Every benefits leader I meet tells me the same thing: "Our wellness program is fully compliant. HIPAA covers the data, and we only see aggregated reports. We're fine."
I get it. That line is comforting. Vendors promise it. Brokers repeat it.
But the ground has shifted. Wellness programs have quietly become data ecosystems that few employers truly understand. The new risks aren't about a lost laptop or a phishing attack. They are structural, baked into how wellness data moves between vendors, stop-loss carriers, and employers.
When HIPAA Applies, and When It Doesn't
That opening reassurance deserves scrutiny, because it is often wrong. HIPAA applies only to covered entities and their business associates, not to an employer acting as an employer, and whether the rules reach a wellness program depends on how the program is structured. A program the employer runs directly, or one delivered through a vendor that is not a business associate of the group health plan, can sit entirely outside HIPAA. Privacy advocates have documented for years that many wellness vendors are unbound by the law employees assume protects them.
That gap now has a backstop. In July 2024 the Federal Trade Commission amended its Health Breach Notification Rule, effective July 29, 2024, to confirm that makers of health apps, connected devices, and similar products not covered by HIPAA must notify consumers, the FTC, and sometimes the media when unsecured health data is breached. The step-tracking app and the blood-pressure cuff your wellness program hands out now carry a federal breach-notification duty even where HIPAA never applied. For an employer, the practical work is to identify which vendors are HIPAA business associates and which are FTC-covered entities, and to confirm what each contract promises if data leaks.
The Myth of the Safe Aggregate
When an employee completes a health risk assessment or logs a blood pressure reading, the vendor says: "Don't worry. The employer only sees aggregate data, no individual information."
This sounds reassuring. But aggregation does not equal anonymity.
In a small or mid-sized employer, say 300 employees, the "aggregate" report might show that two people in the 45-54 age bracket have elevated HbA1c levels. If your company has only one person in that demographic with a known history of prediabetes, their identity can be inferred. This is called re-identification risk, and it is real and measurable. Privacy researchers treat any cell under five or six people as high risk for re-identification.
The legal standard is whether a reasonable person could be identified from the data, name attached or not. In many wellness programs, the answer is yes, and no one has told the employee.
The Stop-Loss Handshake Nobody Explains
Here's where things get even more uncomfortable.
Most employers with self-funded health plans buy stop-loss insurance to cap catastrophic claims, and that underwriting rests on health status and claims experience. At renewal, carriers require prior claims data and health questionnaires. They can also apply a practice called lasering: assigning one high-cost individual a higher specific deductible than the rest of the group. The carrier has effectively named that person and priced their condition back onto the plan.
Wellness data can reach the same underwriting process. Vendors share de-identified group results with third parties routinely, and de-identified health data can be re-identified when it is joined with claims records the carrier already holds. The biometric readings and health risk scores your program collects are one join away from the file that sets next year's lasers.
The employee's reality: They filled out a health assessment to earn a $50 gift card, believing it was private. In truth, they have silently helped their employer's insurer identify them as a cost liability.
This is not a theoretical risk. It is happening today, buried in vendor contracts and plan renewal documents that no one reads until it's too late.
The Data Perpetuity Problem
Most wellness program consent forms are one-time events. An employee signs a HIPAA authorization at enrollment, and the vendor retains that data, sometimes forever.
What happens when your wellness vendor is acquired by a larger data company? What happens when that company is a pharmacy benefit manager or a life insurer? Your employees' biometric data now lives in a system they never agreed to, used for purposes they never imagined.
The consent form says "for wellness program administration." That phrase is vague, and many vendor agreements already reserve the right to use aggregated or de-identified data for product development, research, and, in some cases, sale to data brokers. Once data is labeled "de-identified," HIPAA imposes no limit on its reuse.
And none of this is communicated to the employee.
The Missing Compliance Layer: Data as Property
We think of privacy as a HIPAA problem. The emerging legal battleground is property rights.
In Illinois, the Biometric Information Privacy Act (BIPA) has already produced multi-million-dollar settlements against employers who collected fingerprints or facial scans without explicit, ongoing consent. A 2024 amendment capped damages at one violation per individual, shrinking the most extreme exposures, but the notice, consent, and retention duties remain in force. While BIPA targets biometric identifiers like fingerprints, the legal reasoning is spreading to health data. Courts are beginning to ask: Does an employee's metabolic data belong to them, even if they voluntarily shared it?
If the answer is yes, then every wellness program that retains, shares, or sells that data without granular consent is facing a class-action exposure that dwarfs typical HIPAA fines.
The Bright Line You Need to Draw
None of this means you should kill your wellness program. Wellness initiatives can improve health and reduce costs. But they must be restructured around a new principle: the employee's data is their asset, not your vendor's inventory.
Here are five concrete actions you can take starting today:
- Map your data handshakes. Identify every third party that touches wellness data: the vendor, the stop-loss carrier, the TPA, the pharmacy benefit manager. Document exactly what they receive and whether it can be linked back to individuals.
- Audit your vendor contract for data sales. Look for phrases like "de-identified data may be used for research or commercial purposes." If it exists, demand removal or an explicit opt-in from each employee.
- Limit data retention. Require your vendor to destroy all clinical wellness data (excluding participation records) within 90 days after the incentive period ends. There is no business justification for keeping last year's HbA1c results.
- Separate participation from results. Pay incentives for completing a health risk assessment, not for achieving a specific biometric target. Once a reward is tied to a specific result, the program involves disability-related inquiries and medical exams under the ADA, which must be voluntary, and the medical information must be kept confidential and stored apart from personnel files. The EEOC's 2016 incentive-limit rules were vacated in court, leaving federal guidance unsettled, so a participation-only program is the cleanest position.
- Educate employees honestly. Stop telling them "your data is anonymous." Tell them the truth: "Your data is pseudonymized and used only for program administration. We do not share individual results with your employer or insurer. You can revoke your authorization, and we delete clinical data within 90 days after the incentive period."
The Bottom Line
Wellness programs were born with good intentions. But the data infrastructure around them has quietly become a risk machine. The employee who steps on a scale and enters a blood pressure reading believes they are participating in a health improvement program. In reality, they may be feeding a data pipeline that ends in a higher insurance premium, an exclusion notice, or a class action lawsuit.
You have the power to rebuild that pipeline. Start with transparency. End with control.
Because the real wellness outcome we should be measuring is trust kept.
This article reflects the views of the author and is not legal advice. Consult your benefits counsel for specific compliance guidance.