Health Risk Reduction Programs in Employer-Sponsored Health Plans: Part II—Law and Ethics

Abstract

Objective

We sought to examine the legal and ethical implications of workplace health risk reduction programs (HRRPs) using health risk assessments, individually focused risk reduction, and financial incentives to promote compliance.

Methods

We conducted a literature review, analyzed relevant statutes and regulations, and considered the effects of these programs on employee health privacy.

Results

A variety of laws regulate HRRPs, and there is little evidence that employer-sponsored HRRPs violate these provisions; infringement on individual health privacy is more difficult to assess.

Conclusion

Although current laws permit a wide range of employer health promotion activities, HRRPs also may entail largely unquantifiable costs to employee privacy and related interests.

Efforts by employers and employer-sponsored health plans to improve employee health through individual health risk assessments (HRAs), individually targeted interventions, and incentives to improve health risk factors inevitably raise complicated legal and ethical issues. The legal analysis focuses on federal and state laws prohibiting discrimination in health benefits, protecting the privacy and confidentiality of individual health information, prohibiting discrimination on the basis of disability, and prohibiting adverse treatment on the basis of smoking or other lifestyle factors. Health risk reduction programs (HRRPs) also raise numerous ethical issues related to the principles of beneficence, justice, and privacy.

Legal Issues

Various federal and state laws directly or indirectly regulate HRRPs, including HRAs, in employer-sponsored health plans. The Health Insurance Portability and Accountability Act (HIPAA)¹ provides the most direct and detailed regulation. Several other laws, however, also affect the legality of HRAs, individually focused risk reduction, and financial incentives to promote employee participation.²

Health Insurance Portability and Accountability Act

Nondiscrimination and Wellness Programs Rule

HIPAA was enacted primarily to enable individuals to change employers and employment-based health plans without losing their health coverage because of pre-existing conditions. Under HIPAA, “a group health plan, and a health insurance issuer offering group health insurance coverage in connection with a group health plan may not establish rules for eligibility (including continued eligibility) of any individual to enroll under the terms of the plan based on any of the following health status-related factors in relation to the individual or a dependent of the individual: a) health status, b) medical condition (including both physical and mental illnesses), c) claims experience, d) receipt of health care, e) medical history, f) genetic information, g) evidence of insurability (including conditions arising out of acts of domestic violence), and h) disability.”³ Therefore, a health plan may not deny enrollment based on health risks discovered in the course of an HRRP or HRA.

Another provision of HIPAA makes it unlawful for an employer-sponsored health plan to vary premium contributions based on the health status of an employee or a covered dependent.⁴ An important proviso to this general provision, however, states that the premium contribution language should not be construed “to prevent a group health plan, and a health insurance issuer offering group health insurance coverage, from establishing premium discounts or rebates or modifying otherwise applicable co-payments or deductibles in return for adherence to programs of health promotion and disease prevention.”⁵

This provision, jointly enforced by the Department of the Treasury, Department of Labor, and Department of Health and Human Services, is the subject of joint rules that took effect on July 1, 2007.⁶ The rules, “Non-discrimination and Wellness Programs in Health Coverage in the group Market,” distinguish between two types of wellness programs offering rewards to employee participants. First, there is no detailed regulation if none of the conditions for obtaining a reward are based on an individual satisfying a health-related factor. Examples used in the rule include 1) a program that reimburses all or part of the cost for membership in a fitness center; 2) a diagnostic testing program that provides a reward for participation and does not base any part of the reward on outcomes; 3) a program that encourages preventive care through the waiver of the copayment or deductible requirement under a group health plan for the costs of, for example, prenatal care or well-baby visits; 4) a program that reimburses employees for the costs of smoking cessation programs without regard to whether the employee quits smoking; and 5) a program that provides a reward to employees for attending a monthly health education seminar.⁷

