Category Archives: HIPAA and HITECH

Benefits Compliance: Where You Get It; What You Need (Poll)

Y01VDYAX63Changes in the law and continued advances in technology have made benefits compliance a constantly shifting landscape.  As one of many potential sources for your own path towards benefits compliance, E for ERISA would very much appreciate your participation in the following poll, which asks a few simple questions about where you currently get your benefits compliance services and what you may still need in that regard.  Thank you in advance for (anonymously) sharing your thoughts and experiences.


















Leave a comment

Filed under 401(k) Plans, 403(b) Plans, Affordable Care Act, Applicable Large Employer Reporting, Benefit Plan Design, Employer Shared Responsibility, ERISA, Federally Facilitated Exchange, Fiduciary and Fee Issues, Fiduciary Issues, Fringe Benefits, Health Care Reform, HIPAA and HITECH, Payroll Issues, Plan Reporting and Disclosure Duties, PPACA, Profit Sharing Plan, Uncategorized

Final Rules on Wellness Program Design: A Chart and FAQs

Recent months have seen a flurry of new guidance related to wellness programs:

  • On May 17, 2016 the EEOC published final regulations and interpretive guidance on wellness programs that include disability-related questions (such as a Health Risk Assessment or HRA) and/or medical examinations (such as biometric testing). The new rules and guidance fall under Title I of the Americans with Disabilities Act (ADA), which permits collection of medical information under an employer’s “voluntary” wellness program. They replace proposed rules and guidance which were published in April 2015. We addressed the proposed rules in an earlier post.
  • In addition, EEOC published in the same issue of the Federal Register final regulations on wellness program participation by employees’ spouses, under Title II of the Genetic Information Nondisclosure Act (GINA). For GINA purposes, health status or health history about a family member, including a spouse, constitutes genetic of the employee. The rule replaces proposed regulations issued in October 2015.
  • In connection with the final rules the EEOC also published a model confidentiality notice to be provided to wellness program participants.
  • Finally, the Internal Revenue Service issued guidance regarding taxation of cash rewards to participate in wellness programs, and reimbursement of premiums paid through cafeteria plan deductions.

Overview. The new ADA and GINA regulations supplement, and in some instances contradict, existing wellness regulations under HIPAA, as modified by the ACA. Most notably, the HIPAA/ACA rules do not impose any incentive limitation on wellness programs that are “participation only,” whereas the ADA and GINA rules do impose a maximum incentive limit if the “participation only” program includes an HRA or biometric testing. The ADA and GINA regulations apply to employers with 15 or more employees, and to wellness programs that are “self-standing” as well as those offered in connection with a group health plan. HIPAA/ACA rules apply only to wellness programs that themselves comprise a group health plan, or that are offered with group health plans.

Effective Dates. The ADA and GINA incentive limits and ADA notice requirement discussed below go into effect for plan years beginning on or after January 1, 2017 (in most cases this will be the year of the health plan to which the wellness program relates). Employers may choose to voluntarily comply with these rules prior to that time. The balance of the new guidance goes into effect immediately, as the EEOC has characterized it as clarification of existing law.

Compliance Chart. Below is a chart summarizing permissible dollar or in-kind incentives for wellness program participation, along with some other requirements under the new ADA and GINA regulations, followed by some frequently asked questions on the new wellness program guidance.


* If multiple health plans are offered, the 30% limit applies to the lowest cost major medical plan. If no plans are offered, the reference point is the premium paid for a 40 year old non-smoker enrolled in the second-lowest silver plan on the health exchange in the employer’s region.

Q.1:     What are reasonable design criteria for wellness programs under ADA regulations? 

A.1:      A wellness program is “reasonably designed to promote health or prevent disease” if it is (a) not highly suspect in the method chosen to promote health or prevent disease; (b) does not require an overly burdensome period of time to participate, involve unreasonably intrusive procedures or significant costs; (c) is not a subterfuge for violating the ADA or other legal requirements or a means to simply shift costs from employer to employees; and, (d) if medical information is collected, the program provides feedback or advice to participants about risk factors or uses aggregate medical data to design programs or treat specific conditions.

Q.2: How do these requirements differ from the requirements for wellness programs under HIPAA/ACA?

A.2: In addition to the differences in incentive limits noted in the chart above, the HIPAA/ACA test applies a reasonable design criteria only to health-contingent wellness programs, while the ADA rules apply to participation-only wellness programs that include HRAs and/or biometric testing.  In addition, the HIPAA/ACA rules require that participants have a chance to qualify for the full incentive at least annually, and must offer to waive incentive criteria, or offer a reasonable alternative standard, to permit equal participation by all similarly situated participants.  This is somewhat similar, but not identical, to the ADA reasonable accommodation requirement.  HIPAA/ACA also requires that notice of the waiver/reasonable alternative standard be provided.

Q.3: Do GINA wellness program regulations add any requirements?

A.3: Yes, if a spouse is requested to complete an HRA or undergo biometric testing, a separate incentive limit equal to 30% of the total cost of self-only coverage applies, and the spouse must sign a written, knowing and voluntary authorization to take part in the HRA or biometric testing.  The authorization must describe the genetic information being obtained (e.g. health history information in an HRA), how it will be used, and any restrictions on its disclosure.  Additionally, employers may not deny access to coverage or otherwise retaliate in the event a spouse refuses to provide HRA/biometric testing.

Q.4: What are the criteria of a “voluntary” wellness program under ADA regulations?

A.4: A wellness program is voluntary for ADA purposes if employees are not required to participate in the program, are not punished for not participating (e.g., not granted access to all health benefits or plan options), and are not subjected to adverse employment action, retaliation, coercion or other prohibited conduct in order to get them to participate, or to reach certain health goals. In addition, incentives are capped at the percentages shown in the chart, and participants are provided with a written notice re: collection and use of medical information.  The EEOC has provided a form of model notice.

