Employee wellness program compliance runs through at least five federal statutes: HIPAA as amended by the Affordable Care Act, the Americans with Disabilities Act, the Genetic Information Nondiscrimination Act, ERISA, and the Internal Revenue Code, with the Fair Labor Standards Act adding a wage-and-hour layer on top. Each governs a different piece of the program, and a single poorly drafted health risk assessment can breach three of them at once. Penalties stack: an excise tax of $100 per affected employee per day under HIPAA, EEOC damages that scale with employer size under the ADA and GINA, and IRS reclassification of tax-favored reimbursements as ordinary wages. The rules below cover what applies, when, and where the current regulatory gaps sit.
Which Type of Program You’re Running
The compliance burden turns first on how the program is structured. Participatory programs reward employees for engagement alone: reimbursing a gym membership, offering a lunch-and-learn, or paying a small reward for completing a questionnaire. Because nobody has to hit a health target, these programs face lighter requirements and no incentive cap under HIPAA.
Health-contingent programs tie the reward to a health-related standard, and they split into two subtypes. Activity-only programs require the employee to do something, like walking 10,000 steps a day, regardless of whether their health markers move. Outcome-based programs require the employee to reach a measurable result: a target BMI, blood pressure within a stated range, a negative nicotine test. Outcome-based designs carry the heaviest compliance load because they can penalize employees for conditions they may not fully control.
HIPAA and ACA Rules for Health-Contingent Programs
The joint HIPAA/ACA regulations from the Departments of Labor, HHS, and Treasury impose five requirements on any health-contingent program:
- Employees must have the opportunity to qualify for the reward at least once per year.
- The total reward across all health-contingent programs cannot exceed 30% of the total cost of employee-only coverage, counting both employer and employee premium shares. For programs designed to prevent or reduce tobacco use, the cap rises to 50%.
- The program must be reasonably designed to promote health or prevent disease. It cannot be overly burdensome, a pretext for health-factor discrimination, or highly suspect in its methodology.
- The full reward must be available to all similarly situated individuals. If meeting the standard is unreasonably difficult due to a medical condition, or medically inadvisable to attempt, the program must offer a reasonable alternative way to earn the reward.
- All plan materials describing the program must disclose the availability of a reasonable alternative standard, provide contact information for requesting one, and state that the recommendations of a participant’s personal physician will be accommodated.
Both activity-only and outcome-based programs must satisfy all five, and outcome-based programs carry additional obligations around the reasonable alternative standard. The disclosure is not optional language buried in fine print. It has to appear in every piece of material that describes the program’s terms, including any notice telling an employee they did not meet an outcome-based target. The DOL publishes model language, and staying close to it reduces the risk of challenge.
ADA Voluntariness and the Incentive Gap
The ADA permits disability-related inquiries and medical exams only as part of a voluntary employee health program. That word “voluntary” has generated more litigation than any other aspect of wellness compliance. Employers cannot require participation, deny health insurance to non-participants, or retaliate against employees who decline. Medical records collected through the program have to be kept confidential and stored separately from regular personnel files. Managers involved in employment decisions should not see them.
The current gap is significant. In 2016, the EEOC issued rules allowing incentives up to 30% of the cost of self-only coverage without making a program involuntary under the ADA. A federal court struck down those incentive provisions in AARP v. EEOC, and the EEOC formally removed them in 2019. The EEOC proposed a replacement rule in 2023 that would have reinstated a 30% threshold, but it was never finalized. As of 2026 there is no binding EEOC guidance on what incentive level makes a program effectively involuntary under the ADA. Satisfying the HIPAA/ACA 30% cap does not automatically satisfy the ADA. Large incentives within the HIPAA limit can still be challenged as coercive. Most employment lawyers advise keeping incentives modest and making sure the program is optional in practice, not just on paper.
GINA and Family Medical History
GINA prohibits employers from requesting, requiring, or purchasing genetic information for use in employment decisions. Genetic information under the statute includes family medical history, not just DNA test results. That definition collides directly with health risk assessments that ask about diseases running in the employee’s family.
A plan cannot offer a reward in exchange for completing a health risk assessment that asks for family medical history, because the reward turns the request into a prohibited underwriting tool. Spousal participation creates a second layer: when a wellness program invites spouses to complete health screenings, the spouse’s health information counts as genetic information about the employee. The EEOC’s 2016 amendment permitted limited inducements for spousal data about the manifestation of disease or disorders, but no inducement is allowed for an employee’s own genetic test results or for their children’s genetic information.
Any employer holding genetic information must store it in medical files separate from personnel records and may disclose it only under six narrow statutory exceptions.
Privacy, Data Separation, and Vendor Agreements
Wellness programs generate sensitive health data, and the HIPAA Privacy and Security Rules govern how that data moves between the wellness vendor, the group health plan, and the employer. The core principle is separation. The employer sponsoring the plan generally should not see individually identifiable health information. Data should reach the employer only in aggregate form that cannot be traced to a specific person.