Second, more detailed regulations apply if any of the conditions for obtaining a reward is based on an individual satisfying a standard related to a health factor. In such event, the following provisions must be met: 1) the reward must not exceed 20% of the cost of employee-only coverage under the plan or, if dependents are also covered under the plan, 20% of the cost of the employee and any dependents covered under the plan; 2) the program must be reasonably designed to promote health or prevent disease; 3) the program must give individuals eligible for the program the opportunity to qualify for the reward under the program at least once per year; 4) the reward under the program must be available to all similarly situated individuals, thereby allowing individuals with documented medical conditions an opportunity to qualify for the reward by alternative means; and 5) the plan must disclose in all materials describing the program the availability of a reasonable alternative standard or waiver of the applicable standard.⁸

Wellness program rewards contingent on satisfying certain health targets are the most contentious legally and ethically. For example, when health plans condition significant reductions in employee premiums on weight loss, smoking cessation, and other specific health measures, some affected employees are likely to challenge the standard to be met, the time they are allowed to meet the standard, determinations of whether they have met the standard, and any rules regarding relapses.

Although the federal regulations have not been subject to legal challenge, there are some notable provisions raising important policy issues. Among other contentious issues are the following: 1) the maximum permissible reward of 20% of the health plan cost is a significant amount of money, and therefore a substantial incentive (or coercion) to participate is expressly permissible; 2) the regulation’s provision that only a good faith standard will be used to determine if the program is reasonably designed to promote health and prevent disease is extremely deferential to the plan sponsors; and 3) the regulations state that merely providing alternative means for qualifying for an award (which satisfies the regulation) might not satisfy the provisions of the Americans with Disabilities Act (ADA).

Privacy Rule

The Administrative Simplification title of HIPAA committed the nation to more efficient health claims processing through standard electronic transactions. To protect the privacy of health information in these transactions and, to a degree, protect health privacy more broadly, the Secretary of Health and Human Services, as directed by Congress, promulgated Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule).⁹ Because the enabling legislation for the Privacy Rule is designed to regulate financial transactions in health care, the Privacy Rule applies only to three classes of covered entities: health care providers, health clearinghouses, and health plans.¹⁰ The Privacy Rule does not apply to employers, life insurers, schools, or other entities that may have health information, except to the extent that they perform functions of a covered entity, such as providing and billing for health services.

The applicability of the Privacy Rule to the employment setting is complicated. Employers are not covered entities, but employer-sponsored health plans are.¹¹ In theory, employers maintain “firewalls” between their covered (eg, health benefits) and non-covered (eg, human resources) functions, such as by keeping health claims information separate from personnel information.¹² In practice, some employers fail to establish or maintain the sequestration of health information required by law. Even if employers take care to separate these functions, however, the distinction is often not perceived by employees concerned about the potential for abuse. Moreover, the lack of enforcement actions brought under the Privacy Rule by the Department of Health and Human Services to date provides little assurance that protected health information in health plans will not be shared with human resources, other departments of the employer, coworkers, or beyond the company.

Many HRRPs are sold to health plans by independent vendors. These companies are not covered entities under the Privacy Rule. The typical contractual arrangement is for the vendor to sign a “business associate” agreement with the employer-sponsored health plan in which the vendor promises to comply with the Privacy Rule. As originally promulgated, the Privacy Rule did not extend to business associates.¹³ Covered entities were required to monitor the actions of their business associates and insist that they correct practices not in compliance with the Privacy Rule. This self-regulation was widely considered to be ineffective.¹⁴ Accordingly, in section 13,404 of the American Recovery and Reinvestment Act of 2009¹⁵ Congress extended the Privacy Rule to business associates of covered entities. It remains to be seen what the effects of this new provision will be.

Americans With Disabilities Act

Title I of the ADA¹⁶ is the principal federal law prohibiting discrimination in employment on the basis of disability. It applies to state and local government employers and private sector employers with 15 or more employees.¹⁷ Federal government employees are covered by section 501 of the Rehabilitation Act.¹⁸ Under the ADA, employers are limited in the types of employee medical examinations and inquiries they are permitted to make, with the lawfulness depending on the timing. At the preemployment stage, employers are not permitted to make any inquiries about whether the individual has a disability and may only inquire about the individual’s ability to perform job-related functions. After a conditional offer of employment, an employer may require a medical examination and the disclosure of health records, but a conditional offer may not be withdrawn for a health reason unless the individual, with or without reasonable accommodation, is unable to perform the essential functions of the job. Finally, employers are not permitted to require medical examinations or make medical inquiries of current employees unless such measures are job-related and consistent with business necessity.¹⁹ As to current employees, an employer “may conduct voluntary medical examinations, including voluntary medical histories, which are part of an employee health program available to employees at the worksite.”²⁰ Thus, offering a voluntary HRRP to current employees would not violate the ADA.

