Author: Julie ApplebyÂ
KHN (Kaiser Health News) âa nonprofit national health policy news service that is part of the nonpartisan Henry J. Kaiser Family Foundation.âÂ
Like millions of Americans, Michelle Muckenthaler joined her workplace wellness program this year, answering a bunch of questions about her health habits: What did she eat? How often did she exercise?
Next year, sheâll also face a wellness exam, including tests to measure her cholesterol level, blood sugar and weight. Worried about the privacy of her personal information, she says sheâll opt out, even though she will lose a discount off her premium.
âA $40 a month penalty is not enough for me to want to tell my employer what Iâm doing with my health,â said Muckenthaler, 37, who lives near Denver.
The $6 billion a year workplace wellness industry is booming among employers looking for ways to slow health care spending. But so, too, are concerns about privacy.
Many programs ask detailed health-related questions, and a growing number include medical tests. Some offer workers cash or credits toward insurance discounts if they allow the programs to track their grocery store purchases or the number of steps they take. As the programs delve into ever more sensitive areas â mental health, finances, sleep habits and pregnancy â advocates say existing privacy and anti-discrimination laws fall short.
âI donât think the privacy rules are anywhere close to adequate,â said Anna Slomovic, a lead researcher at the George Washington University Cyber Security Policy and Research Institute.
Existing laws, she and others say, donât cover all wellness programs, allow employers to get personal medical information in some circumstances and havenât kept pace with advances in technology now being used in some programs, including fitness trackers that report information about a wearerâs location, activity level and sleep patterns.
How Is Wellness Data Protected?
Federal law limits the scope of the personal health information that employers can glean from the programs and bars them from discriminating against workers with disabilities. Most employers say they get only aggregated, anonymous data. And consumer advocates cannot point to specific examples where wellness program data was misused by employers or not kept separate from employment-related decisions, such as hiring or firing.
Still, this spring, the Equal Employment Opportunity Commission proposed a new rule warning employers that wellness programs must be voluntary, âreasonably designedâ to improve health and not a âsubterfuge for violating ⌠laws prohibiting employment discrimination.â Last year, the EEOC brought several cases against employers, including one against Orion Energy Systems in Wisconsin where Wendy Schobert worked in the accounting office. Citing privacy and other concerns, Schobert opted out of her workplace program. As a result, she had to pay the full cost of her insurance, plus a $50 a month penalty and was warned not to express her opinions about the program to her co-workers, according to the EEOCâs lawsuit.
Within weeks, the lawsuit noted, she was fired. Orion disputes the allegations in its response to the EEOC.
The case â and another similar one also brought by the EEOC â is still pending.
While those lawsuits and much of the proposed EEOC rule address the definition of what constitutes a voluntary wellness program, the EEOC also took a swipe at adding some privacy protections. The proposal would require employers to spell out specifically what entities can access worker data and only allow employers access to that data mainly in an aggregate form that isnât likely to disclose the identity of individuals.
Advocates, however, say the proposal includes a large loophole: It allows employers to get individual data provided to the wellness programs if needed to administer their health plans. Some advocates say the EEOC hasnât defined clearly what âadministerâ means or why, in any case, the information would be needed.
âIf, by âadminister,â the commission is referring to the ability to surcharge ⌠nonparticipants, there is no need for actual medical information âŚâ wrote David Certner, legislative counsel for the AARP, in one of hundreds of comment letters sent to the government concerning the EEOC proposal. âMore effective firewalls are essential.â
Some point to the Health Insurance Portability and Accountability Act, heralded in 1996 as a big step toward helping consumers keep their personal medical information private, as a firewall. But there are gaps in the protection it provides.
Among other things, it limits what information employers who sponsor group health plans can receive about participants without their specific consent. Additionally, employers whose wellness programs are covered must promise to protect any personal medical information they receive and shield that information from any employees who are not specifically designated to see it. Employers also cannot use the information for employment-related actions.
But privacy advocates say HIPAAâs rules donât apply directly to employers. In addition, wellness programs run entirely by the employer, rather than as part of the employerâs group health insurance plan, are also outside of HIPAAâs purview.
It isnât known how many employers offer wellness programs entirely separate from their group health insurance benefit, although an annual survey of employers by the Kaiser Family Foundation showed that almost half of large employers offer wellness programs outside of their group health benefits. (KHN is an editorially independent program of the foundation.)
Even when consent is sought to gather or share the sensitive data as required by HIPAA, advocates say some wellness programs bury such authorizations in lengthy forms or deem the simple act of logging onto a wellness program website as a workerâs âelectronic signature,â agreeing to the disclosure.
