Many employers who offer wellness programs to their employees may not have considered compliance with HIPAA privacy, security and breach notification rules (collectively, “HIPAA Rules”), since they don’t think of their wellness programs as a group health plan. Part 1 of this post covered why most employee assistance programs (“EAPs”) are subject to the HIPAA Rules. This part discusses wellness programs. As with EAPs, wellness programs must comply with the HIPAA Rules to the extent that they are “group health plans” that provide medical care.

A wellness program may be considered a group health plan in at least two common ways. First, if an employer offers a wellness program as part of another group health plan (e.g., a major medical plan), any individually identifiable health information collected from participants in the wellness program is protected health information (“PHI”) under the HIPAA Rules. In other words, if the wellness program is part of another group health plan, such as a major medical plan—for example, by offering incentives like premium reductions or lower cost-sharing amounts for major medical coverage based on participation in the wellness program—the wellness program will be subject to the HIPAA Rules.

Second, a wellness program will be a group health plan subject to the HIPAA Rules if it provides medical care to employees. Some benefits commonly provided by wellness programs are not medical benefits—a health risk assessment (“HRA”), for example, is typically a questionnaire intended to identify an employee’s possible health risks and to motivate the employee to make positive behavior changes to reduce those risks. HRAs are not medical care if they are not administered by medical professionals and are not intended to diagnose illness or prescribe treatment. Other non-medical benefits offered by wellness programs include exercise, nutrition, or weight loss programs, as long as they are not connected with or recommended in response to a medical practitioner’s diagnosis. A wellness program may also provide general health-related information, or referrals (if made by people without any special medical training), without providing medical care (and without triggering compliance obligations under the HIPAA Rules).

Other common wellness program benefits, however, may provide medical care. A biometric screening (often conducted in conjunction with an HRA) is typically medical care because it often involves a blood draw, labs and a clinical assessment of an employee’s health and is intended to diagnose, or indicate an increased risk of, certain health conditions (heart disease, diabetes, etc.). Wellness programs also often include disease management and smoking cessation services, which are considered medical care because they are designed to assist with specific health conditions. Even something as simple as an employee flu shot is medical care, whether or not it is part of another group health plan. Individualized health coaching by trained nurses or counseling provided by trained counselors also would be considered medical care. Providing any of this medical care through a wellness program may lead to unexpected compliance obligations under the HIPAA Rules.

Employers/plan administrators facing unexpected compliance obligations under the HIPAA Rules because of a self-insured wellness program that provides medical care will need to enter into a the HIPAA Rules business associate agreement with the wellness program vendor, amend the plan document for the wellness program to include language required by the HIPAA Rules and develop and implement other compliance documents and policies and procedures under the HIPAA Rules. One option is to amend any existing compliance documents and policies and procedures in place under the HIPAA Rules for another self-insured group health plan (such as a major medical plan) to make them apply to the wellness program as well. If the wellness program is the plan administrator’s only group health plan for which it has compliance responsibility under the HIPAA Rules, the plan administrator should consult with legal counsel to develop and implement all necessary documentation for compliance under the HIPAA Rules.

[View source.]