HHS, Labor, Treasury Release Final Rule on Group Health Plan Wellness Programs
WHAT: Final Rule on Incentives for Nondiscriminatory Wellness Programs in Group Health Plans
WHO: Applies to grandfathered and non-grandfathered group health plans and health insurance issuers in the group market
WHERE: Issued by the Department of Health and Human Services (45 C.F.R. §§ 146.121, 147.110), the Department of Labor (29 C.F.R. §§ 2590.702, 2590.715-2705), and the Department of the Treasury (26 C.F.R. §§ 54.9802-1, 54.9815-2705)
WHEN: Effective for plan and policy years beginning on or after January 1, 2014
WHY: More and more employers are offering wellness programs; compliance with Final Rule and other federal and state laws is crucial to avoid claims of discrimination and other violations
The departments of Health and Human Services, Treasury and Labor have just issued a Final Rule on Incentives for Nondiscriminatory Wellness Programs in Group Health Plans, which will be published in the Federal Register on June 3, 2013. The Final Rule applies to grandfathered and non-grandfathered group health plans—including self-insured health plans—and health insurance issuers in the group market for plan or policy years beginning on or after January 1, 2014. 1
Who Should Pay Attention to the Final Rule? Plan sponsors who offer employee wellness programs must be careful not only to comply with the detailed provisions of the Final Rule regarding the permissible structure of wellness programs and rewards or penalties under such programs, but also must consider how the Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification provisions, implemented through the Privacy, Security and Data Breach Notification Rules, as well as other state and federal laws, may impact the operation of such programs. Consultants and vendors offering products and services relating to employee wellness programs should also understand the requirements of the Final Rule and consider liabilities and obligations that group health plans and insurers may impose on them as HIPAA business associates.
Where Did the Final Rule Come From? The Final Rule implements the Affordable Care Act’s (ACA) modifications of the wellness program exception to HIPAA’s nondiscrimination provisions prohibiting group health plans and insurers from discriminating (e.g., through restrictions on eligibility or higher premiums) against individual participants and beneficiaries based on a health factor. The exception was established in 2006 regulations implementing HIPAA’s nondiscrimination provisions and allowed group health plans and insurers to offer rewards or penalties, up to a certain amount, for participants in wellness programs who satisfy, or fail to satisfy, a health standard. The ACA increased the maximum possible reward or penalty available through a wellness program and made some other minor changes to the exception.
What Can Group Health Plans Do Under the Final Rule? Under the Final Rule, group health plans and insurers may offer two types of wellness programs: participatory wellness programs and health-contingent wellness programs.
Participatory wellness programs must be available to all “similarly situated” individuals without regard to health status. Examples of such programs include reimbursement for gym membership, free health education classes or rewards for completing health assessments with no requirement for further action or follow-up. If a plan or issuer implements a wellness program that does not vary benefits or premiums based on a health factor, the Final Rule is generally not implicated.
Health-contingent wellness programs provide rewards (or impose penalties) based on whether an individual meets a specific health standard. Examples include gift cards for people whose Body Mass Index (BMI) falls within the normal range or increased premiums for smokers. Importantly, health-contingent wellness programs must meet the following five requirements that attempt to ensure that they will not, in fact, discriminate based on health status:
- Annual Qualification. The program must give eligible individuals an opportunity to qualify for the reward at least once per year.
- Reward and Penalty Maximums. The reward (or penalty) must not exceed: (a) 30 percent of the total cost of employee-only coverage under the plan, taking into account both employer and employee contributions towards the cost of coverage for the benefit package under which the employee is (or the employee and any dependents are) receiving coverage; or (b) 50 percent if the program is designed to prevent or reduce tobacco use. The Final Rule increases the reward or penalty in (a) from 20 percent to 30 percent. The Final Rule also provides several examples of compliant and non-compliant reward and penalty structures.
- Reasonable Alternatives. The reward must be available to all similarly situated individuals. The group health plan or insurer must make available a “reasonable alternative standard” (or waive the general standard) to anyone for whom it is “unreasonably difficult” to meet, or try to meet, the general standard. The Final Rule discusses in detail what constitutes a reasonable alternative standard and provides examples.
- Reasonable Design. The program must be “reasonably designed” to promote health or prevent disease and cannot be a “subterfuge for discriminating based on a health factor.” The Final Rule discusses in detail what qualifies as a reasonably designed program.
- Disclosure Obligations. The group health plan or insurer must disclose—in all plan materials that describe the terms of the program—alternatives for obtaining rewards and the possibility of waiver of the alternative standard.
What Else Should I Worry About? Plan sponsors who offer, or are considering creating, wellness programs for employees through the company health plan should be aware of how HIPAA Privacy, Security and Data Breach Rule provisions may impact the operation of the program. The Final Rule notes that HIPAA Privacy and Security Rules (as well as other federal and state laws, including the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA)) may apply to information gathered through such wellness programs. Crucially, information obtained as a result of an employee’s participation in a group health plan wellness program is most likely Protected Health Information (PHI) under HIPAA and may not be disclosed from the group health plan to the employer without proper authorization. For example:
- an employer’s Human Resources department may not be able to list in the company’s monthly newsletter the “biggest losers” in a weight loss program without obtaining a written authorization from each of those individuals
- an employer cannot make staffing decisions based on information about an individual’s alcohol or drug use obtained through a wellness program health risk assessment
- a group health plan may need to provide data breach notifications to affected individuals (and possibly the Secretary of Health and Human Services and the media) if the security of a portal hosting health risk assessments was breached.
In practical terms, this intersection of HIPAA Privacy, Security and Data Breach Rules and the Final Rule means that group health plans and plan sponsors will need to review their policies and procedures, and also that they will need to provide updated training to staff, to make sure that they address information obtained through wellness programs. Additionally, both health plans and consultants or vendors who provide wellness program-related services should determine the need for data privacy compliance programs, and review any existing business associate agreements to ensure that they adequately address the privacy and security obligations relating to information obtained through such programs.
Importantly, while the Final Rule does not apply to workplace wellness programs that are not offered through group health plan coverage, employers who want to incentivize healthy behaviors through rewards and penalties must also consider how other federal laws, including GINA, the ADA and the Employee Retirement Income Security Act (ERISA) may apply to their activities. State laws can also come into play, but employers may be able to avoid those issues by making the wellness program part of their group health benefit plans so that the ERISA would preempt those laws.
What’s Next? The Departments will reportedly issue additional interpretive guidance regarding the Final Rule, and it is possible that further notice and comment rulemaking regarding these issues will be initiated in the future.
Contact Information
If you have any questions concerning this alert, please contact:
| Jorge Lopez, Jr. jlopez@akingump.com 202.887.4128 Washington, D.C. |
John R. Jacob jjacob@akingump.com 202.887.4582 Washington, D.C. |
| Richard J. Rabin rrabin@akingump.com 212.872.1086 New York |
Robin M. Schachter rschachter@akingump.com 310.728.3363 Los Angeles - Century City |
| Jo-Ellyn Sakowitz Klein jsklein@akingump.com 202.887.4220 Washington, D.C. |
Anna R. Dolinsky adolinsky@akingump.com 202.887.4504 Washington, D.C. |
1 Importantly, the wellness program provisions discussed in this alert do not apply to coverage on the individual market. The Final Rule does implement, however, the HIPAA nondiscrimination provisions to non-grandfathered individual health insurance coverage for policy years beginning on or after January 1, 2014.
Authors
