Employers Offering Wellness Programs Through Self-Insured Group Health Plans Must Comply With Final Rule on Incentives to Avoid Claims of Discrimination, Violations of Other Laws

The departments of Health and Human Services, Treasury, and Labor published their final rule regarding Incentives for Nondiscriminatory Wellness Programs in Group Health Plans on June 3, 2013 (104 PBD, 5/30/13; 40 BPR 1327, 6/4/13). This final rule implements the Affordable Care Act’s modifications of the wellness program exception to the Health Insurance Portability and Accountability Act’s (HIPAA’s) nondiscrimination provisions prohibiting group health plans and insurers from discriminating (e.g., through restrictions on eligibility or higher cost-sharing requirements) against individual participants and beneficiaries based on a health factor. ¹The wellness program provisions discussed here do not apply to coverage on the individual market. The final rule does implement, however, the HIPAA nondiscrimination provisions to nongrandfathered individual health insurance coverage for policy years beginning on or after Jan. 1, 2014.

The exception was established in 2006 and allows group health plans and insurers to offer rewards or penalties, up to a certain amount, for participants in wellness programs who satisfy, or fail to satisfy, a health standard (237 PBD, 12/13/06; 33 BPR 2920, 12/19/06). ACA increased the maximum possible reward or penalty available through a wellness program and made some other minor changes to the exception.

The final rule applies to grandfathered and nongrandfathered group health plans, including self-insured health plans, and health insurance issuers in the group market for plan or policy years beginning on or after Jan. 1, 2014.

Importantly, the preamble to the final rule states that the regulations do not apply to “all types of programs or information technology platforms offered by an employer, health plan, or health insurance issuer that could be labeled a wellness program, disease management program, case management program, or similar term.”

Which Employers Come Under the Final Rule?

So what exactly brings an employer under the ambit of the final rule? Is it the employer’s status as a plan sponsor? The fact that a workplace wellness program features a reward or penalty? Or is it that the reward or penalty is tied to a “health factor”?

• As an initial matter, the final rule applies to employers only if they are self-insured. Workplace wellness programs offered by fully insured employers are not subject to the final rule.

• Next, workplace wellness programs offered by group health plans or plan sponsors that do not offer any rewards (financial or nonfinancial) generally do not have to meet the conditions laid out in the final rule.

• Finally, group health plan or plan sponsor wellness programs with rewards that are not contingent on individuals meeting specific standards or performing specific activities related to a health factor generally do not trigger the final rule’s detailed requirements for program and reward parameters.

Under the final rule, group health plans and insurers may offer two types of wellness programs: participatory wellness programs and health-contingent wellness programs.

Participatory wellness programs must be available to all “similarly situated” individuals without regard to health status. Examples of such programs include reimbursement for gym membership, free health education classes, or rewards for completing health assessments with no requirement for further action or follow-up. As discussed above, if a plan or issuer implements a wellness program with no variation in benefits, premiums, or other financial or nonfinancial reward based on a health factor, the final rule is generally not implicated.

Health-contingent wellness programs provide rewards to or impose penalties on individuals who meet or fail to meet a specific health standard. Such programs, in turn, fall into one of two categories. Activity-only wellness programs are health-contingent wellness programs in which individuals must perform or complete an activity related to a health factor (e.g., exercise regimen or weight loss program) to get a reward. Outcome-based wellness programs are health-contingent programs that require individuals to meet a specific health goal or outcome (e.g., not smoking or body mass index (BMI) falling within the normal range) to get a reward.

Five Requirements for Health-Contingent Wellness Programs.