Q.5: What does the model EEOC notice state, and is it mandatory or can we use our own version?

A.5: The notice, which should be provided prior to participation in an HRA or biometric exam, may be modified but must be written in language that recipients can understand, and must describe what medical information is collected, what measures will be used to protect its privacy and security, and must state that the information will not be sold, exchanged, transferred, or otherwise disclosed except as necessary and permitted under law in order to implement the wellness program.  Some of the provisions may repeat provisions of an existing HIPAA privacy notice.

Q.6: Can we email the ADA wellness program notice or must we distribute by hand?

A.6: You can email it so long as you are certain the email will reach the intended employees, e.g. through use of a current work email address, and so long as proper attention is brought to the nature of the notice (for instance, do not attach it to an email already containing a number of other, unrelated human resource forms or disclosures). You may also distribute in hard copy.  Your distribution method should take into account employee disabilities such as visual impairment, or learning disabilities.

Q.6: What confidentiality requirements apply under ADA regulations?

A.6: The employer must receive wellness data in aggregate form only, and may not require an employee to agree to the sale, exchange, sharing, transfer or other disclosure of medical information, or to waive ADA confidentiality protections, as a condition for participation.  Note that ADA confidentiality rules would apply to a wellness program not linked to a group health plan, and for a wellness program that is a health plan or is linked to one, HIPAA/ACA privacy, security and breach notification measures must also be followed.  These rules independently would prohibit the employer from viewing individualized health data.

Q.7: What is the impact of “de minimis” wellness incentives such as tee-shirts and water bottles?

A.7: The ADA regulations do not recognize a “de minimis” rule, thus the approximate dollar value of all “in-kind” incentives should be counted towards the 30% incentive limit.  By contrast, for federal income tax purposes, the IRS allows small items such as tee-shirts and water bottles to be excluded from participants’ taxable income as de minimis fringe benefits under Internal Revenue Code (“Code”) Section 132(e).  See IRS Memo 2016-22031, discussed below.

Q.8: How does the IRS treat cash incentives to participate in a wellness program treated under the Internal Revenue Code?

A.8: In IRS Memo 2016-22031 the IRS concluded that cash incentives to take part in a wellness program, or amounts paid or reimbursed for more than de minimis items that do not qualify as Code Section 213(d) medical expenses (such as gym memberships) are included in employees’ taxable income.  The same is true when an employer uses a wellness program to reimburse employees for premium or other coverage amounts withheld from their salary under a Section 125 cafeteria plan.

Q.9: What is the ADA’s  “insurance safe harbor” or “bona fide benefit plan” safe harbor, and can employers use it to justify a wellness program that does not meet the new ADA wellness program criteria?

A.9: The insurance safe harbor or “bona fide benefit plan” safe harbor permits the gathering of health data from employees so long as it is for underwriting or risk classification purposes, e.g., in order to determine insurability or establish premiums and other costs of coverage.   The safe harbor typically would apply to an insurance carrier but also could apply to a self-insured health plan.  In the past several years, a few employers have successfully used the safe harbor to prevail over EEOC federal court challenges to wellness programs that conditioned very high financial incentives on completion of an HRA or biometric testing; see, e.g., Seff v. Broward County, 691 F.3d 1221 (11th Cir. 2012); EEOC v. Flambeau, Inc., 131 F. Supp. 3d 849 (W.D.Wis. 2015).  The ADA regulations expressly make the insurance safe harbor unavailable to employers sponsoring wellness programs, but this does not resolve how the issue will be determined in federal courts.

Q.10: Are there other GINA regulations that impact wellness programs?

A.10: Yes, Title I of GINA applies to health insurance issuers and group health plans (including self-insured health plans), and prohibits requiring an individual to provide genetic information (including through answering a family history question on an HRA) prior to or in connection with plan enrollment, or at any time in connection with “underwriting purposes,” which broadly refers to any provision of a reward or incentive.  As a result of GINA Title I, a plan may use an HRA that requests family medical history only if it is requested to be completed after plan enrollment and is unrelated to enrollment, and if there is no premium reduction or any other reward offered.

Leave a comment

Filed under Affordable Care Act, Americans with Disabilities Act, Benefit Plan Design, Cafeteria Plans, Flex Plans, Fringe Benefits, GINA/Genetic Privacy, Health Care Reform, HIPAA and HITECH, PPACA, Wellness Programs

Proposed EEOC Rules Further Complicate Wellness Program Design

On April 20, 2015, the Equal Employment Opportunity Commission (EEOC) published proposed regulations and interpretive guidance (collectively, “rules”) under Title I of the Americans with Disabilities Act (ADA) applicable to incentive-based wellness programs commonly offered in connection with group health plans.  The new rules add to existing wellness regulations under HIPAA and the ACA, which are published and enforced by the Departments of Treasury, Labor, and Health and Human Services (the “Departments”).

The new guidance primarily impacts wellness programs that condition large financial incentives (or penalties) on employees undergoing biometric testing and/or completing health risk assessments (HRAs).  However it has broader implications – and complications – for all wellness program designs.  Below we explain why certain wellness program designs fall under the ADA, how the EEOC’s proposed rules, if finalized in their current form, would limit design options for these programs, and what employers might consider doing in the meantime.

Wellness Programs Subject to the ADA

As mentioned, the EEOC rules primarily impact wellness programs that provide a high financial reward for merely undergoing biometric testing and/or completing an HRA, or that impose a penalty on employees who choose not to participate in such testing.

