be "de minimis."

Under the proposed regulations, can a wellness programs offer incentives to employees and family members who complete health risk assessments that have a mix of genetic and non-genetic questions?

Yes, but they have to offer the full incentive even if the employee or family member declines to answer the questions eliciting genetic information. The assessment should clearly designate the (non-genetic) questions that must be answered to receive the incentive and the (genetic) questions that the individual can decline to answer while remaining eligible for the full incentive.

Would a wellness program be able to offer incentives to an employee who discloses family medical history of a medical condition so that he or she can start taking preventive steps? For example, a history of diabetes or heart disease?

Yes, as long as other employees who have similar risks but because of their current medical conditions or "unhealthy lifestyles" (in other words, where GINA is not implicated) are allowed to participate on the same basis.

Is it legal to discriminate or retaliate against an employee based on any of this?

Do you really have to ask? Of course not!

Has the EEOC asked for comment on any specific topics?

Yes, with respect to the GINA proposed regulations, the EEOC has asked for comments regarding (1) whether employers are currently offering the "HIPAA-level" incentives in exchange for medical information about family members, (2) any research studies related to what employers are doing in this area, (3) the expected impact of imposing a "de minimis" rule on employers who have been offering the HIPAA incentives, and (4) whether the EEOC should include other examples of "de minimis" incentives besides . . . you got it! water bottles and gift cards of modest value.

Of course, other comments are welcome, too. The EEOC will accept comments for 60 days after the proposed regulations are published in the Federal Register, which has not happened yet.