Corporate wellness program marketing to employers

A practice or clinic that sells a wellness or screening program to an employer is selling into a space with three sets of federal rules. If the program gives rewards tied to the employer’s group health plan, the HIPAA nondiscrimination rules for wellness programs apply. If the program asks health questions or includes biometric screening, the Americans with Disabilities Act applies, and if it asks about family medical history, the Genetic Information Nondiscrimination Act does too. Then there is the question of who sees the results, which depends on whether the program runs through the health plan or directly through the employer.

This guide covers what is specific to wellness programs sold to employers. Employer pages, account setup, post-offer exams and what findings an employer can receive from injury care are covered in our guide to occupational medicine marketing. Running a screening table at an event is covered in our guide to health fair and screening event marketing, and the wording rules for genetic tests and GINA in our guide to genetic testing marketing. Selling onsite or direct-contract care to an employer, beyond wellness screening, is covered in our guide to marketing a practice directly to employers. Coaches who work inside employer programs should read health coach marketing.

This is general information, not legal or medical advice. Sources cited were checked on October 29, 2026: 29 CFR 2590.702(f), 45 CFR 146.121(f) and 26 CFR 54.9802-1(f) (current eCFR text); 42 U.S.C. 300gg-4(j); 29 CFR 1630.14(d) and 29 CFR 1635.8(b)(2) (current eCFR text); 42 U.S.C. 12112(d)(4) and 2000ff-1(b)(2); the EEOC final rules removing the ADA and GINA wellness incentive sections (83 FR 65296, December 20, 2018, effective January 1, 2019) and the ADA appendix discussion (89 FR 55520, July 5, 2024); 45 CFR 164.504(f); the HHS page on HIPAA and workplace wellness programs (content last reviewed April 20, 2015); 15 U.S.C. 45; and the FTC Health Products Compliance Guidance. Privacy and employment rules are also set state by state. Have the employer’s benefits counsel review program terms and rewards before you market them.

First question: is the program part of the health plan?

HHS explains that the HIPAA Rules apply to covered entities and business associates, not to employers in their capacity as employers, so how HIPAA applies to a workplace wellness program depends on how the program is structured. Where the program is offered as part of a group health plan, the individually identifiable health information collected from or created about participants is protected health information. Where an employer offers the program directly and not as part of a group health plan, HHS says the health information the employer collects from employees is not protected by the HIPAA Rules, although other federal or state laws may apply.

HHS gives an example of the first kind: incentives or rewards related to group health plan benefits, such as reductions in premiums or cost-sharing amounts, in exchange for participation. HHS also notes that a self-administered employee welfare benefit plan with fewer than 50 participants is not a group health plan under 45 CFR 160.103, and so is not a HIPAA covered entity.

For marketing, this means your sales page and proposal should not describe the program’s privacy terms until you know which structure the employer uses. A line such as “your results are protected by HIPAA” can be true for one employer and false for another. Ask the employer and its benefits counsel how the program will sit, then write the privacy description to match.

Rewards tied to the health plan: participatory and health-contingent programs

The HIPAA nondiscrimination rules for wellness programs appear three times in nearly identical form: 29 CFR 2590.702(f) (Labor), 45 CFR 146.121(f) (HHS) and 26 CFR 54.9802-1(f) (Treasury), all resting on 42 U.S.C. 300gg-4(j). They sort programs into two kinds.

Participatory programs. None of the conditions for a reward is based on meeting a standard related to a health factor, or there is no reward. The rule’s examples include reimbursing fitness center fees, a diagnostic testing program that rewards participation without basing any part of the reward on outcomes, and a reward for completing a health risk assessment with no further action required. These programs must be available to all similarly situated individuals, regardless of health status (paragraph (f)(2)).
Health-contingent programs. The individual must meet a standard related to a health factor to get the reward. An activity-only program requires an activity, such as a walking, diet or exercise program, without requiring a specific health outcome. An outcome-based program requires a specific health outcome, such as not smoking or certain results on biometric screenings.