The financial inducements associated with HRRPs could violate the ADA if they had the effect of discriminating on the basis of disability. First, it would violate the ADA if not all employees are eligible for the reductions in health plan premiums or other rewards, such as by excluding employees with certain physical impairments. Second, the benefits from adherence to the health promotion plan must not discriminate on the basis of disability. For example, health plans might reward employees who lower their cholesterol level a certain amount or jog a certain number of miles per week. Such financial benefits might be viewed as penalizing employees who had hereditary hypercholesterolemia or a disability requiring the use of a wheelchair, thereby preventing them from obtaining the reward.

In addition to the HIPAA “firewall” separating health plan information from other employee information, the ADA requires employee health information to be stored in separate files and not in human resources records. Thus, an employer and its health plan could have the following three sets of records: 1) employee personnel information exclusive of health information; 2) employee health information obtained from medical examinations and inquiries; and 3) health plan claims information and HRRP data. If any of these three sets of records became commingled, then there might be a violation of the ADA, regardless of whether the individual satisfied the definition of an individual with a disability.²¹

Another way in which an HRA might implicate the ADA is if an individual were identified as being at an increased risk of a disabling condition or using greater amounts of health care resources. Although employer actions to terminate or otherwise take adverse action against such an individual would seem to be a clear case of “discrimination,” it is quite possible that such actions would not violate the ADA. The ADA Amendments Act of 2008²² legislatively overrules several restrictive Supreme Court decisions and directs the courts to apply a more expansive reading of the coverage of the ADA. Nevertheless, even as amended, the ADA does not apply to individuals who do not have any current impairment. Thus, adverse treatment based on the possibility that an individual might consume additional health resources in the future does not expressly violate the ADA.²³

The ADA has special provisions dealing with employee use of illegal drugs and alcohol. The ADA excludes from the definition of “qualified individual with a disability” “any employee or applicant who is currently engaging in the illegal use of drugs, when the covered entity acts on the basis of such use.”²⁴ The term “illegal use of drugs” includes both the use of illegal drugs and the abuse of legal controlled substances.²⁵ Individuals who have a history of alcoholism, but who have completed rehabilitation are covered by the ADA. In the context of HRRPs, employers may not discriminate against an individual with a history of drug abuse who no longer uses drugs and who is otherwise qualified for the position he or she seeks or holds. An employer also may not discriminate against an individual with alcoholism who is otherwise qualified for the position he or she seeks or holds. Neither drug users nor alcoholics are “qualified” if their substance abuse renders them unfit to perform the job.

Genetic Information Nondiscrimination Act

The Genetic Information Nondis-crimination Act of 2008 (GINA)²⁶ prohibits genetic discrimination in employment and health insurance, thereby supplementing existing federal protections against genetic discrimination in employer-sponsored group health plans contained in HIPAA as well as state laws. Under GINA, it is unlawful for an employer to use genetic information in hiring, firing, job assignment, training, compensation, terms, conditions, or privileges of employment, limiting, segregating, or classifying in ways that adversely affect employee status, and requesting, requiring, or purchasing genetic information about employees or applicants.

One provision of GINA might have direct relevance to HRRPs. GINA states that it is unlawful for an employer “to request, require, or purchase genetic information with respect to an employee or family member of the employee.”²⁷ “Genetic information” includes “the manifestation of a disease or disorder in family members.”²⁸ In addition to less common monogenic disorders, “genetic information” includes the genetic contribution or risk of common, chronic, multifactorial disorders. Consequently, it is unlawful under GINA for an employer to request that an employee provide family health history, which might be part of an HRA. There are two possible exceptions that apply. First, it is not a violation if the employer “inadvertently requests or requires family medical history of the employee or family member of the employee.”²⁹ The HRAs, however, are unlikely to qualify as “inadvertent” requests. Second, it is not unlawful to make such inquiries if “the employee provides prior, knowing, voluntary, and written authorization.”³⁰ It is not clear what degree of specificity will be needed to satisfy the authorization requirement of GINA when a voluntary wellness program includes an HRA with family history questions. Even if receipt of the employee’s genetic information is lawful, it violates GINA for the employer to use the information to alter any term or condition of employment.

