Employee Wellness Program: HIPAA, ADA, and ERISA Compliance

An employee wellness program has to satisfy at least five separate federal regimes to be legally compliant: HIPAA and the Affordable Care Act govern incentive caps and alternative standards, the ADA controls medical inquiries and confidentiality, GINA restricts what you can ask about family history and genetic information, the Internal Revenue Code determines which rewards are taxable, and ERISA imposes plan-document and reporting obligations when the program qualifies as a welfare benefit plan. A sixth, the FLSA, decides whether time spent on wellness activities has to be paid. Getting any one of these wrong can produce discrimination claims, back taxes, or DOL penalties.

Which Category Your Program Falls Into

Federal rules split wellness programs into two categories, and the category determines almost everything else.

A participatory program rewards everyone who takes part, regardless of health status. Gym reimbursements, health seminars, and attendance-based walking challenges are participatory. The only real requirement is that the program be available to all similarly situated employees.¹

A health-contingent program ties the reward to meeting a health-related standard. Activity-only versions require completing a task, like logging a set number of steps, without hitting a biometric target. Outcome-based versions require reaching a measurable goal such as a target blood-pressure or cholesterol reading.¹ Health-contingent programs have to satisfy five federal requirements, including incentive caps, a reasonable frequency for qualifying, and a reasonable alternative standard. Participatory programs are exempt from all five.

Incentive Caps Under HIPAA and the ACA

For most health-contingent programs, the combined reward across all such programs under a plan cannot exceed 30% of the total cost of employee-only coverage. “Total cost” means the employer’s share plus the employee’s share of premiums, not just what the employee pays out of pocket.¹ At a 2025 national average of $9,325 for single coverage, that puts the maximum around $2,798.

Tobacco-cessation programs get a higher ceiling: 50% of the total cost of employee-only coverage. Where an employer offers both a general health-contingent program and a tobacco program, the combined incentive still cannot exceed 50%.²

When dependents can participate, the percentage applies to the coverage tier the employee and dependents are actually enrolled in, not the self-only rate. The dollar ceiling rises, but so does the exposure from a miscalculation.¹

The EEOC Incentive Gap

The ACA and HIPAA set the caps described above, but the ADA separately requires that any wellness program collecting medical information be “voluntary.” The EEOC’s 2016 rules defined that word with their own incentive limits tied to the 30% threshold. A federal court vacated those rules in AARP v. EEOC effective January 1, 2019, and the EEOC has not replaced them.³

The EEOC proposed new rules in January 2021 that would have capped incentives for programs involving medical inquiries or exams at a de minimis amount, far below the ACA’s 30%.⁴ Those proposals were withdrawn before publication and never finalized. There is no current EEOC safe harbor for incentive size tied to disability-related inquiries or medical exams. An employer offering the full 30% for a biometric screening or a health risk assessment with medical questions is operating within the ACA but without ADA certainty, which is why many employment lawyers advise keeping such incentives modest.

Reasonable Alternative Standards

Every health-contingent program has to offer a reasonable alternative for anyone who cannot meet the initial standard because of a medical condition or for whom trying to do so would be medically inadvisable. For outcome-based programs, the alternative must be available to any employee who does not meet the target, without a physician’s note.²

“Reasonable” has content. If the alternative is an educational program, the employer must make it available or help the employee find one, and cannot charge for it. If it is a diet program, the employer must cover membership or participation fees, though not food. The time commitment must be realistic; nightly hour-long classes would fail. Where the alternative is itself an outcome-based goal, the employer cannot just pick a different number on the same metric without giving the employee additional time that accounts for individual circumstances. If a personal physician says the standard is medically inappropriate, the plan has to accommodate that recommendation. Every description of the wellness program in plan materials must disclose that a reasonable alternative is available and how to obtain it.¹

ADA Confidentiality and the “Voluntary” Standard

HIPAA is often assumed to cover all wellness data. It does not. HIPAA applies to a wellness program only when the program is offered as part of a group health plan. A standalone program that is not tied to the employer’s health insurance is outside HIPAA entirely, though other laws may still limit how the data is used.⁵

The ADA fills part of the gap. Medical information collected through employee exams or health inquiries has to be kept on separate forms in separate medical files and treated as confidential. Supervisors may be told only about necessary work restrictions or accommodations. First-aid and safety personnel may be informed if a disability could require emergency treatment. No one else in management or HR should have access.⁶

The ADA also requires that programs collecting medical information be genuinely voluntary. EEOC standards say a program fails that test if the employer requires participation, denies health plan coverage to nonparticipants, or retaliates against employees who opt out. A written notice must explain what data will be collected and how it will be protected.⁷

GINA and Genetic Information

GINA broadly prohibits employers from requesting, requiring, or purchasing genetic information about employees or their family members, and family medical history counts as genetic information under the statute.⁸