Health-contingent programs carry five requirements under paragraphs (f)(3) and (f)(4): an opportunity to qualify at least once per year; a cap on the reward; reasonable design to promote health or prevent disease; a full reward available to all similarly situated individuals through a reasonable alternative standard or waiver; and a notice of that alternative. The cap in paragraph (f)(5) is 30 percent of the total cost of coverage, rising by 20 percentage points, to 50 percent, to the extent the extra amount is tied to a program designed to prevent or reduce tobacco use. Cost of coverage counts both employer and employee contributions.

The notice rule is the one that reaches marketing copy directly. The plan or issuer must disclose the availability of a reasonable alternative standard, with contact information and a statement that recommendations of an individual’s personal physician will be accommodated, in all plan materials describing the terms of a health-contingent program. For outcome-based programs, the disclosure must also appear in any notice telling an individual they did not meet the initial standard. If plan materials merely mention that a program is available without describing its terms, the disclosure is not required. Paragraph (f)(6) gives sample language that can be used.

So if you write the flyer, enrollment page or results letter for an employer’s health-contingent program, and it describes the reward terms, build the alternative standard notice into the template. The plan sets the reward and the terms. Your job is to describe them accurately and include the notice, not to promise the employer that a reward design is compliant.

ADA and GINA: what the EEOC rules say today

The ADA allows voluntary medical examinations, including voluntary medical histories, that are part of an employee health program available to employees at the work site (42 U.S.C. 12112(d)(4)(B)). The EEOC regulation at 29 CFR 1630.14(d) adds conditions. As of October 29, 2026, the current eCFR text says:

The program must be reasonably designed to promote health or prevent disease. A program that only measures, tests or collects health information without giving participants results, follow-up information or advice is not reasonably designed, unless the collected information is used to design a program addressing at least a subset of the conditions found.
A program is also not reasonably designed if it exists mainly to shift costs to targeted employees based on their health, or simply to give the employer information to estimate future health care costs.
To be voluntary, the employer may not require participation, deny or limit group health plan coverage for non-participation, or take adverse action against or retaliate against employees, and must give employees a notice they are reasonably likely to understand. The notice describes what medical information will be obtained, the purposes, who it will be shared with, the restrictions on disclosure and the methods used to prevent improper disclosure.
The employer may receive information from the program only in aggregate terms that do not disclose, or are not reasonably likely to disclose, the identity of any employee, apart from the narrow exceptions in the rule and as needed to administer the health plan.
The employer may not require employees to agree to the sale, exchange, sharing, transfer or other disclosure of medical information, or to waive confidentiality protections, as a condition of participating or earning an incentive.

The incentive limit is a different story. The EEOC issued rules in 2016 that set limits on wellness incentives under both the ADA and GINA. A federal court vacated those incentive sections, and the EEOC removed them effective January 1, 2019 (83 FR 65296, published December 20, 2018). In 2024 the EEOC also removed the related discussion from the ADA appendix (89 FR 55520, July 5, 2024). In the current eCFR text, 29 CFR 1630.14(d)(3) and 29 CFR 1635.8(b)(2)(iii) both read “[Reserved]”. The voluntariness requirement in the statutes remains, and no current EEOC regulation sets a number for how large an incentive can be before a program stops being voluntary. Do not market a program as “EEOC approved” or as having an incentive level that is safe under the ADA or GINA. Point the employer to its own counsel on incentive size, and recheck the eCFR text before you rely on this, since the EEOC can issue new rules.

Health risk assessments and family history under GINA

GINA bars employers from requesting, requiring or purchasing genetic information about an employee or a family member, with exceptions. One exception covers health or genetic services offered by the employer, including as part of a wellness program, where the employee gives prior, knowing, voluntary and written authorization, and individually identifiable results go only to the employee and the licensed health care professional or board certified genetic counselor involved, with the employer receiving only aggregate information that does not identify specific employees (42 U.S.C. 2000ff-1(b)(2)).