State Nondiscrimination Laws

Virtually every state has its own law prohibiting discrimination in employment on the basis of disability.³¹ The ADA does not preempt any state or local law “that provides greater or equal protection for the rights of individuals with disabilities than are afforded by this Act.”³² Similarly, GINA does not preempt the laws enacted in 35 states prohibiting genetic discrimination in employment.³³

There are three main ways in which state laws may complement the protections of the ADA and GINA. First, a state law may apply to a wider class of employees by covering employers with fewer than the federal minimum of 15 employees. Second, statutorily or through decisional law state disability nondiscrimination laws may cover specific impairments, such as obesity and substance abuse, whose coverage under the ADA is less comprehensive or certain. Third, state laws may more closely regulate particular medical or hiring procedures, such as by limiting the nature of employer inquiries into employee health conditions.

None of the differences between the ADA and state disability laws is likely to affect the legality of HRRPs. Thus, so long as participation in the program is voluntary and the HRRP does not have the purpose or effect of discriminating on the basis of disability, HRRPs are unlikely to violate current state disability discrimination laws.

State Smokers’ Rights Laws

Most states have enacted laws limiting or prohibiting smoking on the job to protect the health of coworkers and the public. Even in the absence of such legislation, employers are generally within their rights to regulate or prohibit smoking on the job for reasons related to safety, health, and productivity. Some employers have gone beyond workplace smoking bans to prohibit employees from smoking off the job as well.³⁴ Among other reasons, smokers increase the cost of employer-sponsored health benefits. Beginning in the 1980s, about half the states enacted laws prohibiting discrimination in employment against an applicant or employee based on cigarette smoking off the job. The laws differ in their breadth of coverage and include prohibiting discrimination based on an applicant’s or employee’s participating in lawful activity or use of lawful products off the employer’s premises during non-working hours, smoking or using tobacco products, using an “agricultural product” off the job, using consumable products off the employer’s premises during nonworking hours, or because the employee is a smoker.³⁵

These laws could be relevant in the event an individual with an unhealthy lifestyle refused to enroll in an HRRP or enrolled in such a program but failed to make satisfactory progress. The narrowly drafted laws would apply to smokers only, but some of the more broadly worded statutes prohibiting discrimination based on engaging in a lawful activity off work also would cover an individual who consumed alcohol off the job or engaged in dangerous recreational activities. Thus, this legislation would supplement the protections of disability discrimination laws and further underscore the need to make completely voluntary and without any adverse consequences both HRRP enrollment and rewards.

Ethical Considerations

Various ethical principles are implicated by HRRPs in employer-sponsored health plans. Although the specifics of the program will determine the range of ethical issues presented, there are some common ethical concerns in all the programs. The three predominant ethical issues are beneficence, justice, and privacy.

Beneficence

In theory, the primary ethical justification for HRRPs is beneficence—improving the health of employees. Beneficence refers to “a statement of moral obligation to act for the benefit of others.”³⁶ It is the central explanation for medicine, including occupational medicine. In reality, for many health plan sponsors, saving on employee health benefits is also a significant motivating factor. Having dual motives, one of which involves economic benefit to the program sponsor, however, does not mean that the program is unethical. Cost savings might improve the health plan’s solvency, save money for the health care system in general, and improve health outcomes for individuals, thereby justifying establishing and maintaining an HRRP. In a health care system in which employer-sponsored group health coverage is optional, the mere offering of health benefits represents a combination of beneficence and income maximization for the employer.

The model of beneficence embodied by HRRPs is paternalistic, with employer sponsors of health plans using their economic leverage to encourage employees to adopt healthier lifestyles along dimensions chosen by the health plan or HRRP vendor. This prevailing method of implementing HRRPs raises the issue of whether the positive aspects of HR-RPs justify the paternalism by health plans and their employer sponsors.

