For large employers, the quest to reduce the cost of medical benefits relies in part on helping employees get healthier. Enter the “wellness program,” where employers offer incentives to employees and their families to be more proactive about their health in various ways, such as more exercise, quitting smoking, diagnosing high cholesterol and high blood pressure, and evaluating the risk of future health problems.

Although wellness programs are well-intentioned, they raise issues under various federal laws, including:

• The Health Insurance Portability and Accountability Act (HIPAA), which prohibits discrimination in group health plans on the basis of adverse health factors, such as high cholesterol, high blood pressure, medical history, and genetic information;

• The Americans with Disabilities Act (ADA), which requires reasonable accommodations for disabled individuals to have equal access to benefits and prohibits employers from making disability-related inquiries to employees or requiring employees to take medical examinations—but allowsvoluntary medical examinations and collection of medical histories as part of an employee health program; and

• The Genetic Information Nondiscrimination Act (GINA), which prohibits requesting genetic information from employees and their spouses, except as part of a voluntary program that is designed to promote health or prevent disease.

The requirements to comply with HIPAA’s prohibition against discrimination rules have been pretty clear since 2006; and the Affordable Care Act further liberalized the requirements, to encourage innovative programs that inspire healthy habits and proactive disease prevention. But as the Departments of Treasury, Labor, and Health and Human Services (HHS) published prescriptive regulations and other guidance, the Equal Employment Opportunity Commission (EEOC) continued to warn employers that programs designed to comply with HIPAA and the ACA might still violate the ADA and/or GINA. The EEOC’s principal concern has been that if incentives to participate in a medical examination or provide medical history are too substantial, the program effectively will not be voluntary—which would violate the ADA and/or GINA.

Initially, the EEOC expressed its views through informal statements and guidance in its enforcement manual. In 2014, however, the EEOC brought lawsuits challenging three employers’ wellness programs. The suits signaled to employers that merely complying with the Treasury, Labor, and HHS guidance under HIPAA and the ACA might not be enough: there was a risk that any incentive to participate in a medical examination or provide medical history might make the program involuntary, in violation of the ADA and/or GINA.

On May 16, 2016, the EEOC issued final rules on the Regulations Under the Americans With Disabilities Act and Genetic Information Nondiscrimination Act as well as Q&As on Employer Wellness Programs and Title I of the Americans with Disabilities Act and the Genetic Information Nondiscrimination Act that appear to put the “voluntariness” uncertainty to rest. With a few exceptions, the final rules generally mirror proposed rules issued by the EEOC last year. Together with the regulations and other guidance issued by Treasury, Labor, and HHS, the final regulations appear to provide a clear roadmap for designing wellness programs that comply with federal law. Here are five highlights from the EEOC’s final regulations:

1. Wellness programs must be reasonably designed to promote health or prevent disease. This means that a wellness program may not impose an “overly burdensome” time commitment; involve unreasonably intrusive procedures; be a subterfuge for unlawful discrimination under the ADA, GINA, or other anti-bias laws; or require employees to incur significant costs for medical exams. And the information collected must be used to address at least a subset of conditions identified. Unlike the HIPAA rules, the ADA’s “reasonably designed” standard applies not only to health-contingent and outcome-based programs, but also to participatory programs.

2. Participation in wellness programs must be “voluntary.” This means that incentives may not exceed a specified threshold (the 30% rule described in #3, below); health benefits may not be conditioned on participating in the wellness program; and an employer may not retaliate against anyone who does not participate in the wellness program.

Also, the sponsoring employer must provide a written notice to employees explaining what medical information will be obtained, how it will be used, who will receive it, and restrictions on disclosure. This notice may be included in other materials describing the wellness program. The EEOC says it will issue sample language in June.

3. Incentives for participation may not exceed 30% of the cost of self-only coverage. Under the final regulations, the total incentives—discounts on health care premiums, cash rewards, in-kind prizes like Fitbits, gift cards, and gym memberships, and anything else combined—for an employee to participate in a wellness program—may not exceed 30% of the cost of self-only coverage (the employer’s share plus the employee’s share). This limit is lower than the maximum amount permitted under the HIPAA rules.

A wellness program may also offer an additional incentive of up to 30% of the total cost of self-only coverage for a spouse to provide information about his or her current or past health status (subject to not exceeding a limit under the HIPAA rules). But a wellness program may not provide an incentive to provide health information about an employee’s child.

Special Rule for Tobacco Use. The 30% limit described above may be increased to 50% of the cost of self-only coverage to answer questions about tobacco use. However, a wellness program may not provide any additional incentive (above the 30% limit described above) to submit to medical tests—e.g., a procedure that tests for the presence of nicotine or tobacco.

Which plan is relevant? In general, the coverage used to determine the maximum incentive should be the lowest cost coverage that the employer offers; but if the wellness program is offered only to employees enrolled in a particular plan, the employer should use the coverage in which the employee is actually enrolled. If the employer does not offer a health plan, the maximum incentive should be based on the cost to a 40-year old non-smoker for self-only coverage under the second lowest-cost Silver Plan available on public exchange for the employer’s home state.

4. Confidentiality is paramount. Employers and wellness program providers must protect the confidentiality of employee medical information and must not use employee medical information for any purpose that would violate the ADA. The new regulations expand on these principles with two new requirements:

(i)   Information collected through a wellness program may be presented to an employer only in aggregate form—in a way that is not reasonably likely to identify specific individuals, unless necessary to administer the program; and

(ii)  An employer generally may not require an employee to agree to any transfer or disclosure of medical information or to waive confidentiality protections under the ADA.

The EEOC has also issued some optional “best practices” for ensuring confidentiality. These practices include training, use of encryption, and the creation of “firewalls” to prevent transmission of medical information to anyone responsible for making decisions related to employment.

5. Inside the plan, outside the plan. . . it doesn’t matter. Until now, there was some debate over whether the rules are different for wellness programs offered under a plan than for programs outside of the plan. For purposes of ADA and GINA, that distinction no longer matters. The rules described above apply either way.

Effective Date

The new notice requirement and incentive rules apply for plan years starting on and after January 1, 2017. The EEOC states that all other provisions, such as the confidentiality requirements, are clarifications of existing obligations; so those provisions are effective immediately.

Perspective

After years of uncertainty, the final regulations provide welcome clarity on the requirements for wellness programs—at least under federal law. Employers should review their programs and make adjustments as necessary to comply with the new regulations. In particular, employers will need to assess the value of prizes that they offer for participating in wellness programs, to make sure they stay below the 30% cap. Also, now that the rules are more clear, employers might wish to revisit incentives in the form of premium subsidies.