Family medical history counts as genetic information, and that shapes health risk assessment design. Under 29 CFR 1635.8(b)(2)(ii), an employer may not offer an inducement for individuals to provide genetic information, but may offer an inducement for completing a health risk assessment that includes family history questions if it makes clear, in language reasonably likely to be understood, that the inducement is available whether or not the participant answers the genetic information questions. The rule’s own example finds a violation where the instructions do not say which questions must be answered to get the reward.

If your program uses a health risk assessment, mark the family history questions as optional on the form itself and in any email or page that describes the reward. The regulation also bars conditioning participation or an inducement on agreeing to the sale, exchange or other disclosure of genetic information (paragraph (b)(2)(iv)), and bars denying health coverage or retaliating because a spouse declines to provide information about their own health to the program (paragraph (b)(2)(v)).

Who sees results: the plan, the employer and your practice

An employer will ask what reports it will receive. The answer has to come from the rules above, not from the sales deck.

Individual results go to the participant. Under GINA, individually identifiable results of health or genetic services go only to the employee and the professionals involved. Under the ADA rule, a program that gives no results or follow-up is not reasonably designed.
The employer gets aggregate information. Both the ADA rule and GINA limit what the employer receives to aggregate terms that do not identify individuals. The ADA rule adds “or are not reasonably likely to disclose”, which matters for a small employer or a small department where a report broken out by group could point to one person. GINA’s rule says an employer does not violate the aggregate requirement if, for reasons outside the provider’s and employer’s control, such as a small number of participants, the information makes one person readily identifiable with no effort on the employer’s part. Do not design reports with breakouts small enough to identify someone.
Health plan programs add HIPAA limits. Where the program runs through a group health plan, the plan may give the employer as plan sponsor access to protected health information for plan administration only if the plan documents are amended and the sponsor certifies, among other things, that it will not use or disclose the information for employment-related actions (45 CFR 164.504(f)). Without that, HHS says the plan generally may disclose to the sponsor only enrollment information and summary health information requested for premium bids or for changing the plan.

Your own practice’s obligations do not disappear because the buyer is an employer. If your practice is a covered entity, the results it holds are protected health information whether or not the employer’s program is covered by HIPAA. Disclosures to employers and the narrow workplace exceptions are covered in our occupational medicine guide. Never describe a report option that would send an employer identifiable results without the authorization the rules require.

Executive physicals bought for a company’s leaders raise their own claim and privacy questions, covered in our executive physical marketing guide.

Claims you make to employers

Claims about savings, fewer sick days or lower claims costs can look like a strong close in a proposal to an employer. Under 15 U.S.C. 45, deceptive acts or practices in commerce are unlawful, and the FTC’s Health Products Compliance Guidance applies to health claims about any product or service. It says health benefit claims need competent and reliable scientific evidence, and that an ad can make implied claims through images and context as well as through words.

A return on investment figure, a claims reduction percentage or a promise of fewer sick days is an outcome claim. Do not put one in a proposal unless you hold evidence for that claim for programs like yours, and do not borrow a figure from a study of a different program, population or design. Describe instead what the program delivers: which screenings, who performs them, how results reach participants, what follow-up is offered, how the reasonable alternative works and what aggregate reports the employer receives. The ADA rule itself says a program that exists simply to give an employer information to estimate future health care costs is not reasonably designed, so a pitch built on that idea works against the employer.

Illustration: a clinic that adds employer wellness screening

Illustration: a primary care clinic that already does occupational medicine work adds an onsite screening and coaching program for local employers. Before writing the sales page, it asks each prospect whether the program will run through the group health plan and whether any reward will be tied to premiums. The sales page describes the services, who performs them, how participants get their own results and follow-up, and that employers receive aggregate reports only. It contains no savings figures. The clinic’s health risk assessment marks family history questions as optional and says on the first screen that the reward does not depend on answering them. For employers with a health-contingent reward, the clinic’s flyer template includes a reasonable alternative standard notice with a blank for the plan’s contact details and the physician recommendation statement, and the clinic asks the employer’s benefits counsel to fill in and approve the terms. Aggregate reports are not broken out for groups so small that a result could point to one person.

