Can employers see employee health screening results?

Three sets of rules, depending on how the program is set up

Three federal laws do most of the work. The EEOC's regulations under the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA) set conditions for wellness programs that include medical exams, health questionnaires or questions about family medical history. HIPAA's Privacy and Security Rules, which HHS administers, protect a wellness program's health information when the program is part of a group health plan. So the first question to ask about any program is whether it runs through your health plan.

This page explains the federal rules in general terms. It is information, not legal advice. For your own program, check the details with your benefits counsel.

ADA: voluntary, confidential and aggregate only

The EEOC's ADA regulation lets employers run voluntary medical exams and health questionnaires as part of an employee health program, on these conditions:

• Voluntary: the employer may not require participation, deny or limit health plan coverage for not taking part, or take adverse action against anyone who declines.
• Notice: employees must get a notice they are reasonably likely to understand, describing what medical information will be collected, why, who will receive it and how it will be protected.
• Confidential: the information must be kept on separate forms and in separate medical files, and treated as a confidential medical record.
• Aggregate only: apart from narrow exceptions, such as telling supervisors about necessary work restrictions or accommodations, and what is necessary to administer the health plan, the employer may receive the information only in aggregate terms that do not disclose, or are not reasonably likely to disclose, the identity of any employee.
• No forced sharing: the employer may not make taking part, or earning an incentive, depend on employees agreeing to the sale, sharing or other disclosure of their medical information, beyond what the program needs.
• Reasonably designed: a screening that gives participants no results, follow-up information or advice does not meet the standard, unless the information is used to design a program for at least some of the conditions it finds.

Incentives: the EEOC limit was removed

The EEOC's 2016 rules also capped wellness incentives. A federal court in Washington, DC vacated the ADA incentive section effective 1 January 2019, and the EEOC removed it from the regulations in December 2018. The incentive paragraphs in both the ADA and GINA regulations are now marked reserved. That leaves employers without an EEOC figure for how large an incentive can be before participation stops being voluntary, which is a question for counsel.

Separate rules apply inside a group health plan. Where a plan rewards people for meeting a standard related to a health factor, such as a biometric result, the Departments of Labor, HHS and the Treasury say the total reward must not exceed 30% of the total cost of employee-only coverage, or 50% for programs to prevent or reduce tobacco use, and plan materials must disclose a reasonable alternative standard. The three departments restated these rules in an FAQ on 26 August 2026.

GINA: family history and genetic information

GINA adds stricter rules for genetic information, which includes family medical history, a common question in health risk assessments. Under the EEOC's GINA regulation, a wellness program may collect it only if taking part is voluntary and the employee gives prior, knowing, written authorisation. Individually identifiable genetic information may go only to the employee and the licensed health care professionals or board certified genetic counsellors providing the services, not to managers, supervisors or anyone else in the workplace. The employer may receive it only in aggregate terms that do not identify anyone.

Employers may not offer a reward for providing genetic information. They can reward completion of a health risk assessment that includes family history questions, but only if they make clear that the reward is available whether or not those questions are answered. And a program may not deny an employee a reward because a spouse has blood pressure, cholesterol or blood glucose that the employer considers too high.

HIPAA: only when the program is part of a group health plan

HIPAA applies to health plans, health care clearinghouses, most health care providers and their business associates, not to employers acting as employers. HHS says that where a wellness program is offered as part of a group health plan, the identifiable health information it collects is protected health information under HIPAA. Where an employer offers a program directly, not as part of a group health plan, the health information it collects from employees is not protected by HIPAA, although other federal or state laws may apply. HHS adds that a self-administered employee welfare benefit plan with fewer than 50 participants is not a group health plan under HIPAA.

Inside a group health plan, the plan can give the employer, as plan sponsor, access to protected health information without the employee's written authorisation only for plan administration. The employer must first amend the plan documents and certify that it will separate plan administration staff from others, will not use the information for employment decisions, will safeguard electronic information and will report any misuse. An employer that does not administer the plan can generally receive only who is enrolled, and summary health information for modifying the plan or getting premium bids.

HHS also notes that the Privacy Rule does not protect employment records, even health-related ones, and that a health care provider cannot give an employer information about an employee without the employee's authorisation unless other laws require it.

What 'aggregate' and 'de-identified' mean

Aggregate means figures about a group, such as average cholesterol across everyone who took part. The ADA test is whether the figures disclose, or are reasonably likely to disclose, anyone's identity. Group size is the weak point, and the GINA regulation itself recognises that a small number of participants can make one person's information readily identifiable. In a team of eight, a department average covering two people tells a manager a great deal.

De-identified is a defined HIPAA term. Health information counts as de-identified only if a qualified expert documents that the risk of identifying anyone from it is very small, or if 18 kinds of identifiers are removed and there is no actual knowledge that what remains could identify someone. The 18 include names, geographic units smaller than a state, all date elements except the year, phone numbers, email addresses and record numbers.

Summary health information, which a plan may give a sponsor, is a different thing. The regulation says it may still be individually identifiable, and location only needs to be aggregated to a five-digit zip code. Words such as 'anonymised' in a sales deck are not the tests these rules use, so ask what they mean in practice.

Questions to ask any vendor

• Is this program part of our group health plan, or offered outside it, and which laws and contract terms govern the data as a result?
• Are you a HIPAA covered entity or business associate for this program? If not, what protections does our contract give participants?
• Can we see a sample of the exact report we will receive?
• What is the minimum group size before you report any figure, including for departments or sites?
• Who inside your company can see individual results, and are they licensed clinicians?
• Will you ever sell, share or use participants' data for marketing, and is taking part conditional on agreeing to that?
• Does any questionnaire ask about family medical history, and is every reward available whether or not employees answer those questions?
• What notice will employees get about what is collected, why and who sees it?
• Where is the data stored, how long is it kept, what happens when the contract ends, and how will you tell us and participants about a breach?
• Are incentives paid for taking part, or for hitting a health target?