This specific plan design is permitted under existing HIPAA/ACA wellness regulations, which aim to prevent discrimination on one or more “health factors,” including a disability, illness, claims experience or medical history.  As we have discussed in an earlier post, those regulations permit employers to tie any size financial incentive or penalty to a wellness program that requires mere participation (“participation-only”), and restrict the incentive (and impose other design criteria) only when the incentive is conditioned on physical activity or attainment of a specific health outcome (“health-contingent”).

The Departments consistently have maintained, however, that satisfaction of HIPAA/ACA requirements does not equal satisfaction of other laws governing wellness programs, including the ADA.  They most recently reiterated this position in ACA FAQ XXV, published on April 16, 2015.  And the EEOC in past guidance has identified biometric testing as a workplace medical examination, and HRAs as containing “disability-related inquiries,” such that participation must be “voluntary” on the part of the employee.   EEOC Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees Under the ADA, Q&A 22. (July 27, 2000).   That guidance clarified that a wellness program is “voluntary” as long as an employer neither requires participation nor penalizes employees who do not participate.  Even since, the EEOC requirement of voluntary participation has been on a collision course with the unlimited financial incentives that HIPAA and the ACA permit under “participation-only” wellness plans.

What was not clear, until publication of the new rules, was the point at which a financial wellness incentive crossed the border from voluntary to coercive, in the eyes of the EEOC.   Employer uncertainty on this point reached a crescendo in the latter part of 2014, when the EEOC brought three separate enforcement actions against employers whose “participation only” wellness programs included biometric testing and HRAs, but met applicable HIPAA/ACA design guidelines for same.  In the third and most prominent action, against Honeywell, the wellness program imposed a potential annual surcharge of up to $4,000 on employees who refused, along with their spouse, to undergo biometric testing including a blood draw, performed by a third party vendor.  The federal court rejected the EEOC’s attempt to stop Honeywell’s use of the program, but the case had a “chilling effect” on employers whose wellness programs followed similar designs.

Proposed Design Restrictions

Under the proposed EEOC rules, an incentive or reward under a wellness program that includes biometric testing and/or an HRA crosses the line from voluntary to coercive when it exceeds a dollar amount equal to 30% of the total cost of employee-only health coverage (employer and employee contributions, combined).  An additional incentive or penalty of up to 20% may be imposed in exchange for the employee disclosing whether or not they use tobacco, but not in exchange for blood testing for nicotine or cotinine.  Most significant, this cap on incentives applies to biometric testing and HRAs (or to other forms of medical examination or disability-related inquiries under a wellness program) even when the program is “participation-only” under HIPAA/ACA rules.  Note that only employers with 15 or more employees are subject to Title I of the ADA; smaller employers are outside the EEOC’s jurisdiction.

By contrast, the HIPAA/ACA rules apply these limits only to health-contingent wellness programs, and also permit the maximum percentage limits to apply to the cost of dependent coverage when the wellness program allows participation by dependents.  The EEOC rules do not address dependent participation, most probably because their jurisdiction is limited to the employer-employee relationship.  Nor do they address whether participation by spouses in biometric testing/HRAs triggers concerns under the Genetic Information Nondisclosure Act, or “GINA.” The EEOC did take this position in the Honeywell case, however, and in the new guidance reserves the topic for future comment.

In addition to the cap on incentives, the EEOC rules would also impose other criteria for “voluntariness” on wellness programs that include biometric testing/HRAs, including that:

  • the employer may not require participation in the wellness program;
  • the employer may not deny access to health coverage (other than through imposition of the permitted reward/penalty percentage) to those who do not participate; and
  • the employer may not take adverse employment action or otherwise retaliate against employees who do not participate, or who participate but do not attain a desired health outcome.

Additionally, for all wellness programs that are used in conjunction with a group health plan, whether or not they include biometric testing/HRAs, employers must provide a written notice explaining what medical information will be obtained under the wellness program, how it will be used, and the restrictions on disclosure that apply, including HIPAA privacy and security rules.  Note that this is in addition to the notification of reasonable alternative methods of attaining a wellness reward that the HIPAA/ACA rules require be included in all health-contingent wellness program materials.

The EEOC rules also impose confidentiality requirements on all wellness programs, not just that include biometric testing/HRAs, and further require that wellness programs be “reasonably designed to promote health or prevent disease.”  The EEOC confidentiality and reasonable design rules are quite similar to existing requirements under HIPAA/ACA regulations, with the following modifications:

  • The EEOC confidentiality rules require that medical information be disclosed to employers only in aggregate form, except as is necessary to administer the health plan.
  • The EEOC reasonable design rules would apply to participation-only wellness programs; under HIPAA/ACA regulations they only apply to health-contingent programs.
  • The EEOC reasonable design rules would require that a wellness program that collects medical information (such as through biometric testing) provide follow-up information or advice with regard to health issues.
  • The EEOC reasonable design rules would prohibit wellness programs that require an overly burdensome investment of time in order to attain an incentive, involve unreasonably intrusive procedures, or act primarily to shift health costs onto employees.

Finally, the EEOC rules require that all wellness programs satisfy reasonable accommodation requirements under the ADA.  Under existing HIPAA/ACA regulations, accommodation (in the form of an offer of alternative ways to attain a reward) is only expressly required for health-contingent wellness programs.  The example given is provision of a sign language interpreter to allow a hearing-impaired employee to attain a reward by taking part in nutrition classes.

What to Do Now  

It is likely that the EEOC will receive a large number of public comments on the proposed regulations and guidance.  They have asked for comments on a number of points in addition to the proposed guidance, including whether wellness incentive limits should link to the ACA concept of “affordable” coverage.

