Most wellness-program HIPAA advice boils down to: don’t share people’s health information with managers. True, but that's not where most employers get burned.
The bigger risk, and the quieter one, is structural. A wellness program becomes a HIPAA problem the moment its design and data flows turn everyday incentive administration into PHI, and then route that data through systems never built to handle it: HRIS, payroll, recognition tools, email exports, and spreadsheets.
From a benefits-systems perspective, HIPAA compliance is first an architecture problem and only secondarily a training problem.
First, a correction: “Wellness” isn’t automatically HIPAA
HIPAA doesn’t regulate “wellness programs” as a category. It applies when health information is created, received, maintained, or transmitted by (or on behalf of) a HIPAA Covered Entity, typically the employer’s group health plan, or a Business Associate performing functions for that plan.
The real question is whether the program is tethered to the group health plan in a way that pulls it into HIPAA.
Common ways the tether gets created
- Premium differentials or surcharges (for example, tobacco-related pricing)
- Biometric screenings that are billed to the plan or coordinated through plan vendors
- Condition-management programs informed by claims or pharmacy data
- Wellness eligibility files flowing from the plan’s enrollment/eligibility process
- Plan communications that frame wellness as part of the health plan benefit
Once the plan is in the loop, assume HIPAA rules are at least in the neighborhood, and design accordingly. Where a reward is conditioned on a health factor, the HIPAA nondiscrimination rules cap it at 30% of the cost of employee-only coverage, or 50% for programs that prevent or reduce tobacco use.
When HIPAA doesn’t apply: the FTC Health Breach Notification Rule
When a wellness program is genuinely separate from the group health plan, HIPAA’s privacy and security rules don’t reach it. That doesn’t leave the data unregulated.
The FTC’s Health Breach Notification Rule covers vendors of personal health records and related entities that aren’t subject to HIPAA. Amendments effective July 29, 2024 made clear the rule reaches health apps, connected devices, and similar products. Under the amended rule, a breach of security includes an unauthorized disclosure of unsecured health data, and covered vendors must notify individuals, the FTC, and in some cases the media.
For employers, the practical question changes shape. A standalone wellness app or rewards platform may not be a business associate under HIPAA, but its vendor still carries breach-notification duties under the FTC rule. When you evaluate wellness technology, ask what data the vendor collects, where it goes, and how it handles breach notice. The BAA question is not the only compliance question in the stack.
The rarely discussed failure mode: PHI by inference
You don’t need to leak a lab value to create a HIPAA exposure. A lot of wellness programs reveal health status indirectly, through “innocent” operational details. That’s the trap.
In practice, a payroll file never mentions “diagnosis,” but it does mention “diabetes adherence reward.” A benefits platform doesn’t store a test result, but it tags someone as “surcharge waived.” A manager doesn’t see a claim, but they see a public shout-out for completing a condition-related program.
Examples that can reveal health information without ever showing a diagnosis
- Payroll exports with incentive labels like “diabetes adherence” or “hypertension program”
- Benefits admin or HRIS fields that include reason codes tied to medical status
- Recognition feeds that congratulate employees for completing sensitive programs
- Small-group reporting (by shift, location, supervisor) that makes participation re-identifiable
- Support tickets or exception workflows with free-text notes that describe medical situations
If you want a simple rule that holds up operationally: employer-facing systems should receive “earned/not earned” and dollars, with nothing that explains why.
The plan sponsor trap: “HR can see it” isn’t a compliance strategy
HIPAA can allow a health plan to share certain information with the employer as the plan sponsor for plan administration purposes. But it’s not automatic, and definitely not casual.
In practice, many organizations behave as if “benefits sits in HR, therefore HR can see everything.” That assumption is where compliance programs quietly break down.
What tends to be required when the employer receives PHI for plan administration
- Plan document language that permits specific uses/disclosures to the plan sponsor
- A plan sponsor certification committing the employer to safeguard PHI and limit its use
- A real-world firewall so PHI doesn’t drift into employee relations, manager decision-making, or performance processes
This is about making sure the “who can see what” reality matches what HIPAA expects.