Both types of health-contingent wellness programs must meet the following five requirements, which attempt to ensure that they will not, in fact, discriminate based on health status:

1. Annual Qualification. The program must give eligible individuals an opportunity to qualify for the reward at least once per year.
2. Reward and Penalty Maximums. The reward (or penalty) must not exceed: a) 30 percent of the total cost of employee-only coverage under the plan, taking into account both employer and employee contributions toward the cost of coverage for the benefit package under which the employee is (or the employee and any dependents are) receiving coverage; or b) 50 percent if the program is designed to prevent or reduce tobacco use. The final rule increases the reward or penalty from 20 percent to 30 percent. The final rule also provides several examples of compliant and noncompliant reward and penalty structures.
3. Reasonable Alternatives. The reward must be available to all similarly situated individuals. The group health plan or insurer must make available a “reasonable alternative standard” (or waive the general standard) to anyone for whom it is “unreasonably difficult” to meet, or try to meet, the general standard. The final rule allows plans or issuers to require an individual to provide verification (e.g., through a doctor’s note) that he or she cannot meet the generally applicable standard in an activity-only wellness program in order to be eligible for a reward under the reasonable alternative. However, requiring such a verification is not permitted with outcome-based wellness programs. The final rule discusses in detail what constitutes reasonable alternative standards and provides examples.
4. Reasonable Design. The program must be “reasonably designed” to promote health or prevent disease and cannot be a “subterfuge for discriminating based on a health factor.” The final rule discusses in detail what qualifies as a reasonably designed program.
5. Disclosure Obligations. The group health plan or insurer must disclose—in all plan materials that describe the terms of the program—alternatives for obtaining rewards and the possibility of waiver of the alternative standard.

Interplay With Other State, Federal Laws.

Plan sponsors with covered wellness programs must be careful not only to comply with the detailed provisions of the final rule regarding the permissible structure of wellness programs and rewards or penalties under such programs, but also consider how HIPAA Privacy, Security and Data Breach Notification rules, the Americans with Disabilities Act (ADA), the Genetic Information Nondiscrimination Act (GINA), and other state and federal laws, may impact the operation of such programs.

Consultants and vendors offering products and services relating to employee wellness programs should also understand the requirements of the final rule and consider liabilities and obligations that group health plans and insurers may impose on them as HIPAA business associates.

The final rule expressly notes that HIPAA Privacy and Security rules may apply to information gathered through such wellness programs. Crucially, information obtained as a result of an employee’s participation in a group health plan wellness program is most likely protected health information (PHI) under HIPAA and may not be disclosed from the group health plan to the employer without proper authorization.

For example:

• An employer’s human resources department may not be able to list in the company’s monthly newsletter the “biggest losers” in a weight loss program without obtaining a written authorization from each of those individuals.

• An employer cannot make staffing decisions based on information about an individual’s alcohol or drug use obtained through a wellness program health risk assessment.

• A group health plan may need to provide data breach notifications to affected individuals (and possibly the secretary of health and human services and the media) if the security of a portal hosting health risk assessments was breached.

Review Policies and Procedures, Update Training.

In practical terms, this intersection of HIPAA Privacy, Security, and Data Breach rules and the final rule means that group health plans and plan sponsors will need to review their policies and procedures, and to provide updated training to staff, to make sure that they address information obtained through wellness programs.

Additionally, both health plans and consultants or vendors that provide wellness program-related services should determine the need for and review existing business associate agreements to ensure that they adequately address the privacy and security obligations relating to information obtained through such programs.

Notably, while the final rule does not apply to the myriad workplace wellness programs that are not offered through group health plan coverage, employers that want to incentivize healthy behaviors through rewards and penalties must also consider how other federal laws, including GINA, ADA, and the Employee Retirement Income Security Act may apply to their activities. State laws can also come into play—especially if states enact more stringent nondiscrimination provisions for wellness programs—but employers may be able to avoid some of these issues by making the wellness program part of their group health benefit plans so that ERISA would preempt those laws.

The departments will reportedly be issuing additional interpretive guidance regarding the final rule, and it is possible that further notice and comment rulemaking regarding these issues will be initiated in the future.

In the meantime, employers should verify whether their wellness programs are covered by the final rule, and if so, work with their insurers or self-insured plan administrators and advisers to ensure that these programs are fully compliant with all applicable laws.