Workplace wellness programs: legal rules and what the evidence shows

A workplace wellness program is legal if it fits three overlapping rule sets: the HIPAA and Affordable Care Act nondiscrimination rules for group health plans, the ADA's limits on medical inquiries and exams, and GINA's limits on genetic information. In 2026 the open question is the size of the incentive the ADA and GINA allow, because the EEOC's incentive limits were removed in 2019 and no replacement is in force. The evidence that these programs save money is thin, so design them for engagement and risk reduction, not as a savings plan.

Two kinds of program

Participatory programs reward people for taking part regardless of results: a gym membership discount, completing a health risk assessment, attending a seminar. Under the HIPAA/ACA rules in the group health plan regulations, a participatory program that is available to all similarly situated individuals does not trigger the incentive cap.

Health-contingent programs reward people for meeting a health standard. They come in two types:

• Activity-only: complete an activity such as walking a certain amount.
• Outcome-based: reach or maintain a result, such as a cholesterol level, blood pressure or tobacco-free status.

Health-contingent programs that are part of a group health plan must satisfy five conditions under the federal rules (29 CFR 2590.702): the program must offer an opportunity to qualify at least once a year; the reward must not exceed 30% of the total cost of employee-only coverage, or 50% if the program targets tobacco use; the program must be reasonably designed to promote health; it must offer a reasonable alternative standard (or a waiver) to anyone for whom the standard is unreasonably difficult or medically inadvisable; and the plan must disclose the alternative in program materials. The 30% limit is measured against the cost of coverage, which includes the employer and employee shares, and rises to 30% of the family plan cost if dependents may also participate.

The ADA: voluntary medical inquiries

The ADA restricts disability-related inquiries and medical exams, but allows them as part of a voluntary employee health program. Biometric screenings and health risk assessments that ask about medical history are the usual triggers. EEOC regulations require that the program be reasonably designed to promote health, that participation be voluntary, that the employer not require participation or deny coverage for non-participation, and that medical information be kept confidential and used only in aggregate form, except for administering the plan. The employer must also provide notice of what information is collected, how it is used and who sees it.

Participation cannot be coerced. What counts as coercion has been the unsettled question.

GINA: family history and genetic information

GINA's Title II bars employers from using genetic information, including family medical history, in employment decisions and limits requests for it. A wellness program may ask for it only if the employee gives prior written authorization and the request is a voluntary part of the program. Rules on incentives tied to a spouse's genetic information, such as family medical history disclosed on a health risk assessment, are part of the same unsettled incentive question. Health risk assessments that ask about family history are the most common GINA exposure. Best practice is to leave family history questions out unless you have a clear reason and a written authorization process.

Where the EEOC incentive limits stand in 2026

The EEOC's 2016 final rules under the ADA and GINA treated a wellness program as voluntary only if the incentive did not exceed 30% of the cost of self-only coverage. AARP challenged the limits, and a federal court ruled in 2017 that the agency had not justified them, and the court vacated the incentive provisions effective January 1, 2019. The EEOC removed them from its regulations. In January 2021 the EEOC issued two proposed rules that would have allowed only de minimis incentives, but they were withdrawn from the Federal Register before publication because of the new administration's regulatory freeze, and the EEOC confirmed the withdrawal.

As of the time this guide was reviewed in October 2026, we found no replacement rule and no final guidance in effect on incentive limits. That leaves employers relying on the voluntariness requirement itself and the statute. Courts and lawyers disagree about how large a reward is too large. Many employers stay within the HIPAA 30% and 50% limits as a ceiling, use participatory designs that avoid medical questions, and provide a non-medical alternative to earn the same reward. Because the rules can change, check the EEOC's site and speak to employment counsel before launching a program that rewards biometric results.

There is a bona fide benefit plan exception in the ADA that some employers rely on, but its scope has been questioned in the cases. Employers shouldn't count on it.

Taxes and benefit design

• Cash and gift cards are taxable wages, including payroll taxes.
• Premium discounts for a wellness program are generally not taxable because they reduce the employee's contribution; the HIPAA limits apply.
• HSA contributions as a reward can be made through a cafeteria plan without comparability issues, within the HSA limits ($4,400 self-only and $8,750 family for 2026, per IRS Rev. Proc. 2025-19). See HDHPs and HSAs: an employer guide with 2026 limits.
• Gym memberships and fitness reimbursements are generally taxable. IRS Publication 15-B lists on-premises athletic facilities as an excludable fringe benefit, but memberships to outside gyms are not covered.
• A wellness program offered as part of a group health plan is an ERISA welfare plan feature and can bring ERISA disclosure duties.

Non-health-plan wellness benefits such as an EAP are separate (see Employee assistance programs (EAPs): what they cover and how to buy one). If the program collects health data, HIPAA privacy rules apply when it is run through a group health plan, and state privacy law may apply when it is not. Biometric data can raise state-law issues, so ask your vendor how it stores and shares data. Wellness benefits also belong in the overall package; see building an employee benefits package that fits your budget and group health insurance for small businesses: how it works and what it costs, and fully insured vs self-funded health plans: which fits your business for how funding affects what data the employer can see.

What the research says

The best-known randomized trial, the Illinois Workplace Wellness Study (Jones, Molitor and Reif, NBER working paper 24229, later published in the Quarterly Journal of Economics in 2019), assigned nearly 5,000 University of Illinois employees to a treatment group offered a wellness program and a control group. The program raised health screening rates, but the authors found no significant causal effects on medical spending, health behaviors, employee productivity or self-reported health in the first year. Employees who chose to participate were already lower-cost than those who did not, so a comparison of participants and non-participants overstates savings.

The point is limited. It tested one program at one employer, and a different design might work differently. The practical lesson for small employers is to avoid promising a cost reduction, to measure participation and outcomes honestly, and to choose features employees will use.

Designing a program that survives scrutiny

1. Start with a participatory design: a walking challenge, a lunch-and-learn, a smoking-cessation benefit open to all.
2. Keep rewards modest and give the same reward to people who cannot take part for medical reasons.
3. If you offer a biometric screening, collect results through a third-party vendor, receive only aggregate data, and keep it separate from personnel files.
4. Avoid asking about family history or other genetic information unless counsel has signed off.
5. Give the required notice and a way to request an alternative.
6. Check state law on the use of tobacco status and on employee privacy.
7. Document the program's purpose and review it annually.

Worked example (hypothetical)

Say a 70-employee distributor charges tobacco users $60 more a month than non-users for single coverage. The employee-only coverage costs $600 a month in total, so the 50% tobacco limit allows a reward or surcharge up to $300 a month. The $60 surcharge sits well inside that, but the plan must still give tobacco users a way to avoid it, such as completing a cessation class, and must tell them about it in writing. If a tobacco user in the program has a medical reason they cannot quit, the plan offers the alternative or waives the surcharge. If the employer also wants a biometric screening, it routes the screening through the vendor, offers a non-medical alternative to earn any reward, and does not look at individual results.

Key takeaways

• Wellness programs sit under three rule sets: HIPAA/ACA (30% of coverage cost, 50% for tobacco, reasonable alternatives), the ADA (voluntary, confidential) and GINA (careful with family history).
• EEOC incentive limits under the ADA and GINA were removed effective January 1, 2019, and the 2021 proposals were withdrawn; as of October 2026 we found no replacement rule.
• Participatory designs with modest rewards and a non-medical alternative carry the least legal risk.
• Cash and gift card rewards are taxable; premium discounts and HSA contributions through a cafeteria plan are not.
• Research does not support a promise of cost savings, so measure engagement and outcomes rather than assuming a return.