Public comments are due on June 19, 2015 and it may take some time for the EEOC to incorporate them into final regulations and guidance.  Although compliance with the proposed rules is optional in the meantime, the standards they outline likely will function as a “safe harbor” from challenge on ADA grounds, such that risk-averse employers may want to take steps to comply with them proactively.    In the interim, employers can also expect business lobbies to challenge the dual standard the EEOC rules would impose on several aspects of participation-only wellness programs. (A House bill that would insulate ACA/HIPAA compliant wellness incentives from attack under GINA or the ADA was proposed before the EEOC rules were published.)  All employers maintaining wellness programs should consider distributing the notice re: wellness program data collection, use and privacy, and should work with their wellness vendors and benefit advisors to craft the appropriate language.   Pending further guidance on whether participation by family members triggers GINA concerns, it seems premature to eliminate, or modify wellness incentives for participation by spouses and dependents.

Leave a comment

Filed under Affordable Care Act, Benefit Plan Design, HIPAA and HITECH, PPACA, Wellness Programs

Summary Chart of Disallowed Pay or Play Tactics

With the January 1, 2015 employer shared responsibility deadline fast approaching, the three government agencies charged with ACA compliance (IRS, DOL and HHS) have provided recent guidance on several strategies or tactics that have been marketed to applicable large employers as legitimate ways to reduce their coverage costs and exposure to shared responsibility penalty taxes (assessable payments).   Employer reimbursement of individual health insurance premiums is a common but not universal feature of these arrangements.  The Internal Revenue Service ruled out pre-tax reimbursement of individual health premiums in Notice 2013-54, but more recent guidance in ACA FAQ XXII and in IRS Notice 2014-69 expands the prohibition to include after-tax individual premium reimbursements, as well as other shared responsibility cost reduction strategies.  The chart attached below summarizes:

  • the disallowed strategies;
  • the reasons why they were disallowed;
  • the penalties that may apply to applicable large employers that persist in pursuing these strategies; and
  • other relevant facts and concerns.

Disallowed Tactic Chart

As with all content provided on this blog, the chart is meant to serve as a general summary of legal developments and the information it contains should not be applied to any particular factual situation without first consulting experienced tax or benefits counsel.


Filed under Affordable Care Act, Benefit Plan Design, Cafeteria Plans, Employer Shared Responsibility, ERISA, Flex Plans, Health Care Reform, HIPAA and HITECH, PPACA

Final Wellness Regulations Expand Employer Compliance Duties

On June 3, 2013, the departments of the Treasury, Health and Human Services, and Labor (the “Agencies” or “Departments”) published final regulations defining how wellness programs may comply with the Affordable Care Act’s prohibition against discrimination based on one or more “health factors,” a term that includes an individual’s health status, medical condition, disability, and claims experience. The final regulations make some significant changes to proposed wellness regulations published in November 2012, which were the subject of an earlier post on this blog.  I outline the key changes, which take effect for plan or policy years[1] beginning on or after January 1, 2014, in the following Frequently Asked Questions list.

Q. 1.       What is the most significant change the final regulations make to wellness program compliance duties?

A.1.     The final regulations treat certain wellness programs that formerly were classed as “participatory-only” programs as “health contingent” programs that must meet five criteria designed to permit individuals with health limitations to still qualify for the wellness reward.  Examples include walking programs or other programs that do not require that employees attain a specific result, but that do require their physical participation or other activity that may be ruled out by health issues.

Q. 2.       How do the final regulations change the terminology of wellness programs?

A. 2.    As referenced above, wellness programs generally were classed in two categories: “participatory” or “participation only” programs that merely required the employee to take part in wellness programs and activities in order to attain the related reward, and “results-based” programs that conditioned a reward on the employee meeting a standard or criteria that is related to a health factor, such as actually reducing Body Mass Index (BMI) or blood pressure readings.  The proposed regulations introduced the term “health-contingent wellness programs” to replace “results-based” programs (which was never an official regulatory term to begin with), but did not change the definition of participatory plans.  The final regulations retain the participatory category, but break the “health contingent” category down into two sub-categories:  “activity-only” health-contingent wellness programs – many of which formerly met the “participatory-only” category, and “outcome-based” health-contingent wellness programs, as follows:

Q. 3.       How do the final regulations define “activity-only” health-contingent wellness programs?

A. 3.    An activity-only health contingent wellness program requires an individual to perform or complete an activity related to a health factor in order to obtain a reward, but does not require the individual to attain or maintain a specific health outcome.  Examples include walking, diet or exercise programs, which some individuals may be unable to participate in or complete, or have difficulty in doing so, due to health factors such as asthma, pregnancy, or recent surgery.

Q. 4.       How do the final regulations define “outcome based” health-contingent wellness programs?

A. 4.    An outcome-based health-contingent wellness program requires an individual to attain or maintain a specific health outcome, such as smoking cessation, or reducing BMI or blood pressure below a set threshold, in order to obtain a reward.  As the regulations explain, however, such programs usually contain an “activity-only” subcomponent for individuals who do not attain the desired health outcome.  For instance, if the program provides a reward to employees who reduce their BMI or blood pressure by a set amount, employees who, for health reasons, cannot or should not attempt to attain those results may receive the same reward by participating in a walking program or by attending healthy cooking classes.  As a consequence, the special rules for activity-only health-contingent wellness programs generally will apply to that subcomponent of outcome-based health-contingent wellness programs.

Q. 5.       When is a participation-only or “participatory” wellness program nondiscriminatory under the final regulations?

A. 5.    A participatory wellness program – such as a program that provides a 10% reduction in premiums to employees who take part in biometric testing, without any required result – is nondiscriminatory provided that it is made available to all similarly situated individuals, regardless of health status.  The “similarly situated” rule permits differences among “bona fide employment-based classifications” such as work location, union versus non-union, etc.   There is no dollar or percentage limit on financial rewards for taking part in a participatory-only wellness program.

