7 ms·

If the wellness program is offered as part of a group health plan, then the wellness-plan provider is a business associate of a covered entity under HIPAA, and

by HillRat 11y ago

If the wellness program is offered as part of a group health plan, then the wellness-plan provider is a business associate of a covered entity under HIPAA, and PHI protection applies. So in these cases, the employer cannot have access to individual employees' health information and, more to the point, they usually don't want it -- they're trying to cut overall costs, not individual employees. Having said that, I do think that more robust legislative firewalls are needed to prevent companies from trying to push the envelope in accessing individual employees' records (HIPAA controls covered entities' actions, but not employers').

braythwayt 11y ago
Thank you for the elucidation. This is the kind of quality reply that makes HN great.
Lawtonfogle 11y ago
The problem is that you do have employers wanting to target individual employees and that just because something is illegal doesn't mean it won't happen. An employer could use this to identify what employees are about to become pregnant and then find reasons to fire them. And given that being fired is likely to change their chance of choosing to become pregnant, it becomes significantly harder to prove this was an illegal targeted attack instead of a justified firing of an employee who was violating policy (and given how policies are written, workplace policies are treated like laws these days where everyone is violating some policies and they are only selectively enforced). Add in that this is most likely to be deployed against lower income people if it is deployed, and that those it is deployed against will be in a very poor condition to fight back (hiring a lawyer right after losing a job isn't something most can afford), you have a nasty discrimination disaster ready to happen (or in reality, ready to be made worse than it currently is).
- Retric 11y ago
  Policies that are 'selectively' enforced have limited value as protection from a lawsuit.
  - Lawtonfogle 11y ago
    If it can be proven that there is no reason behind the selective enforcement and if it can be shown that it is selectively enforced. The thing is, the people most likely to be a victim of these policies are the least likely to afford the discovery to prove this, to say nothing of the other side effects (such as being black listed from an industry).
6stringmerc 11y ago
Caveat: In my experience, I've been subjected to a phone call from a Registered Nurse who reviewed my personal health records and called to ask me to switch to a cheaper medication because the company was going through some financial difficulty. I'm 100% not making this up. Your assertion that a company doesn't want personal health information of individual employees is one that I do not agree with. If a company can eliminate the 5% of people driving XX% of the premium cost - through cancer, major surgeries, etc - then it stands to reason they would undertake that method of reducing overhead. The employer itself may not have access, but the party they hired may have access, and I do agree that robust legislative firewalls and significant jail-time for violators should be a national priority. Or, in other words, I very much disagree "Wellness Programs" are actually concerned with wellness (no assistance with dietary materials, gym memberships, incentives, etc) and should be portrayed as "Health Cost Containment Programs" which is significantly more honest.
- bduerst 11y ago
  Who was this RN working for exactly? Your PCP? Your insurance company? A broker? A third party? I doubt they are employed at the company you work at, meaning your employer isn't look at your health record.
  - st3v3r 11y ago
    Employed directly? Maybe not. Employed by a company the employer asked to look into reducing health plan costs? Most likely. And just as creepy and scummy.
    - bduerst 11y ago
      Or it could be their PCP's RN asking them to switch their ongoing Rx to a generic, because recent updates to their health plan means a higher co-pay or deductible. This happens more than you realize, and doesn't mean their employer violated their privacy, which is why I ask.
      - 11y ago
dragonwriter 11y ago
> If the wellness program is offered as part of a group health plan, then the wellness-plan provider is a business associate of a covered entity under HIPAA, and PHI protection applies. But whether that prevents disclosure depends on what specific consent is given as part of opting-in to the offered wellness plan. As I understand, these plans often include consent for fairly extensive information sharing with employers as part of the opt-in paperwork (and that that is a big part of the reason that they are offered.)

by HillRat 11y ago

braythwayt 11y ago

Thank you for the elucidation. This is the kind of quality reply that makes HN great.

Lawtonfogle 11y ago

The problem is that you do have employers wanting to target individual employees and that just because something is illegal doesn't mean it won't happen. An employer could use this to identify what employees are about to become pregnant and then find reasons to fire them. And given that being fired is likely to change their chance of choosing to become pregnant, it becomes significantly harder to prove this was an illegal targeted attack instead of a justified firing of an employee who was violating policy (and given how policies are written, workplace policies are treated like laws these days where everyone is violating some policies and they are only selectively enforced). Add in that this is most likely to be deployed against lower income people if it is deployed, and that those it is deployed against will be in a very poor condition to fight back (hiring a lawyer right after losing a job isn't something most can afford), you have a nasty discrimination disaster ready to happen (or in reality, ready to be made worse than it currently is).

Retric 11y ago
Policies that are 'selectively' enforced have limited value as protection from a lawsuit.
- Lawtonfogle 11y ago
  If it can be proven that there is no reason behind the selective enforcement and if it can be shown that it is selectively enforced. The thing is, the people most likely to be a victim of these policies are the least likely to afford the discovery to prove this, to say nothing of the other side effects (such as being black listed from an industry).

6stringmerc 11y ago

Caveat: In my experience, I've been subjected to a phone call from a Registered Nurse who reviewed my personal health records and called to ask me to switch to a cheaper medication because the company was going through some financial difficulty. I'm 100% not making this up. Your assertion that a company doesn't want personal health information of individual employees is one that I do not agree with. If a company can eliminate the 5% of people driving XX% of the premium cost - through cancer, major surgeries, etc - then it stands to reason they would undertake that method of reducing overhead. The employer itself may not have access, but the party they hired may have access, and I do agree that robust legislative firewalls and significant jail-time for violators should be a national priority. Or, in other words, I very much disagree "Wellness Programs" are actually concerned with wellness (no assistance with dietary materials, gym memberships, incentives, etc) and should be portrayed as "Health Cost Containment Programs" which is significantly more honest.

bduerst 11y ago
Who was this RN working for exactly? Your PCP? Your insurance company? A broker? A third party? I doubt they are employed at the company you work at, meaning your employer isn't look at your health record.
- st3v3r 11y ago
  Employed directly? Maybe not. Employed by a company the employer asked to look into reducing health plan costs? Most likely. And just as creepy and scummy.
  - bduerst 11y ago
    Or it could be their PCP's RN asking them to switch their ongoing Rx to a generic, because recent updates to their health plan means a higher co-pay or deductible. This happens more than you realize, and doesn't mean their employer violated their privacy, which is why I ask.
    - 11y ago

dragonwriter 11y ago

> If the wellness program is offered as part of a group health plan, then the wellness-plan provider is a business associate of a covered entity under HIPAA, and PHI protection applies. But whether that prevents disclosure depends on what specific consent is given as part of opting-in to the offered wellness plan. As I understand, these plans often include consent for fairly extensive information sharing with employers as part of the opt-in paperwork (and that that is a big part of the reason that they are offered.)