Health-Contingent Wellness Programs: Federal Requirements

A health-contingent wellness program must meet five federal requirements to stay on the right side of HIPAA and the Affordable Care Act: give eligible employees a chance to qualify at least once a year, cap the total incentive at 30 percent of the cost of coverage (50 percent for tobacco-related programs), be reasonably designed to promote health or prevent disease, offer a reasonable alternative standard to anyone who can’t meet the primary one, and disclose that alternative in every plan material describing the program.¹ Miss any one of them and the program loses its exception from HIPAA’s nondiscrimination rules, which turns the whole setup into prohibited discrimination based on a health factor.²

Is Your Program Actually Health-Contingent

The dividing line is whether the reward depends on a health factor. A program that reimburses gym memberships or pays employees for attending a health seminar without tracking results is participatory, and participatory programs face only one rule: make the program available to all similarly situated individuals. A health-contingent program conditions the reward on satisfying a standard tied to a health factor, such as completing a specific exercise regimen, staying tobacco-free, or hitting a cholesterol target.² Only health-contingent programs have to clear the five-requirement bar.

Health-contingent programs come in two flavors. Activity-only programs reward employees for performing a task, such as finishing a 10-week walking program or attending exercise classes, regardless of whether their biometric numbers actually change. Outcome-based programs require employees to attain or maintain a specific health result, like a target BMI range, blood pressure threshold, or tobacco-free status, usually verified through biometric screening or physician attestation.² Both subtypes face the same five requirements, but the alternative-standard rules apply differently to each.

The Five Requirements in Detail

Annual Chance to Qualify

Every eligible employee must have at least one opportunity each year to earn the full reward.¹ A program that closes enrollment early or offers only a single screening date without makeup options puts this requirement at risk.

Incentive Cap

The total reward across all health-contingent programs in a plan cannot exceed 30 percent of the total cost of employee-only coverage, counting both the employer and employee shares. If the annual cost of employee-only coverage is $10,000, the ceiling sits at $3,000.¹ Programs aimed specifically at preventing or reducing tobacco use get a higher cap of 50 percent, so a tobacco surcharge or smoking-cessation reward on that same $10,000 plan could reach $5,000.² An employer can run both a general program and a tobacco program at once, with the 30 percent and 50 percent limits applying to their respective incentives.

When dependents can participate, the calculation shifts to the cost of whatever coverage tier the family is enrolled in. A family plan costing $25,000 would allow up to $7,500 in general health incentives or $12,500 for tobacco programs.¹ The regulation counts both rewards (premium discounts, benefit enhancements, cost-sharing waivers) and penalties (surcharges, benefit reductions) toward the cap. Whether you frame it as a carrot or a stick does not matter; only the dollar amount counts.²

Reasonable Design

The program must have a genuine chance of improving health or preventing disease, it cannot be overly burdensome, and it cannot be a disguised way to discriminate based on health status.¹ There is no hard rule on how many hours per week an employer can demand. The determination rests on the overall facts and circumstances, so requiring nightly attendance at an hour-long class would likely cross into unreasonable.

Reasonable Alternative Standard

The full reward must be available to all similarly situated individuals, which means an alternative pathway must exist for employees who can’t meet the initial standard. Not a reduced reward. Not a consolation prize. The same incentive everyone else gets.

When the alternative must be offered depends on the program type. For activity-only programs, the trigger is the individual showing that a medical condition makes the standard unreasonably difficult or medically inadvisable to attempt. For outcome-based programs, the trigger is broader: every employee who fails to hit the biometric target must be offered an alternative, regardless of the reason.¹ An outcome-based program cannot screen employees for a sufficient reason before providing the alternative.

Federal guidance gives examples of what qualifies. An employee who can’t meet a weight-loss goal could be offered attendance at nutritional education classes. A tobacco cessation program could allow nicotine patches or counseling as an alternative.¹ The alternative cannot simply be a slightly easier version of the same biometric target without extra time or support. If an employee’s personal physician says the program standard isn’t medically appropriate, the employer must accommodate those recommendations as an alternative.

The employer pays for the alternative. If it involves an educational program, the employer must either provide it directly or help the employee find one, and cannot charge for it. For diet programs, the employer doesn’t have to cover food costs but must pay membership or participation fees.¹ Telling an employee to “go find a nutrition class” and figure it out violates the regulation.

