News & Resources

Publications & Media

“Healthy reminder: HIPAA rules apply to most workplace wellness programs”

Safe and Sound By John L. Barlament

Wellness programs are great ways for employers to provide guidance on ways employees can improve their health through fitness, diet and various other means. But oftentimes, employers forget that wellness programs may be an extension of a company’s heath care plan. As such, the Health Insurance Portability and Accountability Act (HIPAA) rules apply equally to these wellness programs as they do health care plans.

The U.S. Department of Health and Human Services (HHS) recently released a list ofquestions and answers to remind employers of their HIPAA obligations with regard to wellness programs.

In the release, titled “HIPAA Privacy and Security and Workplace Wellness Programs,” HHS clarifies which wellness programs are subject to HIPAA rules. That is, any workplace wellness program a company offers as part of a group health plan for employees. “Where a workplace wellness program is offered as part of a group health plan, the individually identifiable health information collected from or created about participants in the wellness program is [protected health information (PHI)] and protected by the HIPAA Rules,” HHS says.

The department also said that workplace wellness programs which do not provide any health benefits and are not connected to the health plan are not subject to HIPAA. However, it warns that “other Federal or state laws may apply and regulate the collection and/or use of the information” collected through that program.

The Q&A also addresses the HIPAA protections that are in place when a workplace wellness program is offered through the group health plan for plan sponsor employees regarding their access to individually identifiable health information about participants in that program. HHS clarifies when an employer should have access to PHI and what it may and may not do with that information.

Because this is the time of year that employers are beginning to develop their wellness programs for the following year, the Q&As serve as an excellent reminder that HIPAA rules apply for most wellness programs. As companies begin their new programs, it’s essential they keep this in mind.