When an employer does need access to individual health data for plan administration, the group health plan documents have to be amended to include specific protections. The employer must certify that it will maintain clear separation between staff who handle plan administration and those who do not, that it will not use the information for hiring, firing, or promotion decisions, and that it will apply reasonable safeguards for any electronic health information. Any unauthorized disclosure has to be reported back to the group health plan.
When a third-party vendor runs the program and handles protected health information, HIPAA requires a written Business Associate Agreement before any data changes hands. The contract has to spell out what the vendor can and cannot do with health data, require security safeguards, mandate breach reporting, and require the vendor to return or destroy all health information at contract end. It also has to bind any subcontractors to the same restrictions. Sharing health data with a vendor without this agreement in place is itself a HIPAA violation, whether or not a breach ever occurs.
If the employer seeks personal health information beyond what plan administration requires, it needs a signed authorization from the employee identifying what will be shared, who will receive it, and the purpose. The ADA’s confidentiality requirements still apply on top of that authorization.
ERISA Plan Documents and Form 5500
A wellness program that provides medical care, such as biometric screenings, health risk assessments with clinical components, or disease management services, likely qualifies as an ERISA welfare benefit plan. That classification triggers administrative duties. The employer must maintain a formal written plan document and give participants a Summary Plan Description that explains the program’s terms, eligibility, and claims procedures in plain language.
If the plan has 100 or more enrolled participants on the first day of the plan year, the employer must file a Form 5500 annual report with the Department of Labor. Purely participatory programs that do not involve medical inquiries or clinical testing may fall outside ERISA, but the line is fact-specific and worth evaluating with counsel before assuming exemption.
Tax Treatment of Incentives
The IRS treats most wellness rewards the same way it treats regular wages. Cash payments, gift cards, and merchandise with meaningful value are taxable income that must be reported on the W-2 and run through federal income tax withholding and FICA. A $200 reward for completing a biometric screening hits the paycheck exactly like $200 in salary.
The de minimis fringe benefit exclusion is narrower than many employers assume. Under IRC section 132, a benefit qualifies as de minimis only if its value is so small that accounting for it would be unreasonable or administratively impractical. A branded t-shirt or an occasional water bottle qualifies. Cash and cash equivalents never do, regardless of amount. A $10 gift card is taxable.
The IRS has grown more aggressive about wellness incentives routed through HRAs and FSAs. Only plans that reimburse bona fide medical expenses under IRC section 213(d) qualify for tax-favored treatment. General wellness expenses like gym memberships, personal training, and nutritional counseling do not meet the 213(d) definition unless prescribed to treat a specific diagnosed condition such as obesity or heart disease. If a plan reimburses non-medical wellness expenses, the IRS position is that all payments from the plan become taxable, including reimbursements that would otherwise qualify as medical. The IRS has issued multiple alerts warning employers about arrangements that recharacterize personal expenses as medical care.
Employer contributions to a Health Savings Account as a wellness incentive can be excluded from gross income, but only within the annual HSA contribution limits, and any employer contribution reduces how much the employee can contribute on their own.
Wage and Hour Treatment of Participation Time
For employers with non-exempt workers, the question is whether time spent on wellness activities has to be paid. The Department of Labor addressed this in a 2018 opinion letter. Time spent in voluntary wellness activities, biometric screenings, and benefits fairs is generally not compensable work time, provided participation is genuinely optional, the activity is unrelated to the employee’s job duties, and the primary beneficiary is the employee rather than the employer.
One catch. Short breaks of 20 minutes or less are ordinarily compensable regardless of how the employee spends them. If a 15-minute biometric screening happens during a paid break, that time is compensable because the break is paid, not because the screening is work. Employers running on-site screening events during working hours should track whether participants are using paid break time or genuinely off-duty periods.
Penalties for Noncompliance
The financial exposure justifies the upfront compliance investment, and penalties come from multiple directions depending on which law was breached.
- Excise tax under IRC section 4980D. Group health plan failures, including violations of HIPAA’s wellness nondiscrimination rules, trigger an excise tax of $100 per affected individual per day for every day the violation continues. If the failure is not corrected before the IRS sends a notice of examination, the minimum tax is $2,500 per individual, rising to $15,000 per individual when the violations are more than de minimis.
- GINA damages. Title II violations carry the same remedies as Title VII claims. Compensatory and punitive damages combined are capped from $50,000 for employers with 15 to 100 employees up to $300,000 for employers with more than 500 employees, on top of back pay, attorneys’ fees, and potential injunctive relief.
- ADA enforcement. The EEOC can investigate and sue over wellness programs that violate the ADA’s voluntariness requirement or confidentiality provisions, with remedies mirroring Title VII.
- HIPAA privacy violations. HHS can impose civil monetary penalties for privacy and security breaches, and state attorneys general can bring actions on behalf of residents.
These penalties stack. A single health risk assessment that collects family medical history and ties completion to an incentive can violate GINA, the ADA, and HIPAA’s nondiscrimination rules simultaneously, exposing the employer to overlapping enforcement from the IRS, the EEOC, and HHS on the same facts.