Autonomy is a foundational principle of American health care ethics and law. In research settings, autonomy translates into the essential requirement of informed consent by human subjects. In clinical settings, adult patients of sufficient cognition have the legal right and ethical discretion to accept or decline any recommended therapies, including life-sustaining treatment. Indeed, the only times when American ethical and legal principles approve overriding the autonomy of adults with decisional capacity are in narrowly prescribed instances of public health and safety, such as isolation and quarantine in epidemics. Thus, it could be argued that the paternalism and lack of autonomy in HRRPs is at variance with accepted norms of health care practice and makes them ethically suspect.

Another line of thinking, however, is that autonomy should not trump all other interests. At a time when there is an epidemic of preventable illness, such as obesity and diabetes, and escalating health care costs to society, it might be considered beyond the realm of autonomous decision making for individuals to engage in grossly unhealthy activities with the health care costs borne by others in the form of higher health costs, higher taxes, and unrealized wage increases. It could be argued that the right of society to demand greater personal responsibility in health promotion is analogous to seat belt and motorcycle helmet laws, which protect the health of the individual and the financial well-being of society, albeit by imposing limits on individual freedom. Furthermore, the law of the workplace has long deferred to employer prerogatives, and the workplace might be viewed as a particularly appropriate place to capture the target population.

The generally accepted paternalism of seat belt, motorcycle helmet, and similar laws (eg, fluoridation of drinking water) may be contrasted with the paternalism of HRRPs. In the former instance, the mandatory requirements are adopted by elected officials pursuant to the government’s constitutional authority and responsibility to protect and promote public health. Furthermore, there is no acceptable alternative to coercive governmental action in the event that affected persons refuse to adopt voluntary measures to protect their own health and safety. By contrast, private employers do not have the legal responsibility to promote public health, and health promotion overseen by the individual’s primary care provider is a viable alternative to employer-sponsored HRRPs.

It is also helpful to view workplace-based HRRPs in the broader context of health care ethics, including the principles of autonomy customarily applied in health care settings. Such an approach, regarding occupational health services more like health care generally than traditional employer–employee relations, is suggested by the American College of Occupational and Environmental Medicine Code of Ethics. Principle 1 of the Code provides that physicians should “accord the highest priority to the health and safety of individuals in both the workplace and the environment.”³⁷ Viewed in this light, it is arguable that employer-sponsored health plans should not be able to override individual autonomy by adopting a system of incentives and disincentives that, for many employees, might rise to the level of unethical coercion if used in either the research or clinical setting. The pressures on employees include both incentives to participate in HRRPs and incentives to reach certain health targets. Although participation in HRRPs may be optional, lower-paid employees face increased pressure to participate and obtain the financial reward. Furthermore, although employers have—by design or default—a key role in the American health care finance system, it is questionable whether employers should be able to implement health promotion programs unilaterally when primary care models of health promotion may be equally or more effective and likely raise fewer ethical concerns.

Justice

The term justice has many different meanings, aspects, theories, and interpretations. In general, justice may be interpreted as “fair, equitable, and appropriate treatment in light of what is due or owed to persons.”³⁸ In the employment setting, it evokes notions of equal treatment based on relevant criteria. Thus, persons equal in whatever relevant respect ought to be treated equally. Employment discrimination laws prohibit employers from using criteria that adversely affect individuals based on race, color, religion, sex, national origin, age, or disability.³⁹

Smoking, alcohol, and substance abuse status; body mass index; exercise and nutritional status; cholesterol level; and other measures of health and health risk are often correlated with socioeconomic position. Therefore, less skilled and lower paid employees, as well as racial and ethnic minority employees, are more likely to be at greater risk of illness. These individuals are also the most economically vulnerable because they are least able to change jobs and to resist the compulsion of HRRP incentives and disincentives to participate in health promotion programs. By contrast, at many companies higher paid employees who consider the HRRP to be intrusive can simply pay a “privacy tax” by foregoing incentives for participation in the HRRP.

