Undermining Genetic Privacy? Employee Wellness Programs and the Law

Kathy L. Hudson, Ph.D., and Karen Pollitz, M.P.P.

May 24, 2017DOI: 10.1056/NEJMp1705283

Article
References
Metrics: Genetic information is becoming ubiquitous in research and medicine. The cost of genetic analysis continues to fall, and its medical and personal value continues to grow. Anticipating this age of genetic medicine, policymakers passed laws and regulations years ago to protect Americans’ privacy and prevent misuse of their health-related information. But a bill moving through the House of Representatives, called the Preserving Employee Wellness Programs Act (H.R. 1313), would preempt key protections. Because the bill, which was sent to the full House by the Education and the Workforce Committee in March, would substantially change legal protections related to the collection and treatment of personal health and genetic information by workplace wellness programs, it should be on the radar screens of physicians, researchers, and the public.
Several federal laws currently prohibit discrimination and safeguard the privacy of genetic and other health-related information. The Americans with Disabilities Act of 1990 (ADA) prohibits employment discrimination based on disability or perceived disability and generally bars employers from making medical inquiries and examinations. The Health Insurance and Portability and Accountability Act of 1996 (HIPAA) prohibits discrimination by group health plans based on health information and exclusion periods for coverage of preexisting conditions based on genetic information. HIPAA also includes privacy protections for personal health information that apply to employer-sponsored health plans but not to employers themselves.
The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits both employment and health insurance discrimination based on genetic information, and prohibits employers and insurers from requesting genetic information from individuals. Finally, the Affordable Care Act of 2010 (ACA) prohibits discrimination and preexisting-condition exclusions based on health status and genetic information in all types of health coverage.
These laws, however, made exceptions for voluntary wellness programs, and political pressure from employers and insurers has prompted broadening of those exceptions (http://fortune.com/2017/03/10/genetic-testing-workplace-wellness-bill/). Under the ACA, employer-sponsored health plans can have “reasonably designed” wellness programs that vary employees’ premium contributions by up to 30% of the total cost of the group health plan (combined employer and employee shares) according to whether the person meets specific biometric targets, such as normal blood glucose levels. Such “health contingent” programs are exempted from the prohibition on varying premium contributions according to health status. Under ACA regulations, a reasonably designed health-contingent wellness program doesn’t have to be based on scientific evidence or collect or report data on its efficacy in improving enrollees’ health. And the ACA did not limit incentives or set standards for wellness programs that vary insurance premiums on the basis of employees’ participation only and not their health outcomes (“participatory” programs), other than requiring that such programs be offered equally to all similarly situated persons.
In 2016, the Equal Employment Opportunity Commission revised ADA and GINA regulations to redefine “voluntary” wellness programs, which are excepted from the rules against employers’ requesting health and genetic information. Until then, employees who declined to disclose such information to wellness programs could not be penalized. Now, workers (and their spouses) can be charged up to an additional 30% of the cost of health coverage for refusing to participate in wellness programs that collect health information, although they cannot be fired or denied health benefits for refusing to disclose information. The final regulations did little to limit information collection by wellness programs
The 2016 rules did retain certain protections for genetic information. Wellness programs must waive penalties for persons who decline to disclose genetic information about themselves, and they may not provide incentives for disclosure of health information about workers’ children. And four other GINA standards still apply: wellness programs can request genetic information only if they offer health or genetic services; people must give prior, knowing, voluntary, written authorization to have their genetic information disclosed; individually identifiable information can be obtained only by the patient and the licensed health professional providing the services; and identifiable information can be available only for the purpose of such services and cannot be disclosed to the employer except in aggregated, deidentified forms.
Today, just 8% of large employers offer health-contingent programs authorized by the ACA and subject to ACA limits on incentives; but nearly three quarters of large employers collect employee health information through wellness programs, and more than half of them provide incentives to employees to participate.1 Yet only 41% of workers agree to disclose health information. Privacy is one reason why. The incidence of stigmatized health conditions among adults covered by employer health plans (30%)1 may help explain why people prefer not to participate in wellness surveys and medical exams asking about mental illness, pregnancy, and other health information. In addition, workers worry about how wellness-program vendors might use their information for purposes such as marketing.2 Consumer and patient advocates note that wellness programs routinely obtain passive authorization from participants to access further information about them, including claims and medical records data, and share it with their business partners.
Now, the legal landscape for wellness programs may change dramatically. H.R. 1313’s sponsors argue that GINA and ADA rules conflict with ACA rules — like road signs at an intersection reading “right turn only” and “left turn only” — threatening wellness programs that could promote healthier lifestyles and reduce costs (www.washingtontimes.com/news/2017/apr/18/employee-wellness-programs-should-be-preserved/). Making wellness-program rules consistent, they say, would end confusion and preserve the option for employers to offer wellness programs and individuals to participate in them. But the laws involved address different questions. GINA and the ADA set standards for “voluntary” wellness programs, which may request sensitive information that employers are otherwise prohibited from collecting. The ACA sets standards for how such information may be used to vary workers’ premiums as an incentive to improve their health. Perhaps a more apt analogy would be one road sign stating the speed limit and another reading “stop for pedestrians”: drivers can and must obey both.
H.R. 1313 takes a different approach, however. It would deem workplace wellness programs that comply with ACA standards — including the absence of standards for practices the law doesn’t address — to be compliant with ADA and GINA standards. As a result, most participatory wellness programs that collect health information would face no limit on incentives for getting people to divulge information. GINA wellness-program standards would no longer protect genetic information. Employers could pressure employees to disclose information, and wellness programs could share identifiable information with employers.
H.R. 1313 undermines the principle that genetic information needs the highest level of protection so that people can make decisions about obtaining their own information without fearing that it might be used against them. It thus challenges individual autonomy, a bedrock ethical principle in medicine and research. In the genetics context, this principle requires that people be provided adequate information about what a genetic test is and what the result may mean for them and their families so they can make an informed decision about being tested. Autonomy encompasses the “right not to know” one’s genetic information, which is particularly important with tests that reveal future health risks when no prevention or intervention is available to reduce those risks. This bill would permit employers to use financial incentives to get employees to take a genetic test that might not be medically necessary or ethically appropriate. It would also challenge employees’ ability to guard their privacy, overriding the requirement that individually identifiable genetic information gathered by wellness programs be shared only with the patient and the clinician providing care.
Downstream, such legislation could also stifle medical progress. Today, genetic tests are available for more than 10,000 health conditions, and whole-genome sequencing may eventually become the standard of care and part of our medical records.3 DNA analysis is increasingly included in biomedical research protocols. If employers and business associates of wellness programs can request and share genetic information, and impose penalties for nondisclosure, surely that will dampen enthusiasm about participating in research.
Take, for example, the National Institutes of Health’s planned All of Us Research Program. The investigators aim to partner with a million or more people throughout the United States who will provide detailed information about their health, lifestyle, and environment. Volunteers will also provide biospecimens that will be used to generate genetic and other information and will participate over many years to provide longitudinal data that will be invaluable for research on myriad diseases. Participants will have access to their study data. Under H.R. 1313, employers could ask employees to disclose their research information to wellness programs — and penalize them for refusing. This possibility would have to be disclosed to prospective All of Us participants and might dissuade many otherwise eager and altruistic volunteers. Fear of discrimination could discourage people from getting tests that could save their lives and from participating in research that could lead to future cures.
Disclosure forms provided by the authors are available at NEJM.org.
This article was published on May 24, 2017, at NEJM.org.
SOURCE INFORMATION
From Hudson Works LLC (K.L.H.), and the Kaiser Family Foundation (K.P.) — both in Washington, DC.