Q. 6.       When is a “health-contingent” wellness program nondiscriminatory under the final regulations?

A. 6.    All health-contingent wellness programs – whether activity-only or outcome-based, must meet five separate requirements designed to make wellness rewards attainable regardless of health factors such as disabilities or medical conditions.   The five criteria are: (a) that employees be able to qualify for the reward at least annually; (b) that the financial reward not exceed certain thresholds, as applied to the total premium cost for individual coverage; (c) that the wellness program be reasonably designed to promote health or prevent disease; (d) that the wellness program be made available to all similarly situated individuals, including through waiver of the health goal or offer of a reasonable alternative means of attaining the reward when health factors present an obstacle; and (e) that all written plan materials disclose the availability of other means of qualifying for the reward. These criteria are found in final nondiscrimination regulations under HIPAA from 2006 as well as in Section 2705(j) of the Public Health Service Act, which was incorporated into the Affordable Care Act (ACA § 1201(4)).  Most of the changes in the final regulations involve criteria (d), which is referred to below as the “universal availability/reasonable alternative standard” requirement.

Q. 7.       What is the maximum financial reward that a health-contingent wellness program may provide?

A. 7.    Under current law the maximum financial reward is an amount equal to 20% of the total premium cost (employer and employee portions) for individual coverage under a group health insurance policy or self-funded plan. (The percentage may be based on family or self plus one coverage costs only to the extent that the added spouse/dependents may participate in the results-based wellness program.[2])   For plan or policy years beginning on or after January 1, 2014, the final regulations increase the maximum to 30% of the total premium cost.  An additional 20% incentive is allowed (for a total incentive of 50%) but only if it is offered in connection with a program that reduces or stops tobacco use.  Employers must be sure that their results-based wellness program incentives do not exceed the 30% and 50% thresholds either separately or when added together.  Examples are described in my earlier post on the proposed regulations.

Q. 8.       What special requirements apply to activity-only, health-contingent wellness programs?

A. 8.    The five criteria listed above all apply, but special rules apply under the universal availability/reasonable alternative means requirement, as follows:  The program must either waive the activity requirement, or offer a reasonable alternative standard for obtaining the reward, for any individual for whom it is either (a) unreasonably difficult due to a medical condition to participate in the activity or (b) medically inadvisable to attempt to do so.  For example, for individuals recovering from hip replacement surgery, a requirement to participate in a walking program would need to either be waived, or a substitute offered.  The following additional rules apply:

  • Employers do not need to “pre-design” reasonable alternative standards but instead  may design them once an employee requests alternative standards.
  • If the reasonable alternative standard is completion of an educational program, the employer must make the educational program available or assist the employee in finding such a program, and may not require the individual to pay for the program.
  • The time commitment must be reasonable.  The regulations state that requiring attendance at a nightly one-hour class would not be reasonable.
  • If the reasonable alternative standard is a diet program, the employer does not need to pay for the cost of food but must pay any membership or participation fee.
  • If the reasonable alternative standard that is offered meets the definition of an activity-only wellness program, it must independently comply with the five requirements, including the universal availability/reasonable alternative standard criteria, as if it were a self-standing program.
  • If the reasonable alternative standard that is offered meets the definition of an outcome-based wellness program, it must independently satisfy the five requirements, including the universal availability/reasonable alternative standard criteria, as if it were a self-standing program.

Q. 9.       What special requirements apply to outcome-based, health-contingent wellness programs?

A. 9.    The five criteria listed in response to Q. 5 all apply, but special rules apply under the universal availability/reasonable alternative means requirement, as follows:  The program must either waive the required health outcome, or offer a reasonable alternative standard for obtaining the reward, for any individual for whom it is either (a) unreasonably difficult due to a medical condition to attain the health outcome or (b) medically inadvisable to attempt to do so.  For example, a requirement to lower blood pressure below a certain threshold would need to either be waived, or a substitute offered, to individuals with chronic hypertension.  The following additional rules apply:

  • Employers do not need to “pre-design” reasonable alternative standards but instead may design them once an employee requests alternative standards.
  • If the reasonable alternative standard is completion of an educational program, the employer must make the educational program available or assist the employee in finding such a program, and may not require the individual to pay for the program.
  • The time commitment must be reasonable.  The regulations state that requiring attendance at a nightly one-hour class would not be reasonable.
  • If the reasonable alternative standard is a diet program, the employer does not need to pay for the cost of food but must pay any membership or participation fee.
  • The reasonable alternative standard cannot be a requirement to meet a different level of the same standard without additional time to comply that takes into account the individual’s circumstances.  The final regulations use an example of an initial standard of reducing BMI below 30, and state that a reasonable alternative standard cannot be to achieve a BMI less than 31 on the same date that the original standard was required.  Instead, reducing BMI by a small amount or percentage over a realistic period of time, such as a year, is a permitted alternative goal.
  • An individual must be given the opportunity to comply with the recommendations of the individual’s personal physician as a second reasonable alternative standard to meeting the reasonable alternative standard defined by the plan, but only if the physician joins in the request.  The individual can make a  request to involve a personal physician’s recommendations at any time and the personal physician can adjust his or her recommendations at any time, consistent with medical appropriateness.
  • If the reasonable alternative standard that is offered meets the definition of an activity-only wellness program, it must independently comply with the five requirements, including the universal availability/reasonable alternative standard criteria, as if it were a self-standing program.
  • If the reasonable alternative standard that is offered meets the definition of an outcome-based wellness program, it must independently satisfy the five requirements, including the universal availability/reasonable alternative standard criteria, as if it were a self-standing program.