Checklist

You know whether each employer’s program runs through the group health plan or directly through the employer before you describe privacy terms (HHS workplace wellness page).
Participatory programs are open to all similarly situated individuals, regardless of health status (29 CFR 2590.702(f)(2)).
Materials describing a health-contingent program’s terms include the reasonable alternative standard notice, contact information and the personal physician statement (29 CFR 2590.702(f)(3)(v), (f)(4)(v)).
Reward size, frequency and alternatives are set by the plan and its counsel, not promised by you (29 CFR 2590.702(f)(3)-(5)).
Screenings come with results and follow-up for participants (29 CFR 1630.14(d)(1)).
The ADA notice explains what information is collected, why, who sees it and how it is protected (29 CFR 1630.14(d)(2)(iv)).
Family history questions are clearly optional and the reward does not depend on them (29 CFR 1635.8(b)(2)(ii)).
Employers receive aggregate reports only, with no breakouts small enough to identify someone (29 CFR 1630.14(d)(4)(iii); 42 U.S.C. 2000ff-1(b)(2)(D)).
Participation never requires agreeing to sell or share health or genetic information (29 CFR 1630.14(d)(4)(iv); 1635.8(b)(2)(iv)).
No “EEOC approved” or “safe incentive level” wording, and incentive questions go to counsel (83 FR 65296).
No savings, return on investment or absence reduction figures without evidence for that claim (15 U.S.C. 45).

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and the businesses that serve them. On a medical website design project for a clinic that sells to employers, we can build employer service pages that describe the program and reporting accurately, health risk assessment and enrollment pages with optional family history questions marked as optional, and flyer and results letter templates with space for the plan’s alternative standard notice. We leave reward design, plan documents and incentive questions to the employer and its counsel. Our AI front desk is built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not sell lead lists and do not pay for referrals. For the wider set of rules we follow, see our healthcare marketing rules hub.

Does HIPAA cover a workplace wellness program?

It depends on the structure. HHS says that where the program is offered as part of a group health plan, the health information collected is protected health information, and where an employer offers the program directly and not through a group health plan, the information the employer collects is not protected by the HIPAA Rules, although other federal or state laws may apply.

How large can a wellness reward be under the HIPAA rules?

For health-contingent programs tied to a group health plan, 29 CFR 2590.702(f)(5) sets the cap at 30 percent of the total cost of coverage, rising to 50 percent to the extent the extra amount is for a program designed to prevent or reduce tobacco use. The plan and its counsel set the reward.

Is there an EEOC limit on wellness incentives?

Not in the current regulations. The EEOC removed the ADA and GINA incentive sections effective January 1, 2019, after a federal court vacated them, and in the current eCFR text both paragraphs read Reserved. The statutes still require that medical examinations and inquiries in these programs be voluntary, so incentive questions belong with counsel.

Can an employer see an individual employee’s screening results?

The ADA rule and GINA limit what the employer receives from the program to aggregate information that does not identify individuals, with narrow exceptions. Where the program runs through a group health plan, 45 CFR 164.504(f) also limits what the plan can share with the employer as plan sponsor.

Can a health risk assessment ask about family medical history?

It can include those questions, but under 29 CFR 1635.8(b)(2)(ii) an inducement for completing the assessment is allowed only if it is clear that the reward is available whether or not the participant answers the genetic information questions.

Can we tell employers our program will lower their health care costs?

Only with evidence that supports that claim for a program like yours. Under 15 U.S.C. 45 deceptive claims are unlawful, and the FTC says health benefit claims need competent and reliable scientific evidence. Describing what the program delivers is safer than quoting savings figures.

Sources

More in Health companies, vendors and employers

Corporate wellness program marketing: selling screenings and wellness programs to employers