Employer Wellness Programs: HIPAA, ADA, GINA, and ERISA Rules

Employer wellness programs are governed at the federal level by three overlapping statutes: HIPAA as amended by the Affordable Care Act, the Americans with Disabilities Act, and the Genetic Information Nondiscrimination Act. Additional rules from the IRS, ERISA, the FTC, and the Fair Labor Standards Act apply depending on how the program is structured. The headline compliance point is the incentive cap: rewards tied to a health-related standard generally cannot exceed 30 percent of the total cost of employee-only coverage, or 50 percent when tobacco cessation is involved. An employer running a wellness program has to satisfy every one of these regimes at the same time, and where they conflict, the more protective rule for the employee controls.

Participatory vs. Health-Contingent Programs

Almost every federal requirement turns on which of two categories a program falls into.

Participatory programs are open to all employees regardless of health status. Gym subsidies, nutrition seminars, and health education handouts qualify. No one has to hit a target or pass a screening to earn the reward, so these programs face minimal federal restrictions.

Health-contingent programs condition the full reward on satisfying a health-related standard. They come in two flavors. Activity-only programs ask employees to complete something, like walking a set number of steps or attending a cessation class. Outcome-based programs require achieving a measurable result, such as a target blood pressure reading or body mass index. Outcome-based programs draw the strictest scrutiny because they can effectively penalize employees for conditions they cannot fully control.

Both health-contingent types must be “reasonably designed” to promote health or prevent disease. A program that collects biometric data without offering follow-up resources or a path to improvement would likely fail that test.

HIPAA and the ACA: Five Requirements for Health-Contingent Programs

HIPAA, as amended by the ACA, supplies the most detailed rule set. Group health plans cannot discriminate against individuals based on health factors like claims experience, medical history, or genetic information. When a wellness program sits inside a group health plan, it must satisfy those nondiscrimination provisions and, if it is health-contingent, all five of the following requirements. Missing any one of them can convert the entire incentive into a nondiscrimination violation.¹

Employees must have a chance to qualify for the reward at least once per year.
The total reward across all health-contingent programs cannot exceed 30 percent of the cost of employee-only coverage, or 50 percent where tobacco cessation is involved. When dependents participate, the cap applies to the cost of the coverage tier the employee selected.
The program must be reasonably designed to promote health or prevent disease, not overly burdensome, and not a subterfuge for discrimination.
The full reward must be available to all similarly situated individuals, which means offering a reasonable alternative standard to anyone who cannot meet the initial standard for medical reasons.
All plan materials describing the program must disclose the availability of a reasonable alternative and how to request one.

How the Incentive Cap Is Calculated

The math trips employers up more than any other piece of the regulation. The 30 percent limit runs against the total cost of employee-only coverage, not the employee’s share. If the total annual premium is $9,000 and the employer pays $6,000 of it, the cap is $2,700, not 30 percent of the employee’s $3,000 contribution.¹

The 50 percent ceiling only applies to the tobacco cessation component. An employer running both a biometric screening program and a tobacco cessation program is still capped at 30 percent for the biometric portion, with the combined total not to exceed 50 percent.¹

The cap applies whether the incentive is a premium discount, a surcharge for non-participation, a contribution to a health savings account, or a cash reward. Labeling a penalty as a “tobacco surcharge” does not exempt it.

Reasonable Alternative Standards

The reasonable alternative standard is where compliance meets the employee with a medical condition. If a health factor prevents someone from meeting the program’s standard, the employer must open a different path to the same full reward. The rules vary by program type.¹

For activity-only programs, the alternative must be available to anyone for whom the standard is unreasonably difficult or medically inadvisable due to a medical condition. The plan can require a physician’s verification, as long as the request itself is reasonable.

Outcome-based programs are stricter. If an employee fails to hit the target on a biometric screening, a reasonable alternative must automatically be offered. The plan cannot demand physician verification. If the alternative is itself an outcome-based goal, it cannot simply require a slightly different level of the same measurement without giving additional time that accounts for the individual’s circumstances.

In both categories, if an employee’s personal physician says the program standard is not medically appropriate, the plan must accommodate that recommendation. For outcome-based programs, the employee must also be given the option to follow their own doctor’s recommendations as a second alternative, provided the doctor joins the request.¹

When the alternative involves an educational program or diet plan, the employer must either provide it directly or help the employee find one. The employee cannot be told to track down a program alone and cannot be charged for the cost. Time commitments must also be reasonable. Requiring nightly one-hour classes, for example, would not qualify.

The ADA: Voluntariness, Privacy, and an Unsettled Rule

The ADA allows employers to conduct voluntary medical examinations and collect voluntary medical histories as part of an employee health program. Voluntary is the operative word. Any disability-related inquiry or medical exam in a wellness program has to be genuinely the employee’s choice, and medical information collected must be kept in separate confidential files, apart from general personnel records. Supervisors may only be told about necessary work restrictions or accommodations, not the underlying medical details.²

Voluntariness also means an employer cannot deny health insurance or a specific plan option to someone who declines to participate, and cannot retaliate through demotions, schedule changes, or other adverse actions. Before any data collection, employees must receive a written notice explaining what medical information will be gathered, how it will be used, who will see it, and how it will be protected.