Q. 10.    When may an employer request verification, from an employee’s medical provider, that health factors prevent the employee from earning a reward under a health-contingent wellness program?

A. 10.  Employers may request such verification only in connection with activity-only wellness programs (or in connection with activity-only subcomponents of outcome-based wellness programs).  The proposed regulations would have permitted employers to make such requests whenever it was “reasonable under the circumstances” to do so, but the final regulations conclude that it is never reasonable to require verification that an employee’s inability to attain, or attempt to attain, a specific health outcome is based on one of the enumerated health factors such as a medical condition or disability.  As mentioned, however, if an employee who cannot attempt to lower his or her blood pressure under an outcome-based program is offered the alternative of a walking program or other activity-only program, an employer may request verification that a health factor prevents the employee from taking part in the walking program, as it is an activity-only subcomponent of the outcome-based wellness program.  Under the final regulations, verification requests still must be “reasonable under the circumstances,” and further must be sought only when it is “reasonable to determine that medical judgment is required to evaluate the validity of the request” for a reasonable alternative standard.

Q. 11.    How do the final wellness regulations increase the role and authority of employees’ personal physicians?

A. 11.    The proposed regulations limited the role of an employee’s personal physician to that of rebutting the alternative compliance methods recommended, under a health-contingent wellness program, by a medical professional hired or employed by the employer.  The final regulations permit an employee’s personal physician to prescribe reasonable alternative standards for earning a wellness reward in any instance where original health-contingent program standards are deemed to be medically inappropriate for an employee, including, but not limited to, instances in which the plan or employer’s medical professional has recommended an alternative method.  As described above, outcome-based wellness programs also must include, as a second reasonable alternative standard (in place of the reasonable alternative standard proposed by the plan), the opportunity to comply with recommendations of the employee’s personal physician.  Employees in outcome-based programs also may request to involve a personal physician’s recommendation at any time, and if the physician agrees to participate he or she may adjust recommendations at any time consistent with medical appropriateness.
Regular insurance co-pays or costs will apply to medical items and services furnished in accordance with the physician’s recommendations.[3]

Q. 12.    Must health-contingent wellness programs provide a never-ending series of reasonable alternative standards?

A. 12.  No.  This was a possible interpretation of the preamble to the proposed regulations, which stated that employers must continue to offer alternative standards despite a low success rate, particularly where addictive behavior is involved, and which gave the example of offering different weight loss programs or different nicotine replacement therapies when predecessors failed to have an effect.  The final regulations make clear that employers need not get caught in an endless cycle of suggesting alternative standards, and introduce two new requirements for outcome-based programs designed to shortcut the reasonable alternative standard process.  These requirements are described more fully in Q&A 9, above; the first requirement is that a reasonable alternative standard cannot be a requirement to meet a different level of the same standard without additional time to comply that takes into account the individual’s circumstances, and the second is that the individual be given the opportunity to comply with the recommendations of the individual’s personal physician in lieu of meeting an alternative standard set by the program or a program physician.

Q. 13.    How do the final regulations change the notice requirements for wellness programs?

A. 13.  The proposed regulations contain several alternative model notices that reasonable alternative standard will be offered to individuals who cannot attain health-contingent program goals, and required that the notice be set forth in all written materials that describe a wellness program, but not to materials that simply make reference to the existence of the program. For instance, it need not be set forth in the Summary of Benefits and Coverage document (which is provided by carriers to employers with insured plans).  The final regulations maintain the notice requirement but add to the model notice language reference to the role that personal physicians may play in designing reasonable alternative standards, as follows:

“Your health plan is committed to helping you achieve your best health.  Rewards for participating in a wellness program are available to all employees.  If you think you might be unable to meet a standard for a reward under this wellness program, you might qualify for an opportunity to earn the same reward by different means.  Contact us at [insert contact information] and we will work with you (and, if you wish, with your doctor) to find a wellness program with the same reward that is right for you in light of your health status.”

Q. 14.    Do the final regulations expand on notice requirements for wellness programs?

A. 14.  Arguably, yes.  A footnote to the preamble provides that, if compliance with a wellness program affects premiums, cost sharing, or other benefits under the terms of a group health plan, then the wellness program terms (including the availability of any reasonable alternative standard) are generally required to be disclosed in governing plan documents as well as in the summary plan description (SPD).  This is not a new rule as much as it is a valid interpretation of the required contents of an SPD, including a description of employee contributions (which are impacted by wellness program participation).  However group health plan documents and SPDs – particularly for fully insured group plans – do not always integrate wellness program terms with the provisions for employee contributions and cost sharing.  As a result, many employers will need to revisit their group health plan documentation and revise as necessary to describe the impact of wellness program participation.

Q. 15.    Do the final regulations shed any light on when or whether a wellness program is “voluntary” as required under the Americans with Disabilities Act?

Q. 15.  No.  Clarification on this topic will have to come from the Equal Employment Opportunity Commission (“EEOC”), which regulates compliance with the Americans with Disabilities Act.  EEOC has not yet clearly defined what makes a wellness program “voluntary” or not, but did recently hold a meeting at which business and advocacy groups spoke to the issue and urged the Commission to provide guidance on this point without future delay.

Q. 16.    What can be done when smoking cessation/reduction rewards are provided to an employee who is later found to have lied about stopping or reducing smoking?