Furthermore, health promotion initiatives operate against a backdrop of unequal health conditions, in terms of environmental and occupational exposures, access to nutritious foods, opportunities for exercise, and other components of a healthy lifestyle. Although economically vulnerable employees disproportionately targeted by health promotion programs are also the group that stands to gain the most from a healthier lifestyle, HRRPs are not necessarily the least intrusive means of reducing employee health risks. Some employer-sponsored health plans do not pay for wellness or health promotion visits to primary care providers, and revising reimbursement policies might be a more appropriate place for some employer-sponsored health plans to focus their efforts.

Privacy

Privacy is another ethical principle with many meanings. In general, it is a condition of limited access to the person. Among the many forms of privacy are informational privacy, physical privacy, decisional privacy, and proprietary privacy.⁴⁰ Several of these aspects of privacy are implicated by HRRPs. Besides the risk that health plans or HRRP vendors will improperly or negligently disclose sensitive health information, there are two fundamental privacy concerns. First, as a condition of enrollment in many HRRPs, employees are required to complete HRAs, which focus largely on modifiable risk factors. Requiring individuals to disclose a range of sensitive health information in an incentive-based HRRP invades the privacy of individuals. Even questions that might seem innocuous to some employees, such as current height and weight, would be considered extremely personal to others and beyond the sort of inquiry that one would expect in settings other than the privacy of a physician’s office. Physical privacy also could be implicated by biometric measurement, especially when conducted at the workplace.

Second, individualized HRRPs, some of which include periodic contacts from a health coach, may be regarded as highly intrusive. In the most imposing situations, employees at risk of losing a financial benefit are expected to disclose to a stranger, often with unknown credentials and selected by the employer or a health plan vendor, highly personal information, such as current weight and use of alcohol and illicit substances. In the clinical setting, individuals surrender a degree of privacy in exchange for evaluation and treatment from a trusted health care provider of their choosing. This traditional and ethically acceptable tradeoff of privacy for health care is regulated by law and codes of professional conduct. By contrast, comparable ethical justification and legal regulation are lacking when individuals surrender their informational health privacy in the context of an employer-sponsored HRRP.

Conclusion

Commercial vendors of HRRPs and supporters of these programs often posit that the measures are “win–win” propositions. They presumably improve employee health and reduce employer health care costs. Our two-part study concludes that the picture is much more complicated and that an unqualified endorsement of HRRPs is not supported by the published literature.

In Part I, we considered the efficacy of employer-sponsored HRRPs.⁴¹ We determined that some HRRPs have demonstrable benefits, but that many of the studies evaluating the programs suffered from methodological limitations, such as self-selection and self-reporting bias. We also noted that there was inadequate evidence of long term, sustainable improvements in risk reduction and insufficient data correlating gains with improved morbidity and mortality rates. We also found that there was a generally positive return on investment in HRRPs, but the studies vary widely and may not sufficiently account for overall economic conditions and changes in health care delivery. We were unable to evaluate whether employer-sponsored HRRPs were more effective or had greater return on investment than similar measures undertaken in primary care settings.

In Part II, we considered the legal and ethical implications of HRRPs. Although the legal picture is complicated, regulations dealing with HRRPs have been extremely deferential to the health plans. Therefore, so long as participation in the HRRP is at least nominally voluntary, benefits under the plan do not discriminate against employees with disabilities, and plan-generated health information is not commingled with other employment records, then the HRRP will pass legal muster.

The ethical issues raised by HRRPs are more difficult to resolve. HRRPs are justified by beneficence, but the method of implementation raises concerns about employer paternalism overriding employee autonomy, the possibility of coercion and lack of justice in applying the same financial incentives to employees with different income levels, and the potential invasion of privacy through HRAs, biometric measurement, and telephone inquiries to monitor compliance. Our analysis did not consider other possible effects of the HRRPs, such as employee recruitment, morale, good will, productivity, and turnover.

Although there is some evidence of positive effects from employer-sponsored HRRPs, it is less compelling than some published reports and promotional materials suggest. Furthermore, in evaluating the overall desirability of employer-sponsored HR-RPs, health plan sponsors and health policy makers need to consider the legal, ethical, and other implications of the programs.