There is an open regulatory question worth flagging. In 2016, the EEOC issued rules specifying what incentive levels kept wellness programs “voluntary” under the ADA and GINA. A federal court vacated those rules effective January 1, 2019, finding the agency had not adequately justified its incentive thresholds. The EEOC proposed replacement rules in January 2021, but withdrew them before publication and has not reissued them as of 2026. The HIPAA/ACA caps of 30 and 50 percent still apply to programs within group health plans, but no current EEOC regulation defines the maximum incentive that keeps a standalone wellness program “voluntary” under the ADA or GINA. Programs operating outside a group health plan sit in an area of elevated legal risk.

GINA and Genetic Information

GINA prohibits employers from requesting, requiring, or purchasing genetic information, and bars them from using genetic data in employment decisions. Genetic information includes not just the employee’s own genetic test results but also family medical history and information about genetic testing by family members. The EEOC enforces GINA’s employment provisions, while the Departments of Labor, Health and Human Services, and Treasury enforce the insurance-side provisions.³

For wellness programs, the practical effect is that health risk assessments cannot ask about family medical history as a condition of receiving an incentive without hitting GINA’s limits, and any genetic data that a program does collect is subject to the same voluntariness and confidentiality rules that apply under the ADA.

Privacy of Health Data Collected Through the Program

When the wellness program operates through a group health plan, HIPAA’s Privacy Rule governs how individually identifiable health information moves between the plan and the employer.

Employers performing plan administration functions can access protected health information only after amending their plan documents to include specific safeguards: establishing adequate separation between employees who handle plan administration and everyone else, prohibiting the use of information for employment-related decisions, and implementing physical, technical, and administrative security measures to enforce that separation.⁴

Employers that do not perform plan administration have far less access. In those cases, the group health plan may generally share only enrollment information and summary health data requested for purposes of modifying the plan or obtaining premium bids. Summary data strips out direct identifiers, so a report might show 40 percent of participants have elevated cholesterol without identifying anyone.⁴

When wellness programs collect health data outside a HIPAA-covered arrangement, the FTC’s Health Breach Notification Rule can apply instead. Breaches of unsecured personal health information must be reported to affected individuals within 60 calendar days of discovery, and breaches affecting 500 or more people also require notification to the FTC and prominent media outlets in the affected area within the same window.⁵

Tax Treatment of Wellness Incentives

Not every wellness reward is tax-free, and the treatment depends on the form of the incentive and whether it reimburses an actual medical expense.

Premium reductions tied to an employer-sponsored health plan are generally excluded from the employee’s gross income, treated the same as any employer contribution to health coverage.⁶

Reimbursements for medical care expenses can also be excluded under Internal Revenue Code Section 105(b), but only to the extent they cover actual unreimbursed medical costs. If a wellness program pays an employee for completing a health screening that cost the employee nothing, the payment is not reimbursing a medical expense and must be included in gross income.⁷

Cash rewards, gift cards, and other cash equivalents are always taxable. The IRS is explicit that cash and cash equivalents can never be excluded as a de minimis fringe benefit, regardless of amount. A $25 gift card for completing a health risk assessment is taxable income and must appear on the employee’s W-2.⁶

Gym membership reimbursements have their own wrinkle. The IRS excludes the value of an on-premises athletic facility operated by the employer, but that exclusion does not extend to off-site memberships or reimbursements for external gyms. Those payments are taxable income subject to employment taxes.⁶

Wage and Hour Rules Under the FLSA

Time spent on wellness activities raises a separate question under the Fair Labor Standards Act. The Department of Labor has concluded that when participation is wholly optional and predominantly benefits the employee, the time is not compensable work time. Offering incentives like lower premiums or reduced deductibles does not change that conclusion, as long as the employer does not require participation.⁸

If an employer requires participation, the analysis flips. Mandatory wellness activities are performed for the employer’s benefit and become compensable hours worked.

ERISA Disclosure Obligations

When a wellness program qualifies as an employee welfare benefit plan or is part of one, ERISA requires the employer to provide participants with a Summary Plan Description covering eligibility conditions, benefits, the claims and appeals process, funding sources, and participants’ rights under ERISA. Programs integrated into a group health plan must also describe cost-sharing provisions, network provider rules, preauthorization requirements, and circumstances that can result in loss or denial of benefits.⁹

Employers frequently underestimate this obligation. A wellness program that offers premium discounts, reimburses health-related costs, or provides benefits beyond general education likely triggers ERISA’s reporting and disclosure requirements. Failing to distribute a compliant Summary Plan Description can result in penalties of up to $110 per day for each participant who requests the document and does not receive it.

1
U.S. Department of Labor. HIPAA and the Affordable Care Act Wellness Program Requirements
2
Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
3
U.S. Equal Employment Opportunity Commission. EEOCs Final Rule on Employer Wellness Programs and the Genetic Information Nondiscrimination Act
4
U.S. Department of Health and Human Services. HIPAA Privacy and Security and Workplace Wellness Programs
5
Federal Trade Commission. Complying With FTCs Health Breach Notification Rule
6
Internal Revenue Service. Publication 15-B (2026), Employers Tax Guide to Fringe Benefits
7
Office of the Law Revision Counsel. 26 USC 105 – Amounts Received Under Accident and Health Plans
8
U.S. Department of Labor. FLSA2018-20 Opinion Letter
9
eCFR. 29 CFR 2520.102-3 – Contents of Summary Plan Description