EEOC’s Proposed Rule On Wellness Programs Offers Some Clarity, More Uncertainty

Yesterday, the EEOC published its much anticipated Proposed Rule regarding the interaction between wellness programs and the Americans With Disabilities Act (“ADA”). Though incentives or surcharges are permitted (indeed, encouraged) under the Patient Protection and Affordable Care Act (ACA), their uncertain status under the ADA has been a source of concern for the employer community. The EEOC’s Proposed Rule clarifies some issues under the ADA, but raises or ignores additional employer concerns. The comment period on this Proposed Rule will close on June 19, 2015.

What Makes a Wellness Program “Voluntary”?

The ADA generally prohibits employee medical examinations or inquiries unless they are job-related and consistent with business necessity. The statute contains an exception for “voluntary medical examinations, including voluntary medical histories, which are part of an employee health program . . . .” The Proposed Rule recognizes that this language applies to wellness programs, and then identifies several requirements for establishing that a medical examination or inquiry is “voluntary.” Some are obvious: for example, an employer cannot require participation in the exam or inquiry or retaliate against employees for not participating (or participating, for that matter). To what extent does the carrot and stick approach of incentives and penalties – common feature of wellness programs – affect whether the program or related inquiries are “voluntary” under the ADA?

Under the Affordable Care Act and its implementing regulations, employers may offer financial incentives to employees of up to 30% of the total cost of employee-only coverage for reaching certain health outcomes in a wellness plan (up to 50% for smoking cessation programs). The EEOC’s Proposed Rule mostly follows the ACA, adopting a maximum of 30% as the limit on wellness program incentives. Unlike HIPAA and the ACA, however, the Proposed Rule’s 30% cap would apply both to health contingent and participatory wellness programs. Moreover, the EEOC has added a nuance to the nicotine prevention component of ACA and HIPAA. Under the Proposed Rule, if an employer conducts a biometric exam to test for nicotine, any incentive would be capped at 30% instead of 50%. (If no disability-related inquiry is made, a 50% incentive is permissible because the ADA is not implicated.

Notably, the Proposed Rule does not specifically adopt the “HIPAA/Affordable Care Act” standard but instead imposes hard percentage caps. If the percentages rise or fall in the future at the behest of other federal agencies, EEOC’s caps would remain in place, putting the Commission again at odds with other agencies.

Agency Would Saddle Employers With HIPAA Privacy Requirements

Perhaps more surprising than EEOC’s adoption of the 30% incentive cap is its proposal to engraft HIPAA privacy requirements onto existing ADA confidentiality requirements. Current regulations, like the statue itself, mandate that disability-related medical information be kept in separate medical files – apart from personnel records – and that access to such information be limited to supervisors and managers with a need to know it. The Proposed Rule would add new restrictions regarding medical information obtained in connection with wellness programs. In brief, EEOC proposes to extend HIPAA privacy rules and procedures to ADA-covered employers – entities not otherwise governed by HIPAA. More specifically, under the Proposed Rule, in order for a wellness program to be “truly voluntary” (and thus ADA-compliant), the employer must: (i) “provide a notice that clearly explains what medical information will be obtained, who will receive the medical information, how the medical information will be used, the restrictions on its disclosure, and the methods … to prevent improper disclosure of the medical information;” and (ii) “receive medical information obtained by wellness programs only in aggregate form, except as needed to administer the health plan.” In what will be solace for some employers, the Proposed Rule’s interpretive guidance states, “where a wellness program is part of a group health plan and required to comply with HIPAA, its obligation to comply with [the proposed new ADA medical information requirements] generally may be satisfied by adhering to the HIPAA Privacy Rule.”

What does all this mean? For (typically large) employers whose group health plan is self-funded, the Proposed Rule may not be news – at least not in this regard. Although employers as such are not covered by HIPAA, their group health plans are. Thus, a self-insured company is already familiar with HIPAA privacy because the plan is covered by HIPAA; these employers (more precisely their health plans), therefore, already have HIPAA disclosure rules, privacy firewalls, and the like in place. However, for (typically smaller) employers whose health plans are self-insured, the Proposed Rule could impose a new set of compliance requirements. For these employers, wellness programs maybe offered through their health insurance carrier or a third party vendor. In that context, responsibility for complying with the HIPPA Privacy Rule rests with the carrier or vendor. The EEOC’s Proposed Rule would make the employer responsible for ensuring compliance, and on the hook in the event of breach.

EEOC Cavalierly Rejects Statutory Safe Harbor

The Proposed Rule’s detailed explanation of what makes a wellness program “voluntary” was necessitated by EEOC’s rejection of the widely- recognized Section 501(c) “safe harbor” defense. That section of the ADA instructs that the Act’s substantive provisions (including the restrictions on medical exams and inquiries) do not apply to benefits actions – whether in the insured or self-funded context – unless the action is “used as a subterfuge to evade the purposes” of the ADA. At least four federal circuit courts have held that “subterfuge” under the ADA means adverse action in a non-benefits context, e.g., termination, failure to promote. The Eleventh Circuit most recently reached this conclusion in Seff v. Broward Cty., 691 F.3d 1221 (11th Cir. 2012). The EEOC dismissed this view in a footnote, placing it at odds with every federal appeals court to have addressed the issue.

According to EEOC, applying Section 501(c)’s “safe harbor” defense  to wellness programs would make the word “voluntary” superfluous. By its approach, however, EEOC effectively reads an entire section out of the statute, depriving employers of a well-recognized defense.

Significance For Employers

While the Proposed Rule, if promulgated, would provide some clarity for employers, it could undermine employers’ statutory safe harbor defense, at least in some jurisdictions. Moreover, the proposed new medical privacy requirements could make wellness programs more burdensome for insured employers, who would for the first time be responsibe for satisfying HIPAA privacy requirements. Whether those requirements would discourage smaller employers from adopting or expanding wellness programs we cannot say; they certainly won’t facilitate those programs.  Given these potential issues and more that will inevitably arise in the coming weeks, it is important for the regulated community – employers, wellness program providers, and others – to consider submitting comments for the record regarding pros and cons of the Proposed Rule.  As we have throughout this process, we will keep you informed of significant developments.