âIn effect, this means employees have no control over their health information,â said Deborah Chalfie, senior legislative representative at AARP.
Finally, advocates say technology and the wellness programs that use them have expanded and advanced beyond what drafters of HIPAA and other anti-discrimination laws envisioned.
To make protections stronger, privacy rules should be extended to all workplace wellness programs, personal information should be deleted if employees stop participating and employers or the vendors they hire to run the programs should clearly spell out how the data gathered from all sources will be analyzed, said privacy researcher Slomovic.
âIf the wellness programs are using food purchase data from an app, and combining it with something else, like your BMI [ an indicator of body fat], you should be able to know that,â she added.
The commission has not set a timetable for finalizing the regulation.
A $40 a month penalty is not enough for me to want to tell my employer what Iâm doing with my health,â Muckenthaler said. (Photo by Barry Gutierrez/For KHN)
A âFunâ Perk To Promote Employee Health
Wellness programs sprang up more than two decades ago, prompted by rising health care costs. While employers are generally barred by the Americans with Disabilities Act (ADA) of 1990 from asking non-job-related health questions, regulations give them a broad exception to do so if the questions or medical exams are part of a voluntary wellness program.
Employers say wellness programs are a fun perquisite that can also alert employees to health issues while providing educational tools to combat preventable illnesses, which might save money over the long run.
âWe donât see individual results for anyone ever. Most employees are comfortable with that,â
said Jennifer Franco, director of employee benefits and programs at utility firm Exelon, where workers can save $500 a year on their health insurance premiums if they fully participate in the wellness program.
At IBM, the companyâs long-running workplace wellness program has recently expanded to consider five âdimensions of health,â including physical, mental and financial health, said Meg Bach, who heads the companyâs health promotion efforts.
âWe have modules on sleep, on positivity, on meeting preparation, the value of taking breaks throughout the day,â said Bach. The sleep module, Bach said, includes materials to evaluate bedrooms to see if they are conducive to rest. A hydration module includes a urine color meter, âso every time a person used the rest room, they could see if they were dehydrated.â
IBM isnât getting information about each employeeâs sleep or hydration levels, Bach says, only aggregate information from their wellness vendors, using it âto make program changes, to make business decisions, to help focus our efforts ⌠in support of the employees.â
Workers sensitive about privacy donât have to participate, Bach said: âAll of the programs are voluntary.â
The Cost Of Not Participating
As the financial stakes rise, however, workers donât always see it that way.
âThe only reason we do it is because of the $600,â said Amanda Hansen, a 59-year-old Maryland resident who works for a software company. She and her husband participate in her employerâs wellness program mainly to get the discount off their premium the company grants for doing so.
Hansen, who uses a wheelchair, says she worries that her personal medical information might get out somehow and, more broadly, about how such wellness programs might affect workers, especially those with disabilities.
âThey ask you questions that are very personal,â Hansen said. âNot only do they get into vital stats on blood counts, but also things that cause you stress and how you sleep.â
Hansen worries that most employees access the program through company computers and websites, so âit would be very easy for that info to get filtered back.â
That concern is echoed by advocacy groups. While laws prohibit discrimination based on disabilities, they note that it is hard to prove.
âOnce an employer knows you have a bipolar diagnosis or diabetes, itâs hard to parse out if it is being used to discriminate ⌠to sort out why you got fired suddenly,â said Jennifer Mathis, director of programs at the Bazelon Center for Mental Health Law, an organization that advocates for people with mental disabilities.
Surveys show that privacy is a concern for some, but many workers, used to sharing all kinds of personal information on websites and elsewhere, are not at all worried. And some see advantages to wellness programs.
âI know for a fact I got healthier,â said Steven Rummel of Forest Park, Ill., who worked for utility firm Exelon until last September and got a free Fitbit and savings on his health insurance for joining its wellness program. âI lost about 15 or 20 pounds.â
Rummel, a 46-year-old data analyst, said heâs not concerned about his personal medical information getting out, partly because the wellness program was run by a third party, not his employer. Even if his former employer got personal information, he said, what could they do with it?
âLetâs say they started firing people with high cholesterol, in which case they would lay off two-thirds of the company and set themselves up for a serious PR disaster or a lawsuit,â he said. âIt just didnât seem plausible.â
Jay Hancock contributed to this story.
jappleby@kff.org | @Julie_Appleby
Source: Kaiser Health NewsÂ