Employee wellness apps sit in a compliance gray zone that benefits teams keep avoiding. An app asks for a name and a date of birth to verify eligibility. It collects a stress assessment, a sleep log, a step count. Then that data lands in the same system that holds medical plan elections, and nobody has documented whether HIPAA protects it.
The answer is more specific than vendors claim, and less sweeping than a lot of compliance commentary suggests. HIPAA applies when a wellness program is part of a group health plan. When the program is offered directly by the employer and not in connection with a group health plan, HIPAA doesn't govern that data at all. Most employers never determine which kind of program they run, and that's where the real exposure lives.
Does HIPAA Apply to Your Wellness App?
Every wellness vendor gives the same pitch: "We're a standalone program. This isn't claims data. You don't need a BAA." That pitch is sometimes true. Whether it holds depends on a distinction the vendor has no reason to volunteer.
HHS is explicit on the point. When a workplace wellness program is offered as part of a group health plan, the individually identifiable health information collected from or created about participants is protected health information (PHI), and the HIPAA Privacy, Security, and Breach Notification Rules protect it. When the program is offered directly by the employer and not in connection with a group health plan, the information the employer collects isn't protected by the HIPAA Rules.
The "no BAA needed" line holds only for a program that stands completely outside the group health plan. It collapses the moment the program is tied to plan premiums or cost-sharing, or is administered through the plan. A vendor that collects a health risk assessment and feeds a premium discount is handling PHI on behalf of the plan, which makes it a business associate that needs a business associate agreement (BAA).
The Data Backflow Nobody Audits
Take a program that is part of the plan because it offers a premium discount for completing a health assessment. The flow looks like this:
- An employee logs into the wellness app.
- The app asks for a name and date of birth to verify eligibility, a query against the enrollment database that feeds the medical plan.
- The employee completes a stress assessment and a step-tracking challenge.
- The vendor sends back a "population health report" listing high-risk employees by name, including depression risk scores.
Each step is defensible in isolation. Together they're a disclosure the Privacy Rule doesn't permit. When the wellness program is part of the group health plan, the vendor's report of named, high-risk employees is PHI created on behalf of the plan. The plan can share PHI with the employer as plan sponsor only under the conditions in 45 CFR 164.504(f): the plan documents must be amended, and the employer must certify that it won't use the information for employment-related actions or decisions. A report that HR reads to manage staffing is exactly the use the certification forbids.
The same problem shows up inside the benefits administration system. Most platforms store wellness data in the same employee profile that holds medical plan selections, with no tag distinguishing the two. A benefits coordinator sees "Medical: Waived. Wellness: High-risk cardio screen" in a single view. That's PHI visible to people the Minimum Necessary Standard says shouldn't see it.
The EAP Carve-Out That Collapses
Many employers believe EAPs carry a blanket HIPAA exemption. They're thinking of the wrong rule. EAPs can qualify as excepted benefits under HIPAA portability and ACA market reform rules, which relieves them of certain requirements, but excepted benefits remain subject to the HIPAA Privacy and Security Rules. An EAP that provides counseling is a group health plan and must protect the PHI it holds.
The carve-out most employers imagine doesn't exist in the Privacy Rule. What changes with integration is the exposure. When EAP usage data gets cross-referenced with health risk assessment scores inside the same benefits system, two PHI streams combine into one profile, and the circle of people who can see it widens. EAP counseling data was already PHI. What integration changes is how far it travels.
Why OCR Is Already Looking Here
OCR has spent the past several years enforcing exactly this kind of data sharing. In December 2022 it issued guidance on online tracking technologies, warning that cookies, pixels, and similar tools on websites and mobile apps can collect PHI, and that disclosures to tracking vendors require a BAA or an individual authorization. On July 20, 2023, OCR and the FTC sent a joint letter to roughly 130 hospitals and telehealth providers flagging that tracking technologies on their sites and apps may be collecting health information in violation of HIPAA.
Wellness apps run on the same mechanisms: SDKs, analytics tools, and authentication flows that phone home to third parties. When the app sits inside a group health plan's wellness program, the identifiers and engagement data it emits can be PHI, and the same analysis OCR applied to hospital portals applies to the app. In June 2024 a federal court in Texas set aside the bulletin's treatment of unauthenticated public webpages, but the underlying rule stands: PHI cannot flow to a tracking or analytics vendor without a BAA or an authorization.
What To Do Right Now
This isn't theoretical. Start here:
- Map every API handshake between your benefits system and your wellness and EAP vendors. If a vendor handles PHI on behalf of the group health plan, it's a business associate and needs a BAA.
- Classify each program. If a wellness program affects plan premiums or cost-sharing, or is administered through the plan, treat its data as PHI. If it's a standalone employer program, document that conclusion and govern the data under ADA, GINA, and state law instead.
- Segment your benefits database. Tag data by source. Medical and plan-wellness PHI should be restricted to plan administrators. Non-clinical participation data can stay visible to HR only after you've confirmed it contains no health information.
- Rewrite vendor agreements. Don't accept the "not a BAA partner" argument at face value. Add a clause stating that any PHI received from or created for the group health plan is protected, and that the vendor will sign a BAA when it handles that PHI.
- Review the plan sponsor amendment and certifications. Confirm the plan documents restrict how the employer, as plan sponsor, can receive and use PHI, including the ban on using it for employment decisions.
When HIPAA Does Not Apply, Other Laws Do
A reader who classifies a program as employment-only and stops there has answered the HIPAA question and nothing else. The Americans with Disabilities Act still governs employer wellness programs that collect health information directly. Participation must be voluntary, and employers face limits on the medical examinations and disability-related inquiries they can require. The Genetic Information Nondiscrimination Act bars employers from collecting genetic information, including family medical history, through wellness programs. These laws apply to employment-only programs precisely because HIPAA doesn't.
State law adds another layer. Washington's My Health My Data Act, which took effect March 31, 2024, protects consumer health data but excludes data obtained in the course of employment. Illinois's Biometric Information Privacy Act reaches employee data, so a fingerprint or facial scan collected by a wellness app can carry its own notice and consent obligations. Classifying a program correctly tells you which rules govern. The obligations under those rules remain.
The Bottom Line
The industry has been watching the wrong threat model. Big claims breaches are dramatic, but the quiet migration of wellness data into benefits systems is more common. The fix is structural: determine whether each program is part of the plan, sign BAAs where PHI flows, and audit the data integration, not just the contract.
This article is for general information only and is not legal, tax, or medical advice. Employers should consult their own advisors.