Another Reason to Worry About Health and Wellness

On March 4, 2022, Yale University agreed to settle a class-action lawsuit filed in 2019 by participants in Yale’s “Health Expectations” wellness program (the “Program”) for $1.29 million. This article illustrates some of the problems that may result from a wellness program that is not closely monitored and updated in a rapidly changing regulatory environment.

Wellness Programs

A wellness program is an employee benefit that aims to incentivize its participants to improve their health and fitness voluntarily. While improving your health and fitness is always an admirable goal, employers often implement wellness programs so that the improvements in healthy behaviors reduce the cost of healthcare claims over time. Wellness programs come in several forms and, depending on their design, can be subject to a complex variety of federal laws, including the Employee Retirement Income Security Act of 1974 (“ERISA”), HIPPA, the Genetic Information Nondiscrimination Act of 2008 (“GINA”), and the ADA. The Yale case involved the ADA and GINA, which meant that Yale was allowed to obtain medical or genetic information from employees if they voluntarily participated in the wellness program.

Yale’s Program

Yale’s Program was part of its collectively bargained workplace. As such, the Program required certain union employees and their spouses to either (a) submit to medical inquiries and exams (including mammograms, diabetes screenings, and colonoscopies) or (b) pay $25 per week ($1,300 a year) to opt-out of the Program. If a participant elected to opt-out, the fee was deducted directly from the participant’s paycheck.

A group of current and former Program participants sued Yale, alleging that the amount of the weekly opt-out fee was “unusually punitive”, and violated the ADA and GINA because it made participation in the Program involuntary.

Program participants also alleged that Yale violated HIPAA when it shared the results of the medical exams with its outside wellness vendors without prior authorization. Yale partnered with an outside vendor to review Program participant testing and claims data. The first vendor then shared the resulting data with a second vendor, which paired Program participants with a health coach. The first vendor conducting the data review was a business associate of Yale’s and subject to HIPAA, but the second vendor was not.

As part of the Program, participants were asked to sign a form waiving their HIPAA rights so that information could be shared with the second vendor. However, the first vendor still shared data in some instances where the Program participant did not sign the waiver.

The Settlement

The settlement agreement includes the following key points:

• Yale will pay $1.29 million, which will be divided among employees participating in the Program and the plaintiffs’ attorneys’ fees and costs.
• Yale may continue to offer the Program but will not charge opt-out fees for four years.
• Yale will change its practices regarding the transfer of health information in connection with the Program and will require its affiliated vendors to purge improperly received data.
• Neither Yale nor the second vendor will share participants’ information without a completed HIPAA authorization. Participants actively receiving coaching will have the option to continue receiving coaching (or not) and have their records retained or purged, with no penalty.

Next Steps

Following the Yale settlement, employers should consider taking the following actions:

• Employers should review their wellness program design and governing documents to ensure compliance with HIPAA, GINA, the ADA, and other wellness programs laws.
• The EEOC preliminarily released proposed regulations in early January 2021, but they were never formally published, which the Biden administration subsequently withdrew. Those unpublished January 2021 regulations would have limited specific wellness program incentives to a minimal amount—such as a “water bottle or gift card of modest value.”
• Employers should review their service agreements and business associate agreements with wellness program vendors to address HIPAA compliance adequately.