A.16.   The Affordable Care Act prohibits rescission of coverage under any group or individual plan other than instances of fraud or misrepresentation of a material fact.  With regard to small group and individual policies subject to the tobacco rating surcharge, insurance market reform regulations prohibit rescission on the basis of misrepresentation of smoker status, but permit the plan to seek recovery of premium amounts that would have been paid to the plan if the employee had provided accurate information about tobacco use.  It is possible that future guidance will address the rescission remedy in this context for large group and self-funded plans, but a footnote to the regulations states that the Departments view is that misrepresentation of this type would not be a “material” fact that would trigger rescission, because the lesser remedy of recouping premiums is available.  Please note that the right to recoup the surcharge would need to expressly be permitted in the governing health plan documentation and would otherwise need to be carried out in compliance with ERISA.  State wage and hour laws may prevent or limit the use of payroll deductions to recover the surcharge amounts.  In a related note, final insurance market reform regulations published in February 2013 propose a definition of “smoking” as use of tobacco on average of four or more times per week within a period no longer than the prior six months.

Q. 17.    Are all wellness programs subject to the final regulations?

A. 17.  The final regulations apply to wellness programs that are teamed with small and large group health plans, whether grandfathered or non-grandfathered, insured or self-funded.  They do not apply to wellness programs teamed with individual health insurance policies.  The 50% maximum wellness incentive that includes a smoking cessation or reduction program teams with the tobacco use surcharge (up to 50% of the applicable premium) that applies in the small group market beginning in 2014, such that tobacco users who participate in the cessation or reduction programs can cancel out the effect of the surcharge.  The surcharge would apply to large group plans only when such plans are offered on an exchange; in California this would pertain to plans with more than 50 participants and only in 2016 and subsequent (the California exchange is closed to groups of more than 50 in 2014 and 2015.)

[1] As wellness programs generally do not comprise self-standing group health plans, the applicable plan or policy year is that of the group health plan to which the wellness program relates.

[2] The regulations do not provide direct guidance on how to apportion the reward among employee family members when they are allowed to participate in wellness programs, but the Agencies will likely issue future “soft” guidance – for instance in the form of an FAQ – on that topic in the future.

[3] The final regulations do not directly address the privacy concerns under GINA, HIPAA and comparable state laws, raised by the personal physician’s increased role in wellness program design.

Leave a comment

Filed under Affordable Care Act, Benefit Plan Design, GINA/Genetic Privacy, HIPAA and HITECH, PPACA, Wellness Programs

New Rules on 90-Day Waiting Period Limitation Announce End of “Certificates of Creditable Coverage”

Proposed Regulations published in the Federal Register on March 25, 2013 explain how the maximum 90-day limitation on waiting periods will operate under employer-sponsored group health and insured individual health plans, beginning January 1, 2014.   The rules, set forth in Section 2708 of the Public Health Service Act (PHSA), apply to insured and self-funded group health plans, and to individual insured coverage, and apply equally to grandfathered and non-grandfathered plans.

The Proposed Regulations on waiting periods is consistent with earlier guidance issued in the form of IRS Notice 2012-19, which I summarized, in FAQ format, in this earlier post.   For your convenience, however, the key provisions of the regulations are set forth below:

  • The Proposed Regulations define a waiting period consistent with prior HIPAA regulations, as “the period that must pass before coverage for an employee or dependent who is otherwise eligible to enroll under the terms of a group health plan can become effective.”
  • Once eligibility requirements are met, coverage must begin once 90 calendar days, including weekend and holiday days, have elapsed.  If the 91st day falls on a weekend or holiday, the carrier or plan sponsor may elect to have coverage to be effective earlier than the 91st day, for administrative convenience, but may not delay coverage past the 91st day.
    • This means that the popular eligibility provision under which coverage begins 90 days after the first day of the first month following the date of hire is no longer permissible.  The new safe harbor is to ensure that coverage begins no later than 60 days after the first day of the first month following the date of hire.
    • As was described in Notice 2012-59, an employer or issuer has fulfilled the 90-day waiting period limitation so long as an employee can elect to begin coverage no later than 90 days after satisfying eligibility criteria, even if the employee is late in completing and submitting enrollment materials.
      • The Proposed Regulations describe, as permissible, language calling for coverage to begin “on the first day of the first payroll period on or after the date an employee is hired and completes the applicable enrollment forms,” provided that enrollment materials are provided to the employee on his or her start date and can reasonable be completed within 90 days.
      • In provisions mainly applicable to group health plans, whether self-funded or insured, a plan may impose eligibility criteria such as completion of a period of days of service (which may not exceed 90 days), attainment of a specific job category, or other criteria, so long as they have not been designed to avoid compliance with the 90-day waiting period.
        • As an example, a plan provides coverage only to employees with the title of sales associate.  Sarah is hired on October 17, 2014 as a junior sales associate.  On April 3, 2015, she is promoted to sales associate.  She must be offered coverage no later than July 3, 2015.
        • When a plan conditions eligibility on a cumulative service requirement, such as completion of a set number of hours of service, the hours-of-service requirement must not exceed 1,200.
        • When a “variable hour” or seasonal employee is hired – i.e., someone who cannot be classified as full-time (30 or more hours per week) or part-time, an employer is allowed to classify the employee as full-time (or not full time) over a measurement period not to exceed 12 months, consistent with proposed regulations on employer shared responsibility duties.   If the employee is determined to be full-time at the end of the measurement period, an employer will be deemed to have met the 90-day waiting period limitation period if the employee enters the plan no later than 13 months from the employee’s start date, plus the time remaining until the first day of the next calendar month (in instances when the employee’ start date is not the first day of a month).
      • The Proposed Regulations are effective for plan years beginning on or after January 1, 2014, however elimination of the requirement to provide Certificates of Creditable Coverage has a later effective date of January 1, 2015, as discussed below.
        • For employees who are in a waiting period for coverage when the Proposed Regulations go into effect on January 1, 2014 , the 90-day maximum period is applied to the entire waiting period, including time “served” prior to January 1, 2014.  The Regulations use an example of a calendar year plan with a 6-month waiting period and an employee hired on October 1, 2013, and require that that person be offered coverage no later than January 1, 2014, which is 93 days after her start date, because otherwise the plan would be applying, on January 1, 2014, a waiting period that exceeds 90 days.   The Regulations specify, however, that coverage is not required to be made effective before January 1, 2014.
        • The proposed regulations do not provide an example using a fiscal year plan, but presumably the same rule would apply to employees in a waiting period for coverage as of the start of the 2014-2015 fiscal plan year.
      • Notice 2012-59 stated that employers and insurance carriers could rely on its guidance through the end of 2014, and the Proposed Regulations take the position that they are consistent with, and no more restrictive than, the provisions of Notice 2012-59.  Accordingly, compliance with the terms of the Proposed Regulations will constitute compliance with Section 2708 of the PHSA at least through 2014.  If final regulations are more restrictive, they will not take effect prior to January 1, 2015.
      • Applicable large employers must be mindful that compliance with the 90-day waiting period limitation does not insulate them from penalty taxes under employer shared responsibility rules going into effect January 1, 2014.  For instance, a “full-time” employee (30 hours or more/week) who is required to complete 1,000 hours of service to meet plan eligibility rules may qualify for financial aid on a health exchange/marketplace while such eligibility period is met, even if the waiting period which follows does not exceed the 90-day maximum.