The integrations are the hard part
Most employers know to sign a Business Associate Agreement (BAA) with a wellness vendor. The bigger problem? What happens after the BAA is signed, when data starts moving.
Wellness programs are integration-heavy by design. Incentives hit payroll. Eligibility syncs with HRIS. Rewards are fulfilled through another vendor. Dashboards end up in analytics tools. And suddenly you've got a chain of systems touching sensitive data.
Where scope drift shows up
- A wellness vendor is under a BAA, but the gift card or rewards platform is not
- Payroll receives a file with health-revealing labels
- An internal data warehouse ingests wellness records without HIPAA-grade access controls
- A dashboard tool allows filters that effectively identify individuals in small groups
The cleanest fix is also the simplest: don’t send health-revealing data downstream. Send neutral incentive outcomes that can’t be interpreted as a medical signal.
“De-identified” wellness reporting usually isn’t
Employers love slicing wellness engagement by department, location, shift, or manager. That’s also how you accidentally create a report that’s “anonymous” in theory and obvious in practice.
If a location has 12 people and your report shows three participants in a sensitive program, it doesn’t take a genius to connect dots, especially in tight-knit teams.
HIPAA itself recognizes two paths to de-identification: expert determination and the safe harbor method, which removes 18 specified identifiers. Small-cell suppression is an operational safeguard layered on top of those, not a replacement for them.
Reporting guardrails that actually work
- Suppress small cells (commonly under 10-15 participants)
- Roll up categories until thresholds are met
- Avoid “top conditions” or condition-adjacent reporting for small groups
- Restrict row-level exports unless they’re truly required for plan administration and governed accordingly
Privacy done well serves adoption as well as compliance. Employees won’t engage if they feel monitored.
The operational headache: dual-use data in HR systems
Wellness incentives increasingly affect payroll deductions, contributions, eligibility, and even appeals. That creates dual-use data, information that lives in employment systems while also functioning like plan administration data.
The trouble is that HRIS and payroll permissions are built for employment administration, not PHI segregation. Once wellness details land there, you’ve widened access, weakened auditability, and created new places for sensitive information to leak.
If your incentive file includes program names or medical reasons, you’ve effectively turned payroll into a HIPAA risk surface.
A better model: design wellness so the employer never needs the “why”
The most defensible wellness programs rely on design choices that make the risky data unnecessary, rather than policies that say “be careful with the data.”
What a HIPAA-resilient setup looks like
- Keep identifiable health details inside the plan/vendor boundary (where HIPAA controls and BA obligations are appropriate).
- Send the employer only neutral outputs: earned/not earned, amounts, and status flags like “alternative standard needed.”
- Provide aggregate proof of impact using thresholded reporting, not individual-level surveillance.
This approach protects employees, reduces employer risk, and keeps the program scalable, because you’re not constantly fighting fires caused by the latest integration, export, or dashboard filter.
A quick self-audit (15 minutes, high yield)
If you want to pressure-test your current wellness setup, run through these questions. You’ll find the real issues fast.
- Is the program tied to the group health plan through incentives, claims, screenings, or eligibility feeds?
- If the employer receives PHI for plan administration, do you have the necessary plan document language and certification in place?
- Do you operate a real firewall between plan administration and employment decision-making?
- Do incentive files avoid health inference (no condition labels, no reason codes, no revealing program names)?
- Are all vendors in the data path appropriately covered (including fulfillment, analytics, and data storage)?
- Do reports suppress small groups and prevent re-identification through filters?
- Do integrations enforce minimum necessary and prevent free-text PHI from flowing into HR tools?
- Do you have an incident response plan for the most common failures (exports, email mishaps, dashboard misconfiguration)?
Bottom line
Wellness program HIPAA compliance is usually about a system that leaks meaning rather than a single bad actor.
Design the program so the employer receives outcomes, not medical explanations. Keep PHI where it belongs. Use aggregate, thresholded reporting to prove value. WellthCare, the first Health-to-Wealth Benefit System, operationalizes this principle by sending employers only neutral incentive outcomes (earned/not earned, dollar amounts, and alternative-standard flags) while keeping all health data inside compliance-controlled plan boundaries. That’s how you build a wellness program employees trust and leaders can defend.