Disclosure

Every plan material describing the program must clearly state that a reasonable alternative standard is available.¹ Not buried in an appendix. In every document that discusses the incentive terms. An employee reading about the program should never have to hunt for the alternative pathway.

The ADA Notice You Also Have to Provide

When a wellness program collects health information, the ADA requires a separate written notice covering what information is collected, how it will be used, who will see it, how it will be kept confidential, and that the employee will not face retaliation for declining to participate.³ The notice should name the specific roles with access (such as a registered nurse, physician, or health coach) and confirm that identifiable medical data will not reach supervisors or managers, will not be used in employment decisions, and will be stored separately from personnel files.

Confidentiality Rules When Health Data Is Collected

When the wellness program runs through a group health plan, HIPAA’s privacy rules apply to all health information collected. The plan can share data with the employer only for plan administration purposes, and only if the employer formally amends the plan documents, maintains separation between employees who handle plan administration and everyone else, and commits not to use health information in employment decisions.⁴

One boundary worth flagging: when an employer runs a wellness program directly rather than through a group health plan, HIPAA’s privacy protections do not apply to the health information collected. Other federal and state laws may still provide some protection, but the HIPAA framework specifically requires the plan connection.⁴ Third-party vendors managing the program must follow the same confidentiality protocols, with appropriate administrative, technical, and physical safeguards for electronic health data.

GINA Rules on Family Medical History

GINA treats family medical history as genetic information, and group health plans cannot collect genetic information for underwriting purposes. That prohibition includes tying any reward to the completion of a health risk assessment that asks about family medical history. A common fix is a two-part assessment: one questionnaire collects general health data and can be tied to an incentive; a separate, fully optional questionnaire asks about family history and carries no reward. The two must be genuinely independent, not two sections of the same form filled out at the same sitting.⁵

Employers may offer incentives for a spouse to provide health status information through a voluntary program, but the spouse must give prior, knowing, written, and voluntary authorization, and the maximum inducement is 30 percent of the cost of self-only coverage. Employers cannot offer incentives for health information about an employee’s children, and they cannot deny coverage or retaliate against an employee whose spouse declines to participate.⁶

How Incentives Get Taxed

Premium discounts and surcharges generally adjust the employee’s share of health insurance premiums. If those premiums are paid pretax through a cafeteria plan, the incentive simply changes the pretax contribution amount and creates no separate taxable event.

Cash and gift cards work differently. The IRS treats cash and cash equivalents as taxable compensation, and they cannot qualify as tax-free de minimis fringe benefits regardless of amount. A $500 gift card for completing a biometric screening is $500 of taxable wages subject to income tax, Social Security, and Medicare withholding. Non-cash items of small value may qualify as de minimis fringe benefits, but the IRS sets no fixed dollar threshold; the test is whether accounting for the value would be administratively impractical.⁷

What Happens If a Program Fails a Requirement

A health-contingent program that fails any of the five requirements loses the nondiscrimination exception, and the arrangement becomes a prohibited health-factor-based distinction under HIPAA. Group health plans that violate HIPAA’s nondiscrimination provisions face an excise tax under IRC Section 4980D of $100 per affected individual per day, which scales quickly across a workforce. Mishandling protected health information carries its own tiered civil monetary penalties from HHS, and employees denied rewards without a proper alternative standard, or hit with penalties exceeding the caps, can challenge the program directly.

1
U.S. Department of Labor. Wellness Programs Under HIPAA and the Affordable Care Act
2
eCFR. 29 CFR 2590.702 – Prohibiting Discrimination Against Participants and Beneficiaries Based on a Health Factor
3
U.S. Equal Employment Opportunity Commission. Sample Notice for Employer-Sponsored Wellness Programs
4
U.S. Department of Health and Human Services. HIPAA Privacy and Security and Workplace Wellness Programs
5
U.S. Department of Labor. FAQs About the Genetic Information Nondiscrimination Act
6
U.S. Equal Employment Opportunity Commission. EEOC Final Rule on Employer Wellness Programs and the Genetic Information Nondiscrimination Act
7
Internal Revenue Service. Publication 15-B, Employer’s Tax Guide to Fringe Benefits