A wellness program can ask family-history questions on a health risk assessment, but only under strict conditions. The employee must give prior, knowing, written authorization describing what genetic information will be collected and how it will be used. Individually identifiable genetic information can go only to the employee and the licensed health-care professionals involved, never to managers or anyone making employment decisions. Anything shared with the employer must be aggregated so no individual can be identified.⁸

The incentive rules under GINA are tighter than employers often expect. No inducement may be offered in exchange for an employee providing genetic information such as DNA test results. For a health risk assessment that includes family-history questions, an incentive for completing the assessment is allowed, but the assessment must make clear that the incentive is available whether or not the employee answers the genetic-information questions, and it has to identify which questions those are. An assessment that blurs the line violates GINA.⁹

Inducements for genetic information about employees’ children are flatly prohibited. A limited inducement is permitted for information about a spouse’s current or past health status, capped at 30% of the cost of self-only coverage and requiring the spouse’s prior written authorization.⁹

Tax Treatment of Rewards

Most wellness incentives are taxable wages. The IRS has stated that cash rewards, gift cards, and gym-membership payments provided through wellness programs are included in gross income and subject to federal income tax, Social Security tax, and Medicare tax.¹⁰ The fair market value of each incentive has to be tracked and reported on the employee’s W-2.

One trap catches employers who assume “premium reductions” are automatically tax-free. If employees pay health-plan premiums through pre-tax salary reductions under a Section 125 cafeteria plan and the wellness program reimburses some of those premiums, the reimbursement is taxable. The IRS treats the reimbursement as restoring income that had been excluded, which puts it back in gross income and triggers employment taxes.¹⁰

The exceptions are narrow. Truly de minimis fringe benefits, such as a water bottle or t-shirt, may be excluded. Employer contributions to an employee’s Health Savings Account as a wellness reward can also be excluded, provided the employee has a qualifying high-deductible health plan and total HSA contributions stay within annual limits.¹¹ That makes HSA contributions one of the more tax-efficient reward structures. Misclassifying taxable rewards as nontaxable produces back taxes, penalties, and interest on audit, with the employer liable for the failure to withhold.

ERISA Plan Documents and Form 5500

If a wellness program qualifies as an employee welfare benefit plan under ERISA, documentation and reporting obligations attach. The program needs a written plan document and a Summary Plan Description explaining eligibility, benefits, cost-sharing, and claims procedures in understandable language.¹²

Wellness plans covering 100 or more participants at the beginning of the plan year must file a Form 5500 annual return with the Department of Labor. Plans with fewer than 100 participants are generally exempt if the plan is unfunded or fully insured.¹³ A missed Form 5500 can produce DOL penalties of over $250 per day, so the participant count is worth watching.

FLSA: When Wellness Time Has To Be Paid

For non-exempt employees, time spent on wellness activities is not compensable if participation is optional, the activities are unrelated to the employee’s job duties, and the employee is completely relieved of work responsibilities during that time. The Department of Labor said so directly in a 2018 opinion letter, which covered biometric screenings and benefits fairs.¹⁴

Location does not change the answer. Activities held on-site during business hours can still be noncompensable if participation is genuinely voluntary and no job duties are being performed. There is one exception. If an employee participates during a short rest break of 20 minutes or less, the break stays compensable regardless of how the employee spends it, because short breaks are paid time under federal wage rules.¹⁴

The risk shows up when “voluntary” is only technically true. Manager pressure to attend a lunch-hour screening, or implicit career consequences for skipping, can push the DOL to reclassify the time as compensable. Employers running wellness activities during the workday should document that attendance is optional and that nonparticipation carries no adverse consequences.

1
eCFR. 29 CFR 2590.702 – Prohibiting Discrimination Against Participants and Beneficiaries Based on a Health Factor
2
Department of Labor. HIPAA and the Affordable Care Act Wellness Program Requirements
3
Federal Register. Removal of Final ADA Wellness Rule Vacated by Court
4
U.S. Equal Employment Opportunity Commission. EEOC Provides Proposed Wellness Rules for Review
5
U.S. Department of Health and Human Services. HIPAA Privacy and Security and Workplace Wellness Programs
6
Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
7
Federal Register. Regulations Under the Americans With Disabilities Act
8
eCFR. 29 CFR 1635.8 – Acquisition of Genetic Information
9
U.S. Equal Employment Opportunity Commission. Small Business Fact Sheet Final Rule on Employer-Sponsored Wellness Programs and Title II of the Genetic Information Nondiscrimination Act
10
Internal Revenue Service. Chief Counsel Advice 201622031
11
Internal Revenue Service. Publication 969, Health Savings Accounts and Other Tax-Favored Health Plans
12
eCFR. 29 CFR 2520.102-3 – Contents of Summary Plan Description
13
U.S. Department of Labor. 2025 Instructions for Form 5500 Annual Return/Report of Employee Benefit Plan
14
U.S. Department of Labor. Opinion Letter FLSA2018-20