One significant change the regulations announce is that the “Certificates of Creditable Coverage” required under Title I of HIPAA will be phased out by 2015, having been made obsolete by the Affordable Care Act’s prohibition on exclusions from coverage due to pre-existing health conditions.  HIPAA limits exclusions from coverage due to a pre-existing condition to a maximum of 12 months (18 months in the case of special enrollment) which periods are reduced, month-for-month, by proof of prior “creditable coverage” under a group or individual health plan or policy.  Such proof takes the form of Certificates of Creditable Coverage.   The Affordable Care Act wholly eliminated the “pre-ex” condition exclusion for dependent children up to age 19 for plan years beginning on or after September 23, 2010, and the exclusion fully will be repealed for group or individual health plans with plan or policy years beginning on or after January 1, 2014.  Elimination of the pre-ex condition exclusion eliminates the need for Certificates of Creditable Coverage.

However, it will remain necessary for employer sponsors of self-funded group health plans, and for insurers, to continue to provide Certificates of Creditable Coverage through to December 31, 2014, to allow individuals joining plans in 2014 that have non-calendar plan years to avoid or reduce application of a pre-existing condition exclusion.  The agencies issuing the Proposed Regulations (IRS, DOL, Health and Human Services) invite public comment about those proposed applicability dates.



Leave a comment

Filed under 90-Day Waiting Period, Affordable Care Act, Employer Shared Responsibility, Health Care Reform, HIPAA and HITECH, PPACA, Pre-Existing Condition Exclusion

Stanford Health Privacy Breach Highlights Downstream Vendor Risks, Issues

In an earlier post I described a HIPAA privacy breach that occurred when a spreadsheet detailing the emergency room treatment of nearly 20,000 patients of Stanford Hospital was posted online, for the better part of a year, at a “homework for hire” website, The New York Times has published an article tracing the breach to a job applicant who received the spreadsheet from a one-person marketing agency hired by the Hospital’s third party billing contractor.

The spreadsheet was originally transmitted in encrypted format from the Hospital to the marketing agent, who had represented himself as a vice-president of the billing contractor and was in fact the hospital’s main contact for the billing contractor. In fact, he was not an executive of the billing contractor, but the billing contractor nonetheless condoned his use of that title in order to get access to various health executives and generate customers for its billing services. The marketing agent unencrypted the spreadsheet and provided it to the job applicant with the request that she demonstrate her skills converting it to bar graphs and charts. Without recognizing that the names and treatment codes on the spreadsheet were “real world” data, the job applicant then sought help with the assignment by posting the spreadsheet on, where it was discovered almost a year later by the parent of a Hospital patient named in the chart.

In other words, the breach was not attributable to a Hospital employee, or an employee of the Hospital’s business associate, the billing contractor, but to a “downstream vendor” or “subcontractor” of the billing contractor, and not even to an employee of the downstream vendor but to a mere job applicant. One of the patients disclosed in the spreadsheet has since sued Stanford Hospital and the billing vendor in L.A. County Superior Court, seeking damages of $1,000 for each of the 20,000 affected individuals.

This is a frightening object lesson for covered entities – the Stanford Hospitals of the world – and for business associates such as the billing contractor – about the risks presented by “downstream” vendors, and the need to ensure that their handling and use of protected health information and e-PHI meets HIPAA and applicable state law privacy and data security standards. HIPAA as amended by HITECH now demands that business associates vouch in this manner for their downstream vendors in their business associate agreements. Clearly, to do so, the parties first must clearly identify downstream vendor relationships, and not disguise the vendor’s staff as business associate employees, as occurred in the Stanford case. Even where the vendors clearly are identified, business associates should also address, in business associate agreements, whether the covered entity can share data directly with the downstream vendors, and if so, under what conditions. The Stanford case is unusual due to the disguising of the marketing agent’s true status, but it suggests that business associates might always want to be at least notified of such communications, if this is administratively practical. Or, they might want to vouch for privacy/security compliance only when data passes through them to the downstream vendor, but require the covered entity to be responsible for breaches resulting from its direct communications with the downstream vendors.

Trying to stay ahead of the technological curve in data transmission is almost impossible, but we can learn from others’ mistakes and take whatever steps are necessary not to repeat them.

Leave a comment

Filed under HIPAA and HITECH