Most employees assume HIPAA covers everything their employer learns about their health through a wellness program. That assumption is understandable, and it’s also incorrect. The gap between what people believe is protected and what the law actually shields is wide enough to drive a data breach through.

Here’s a quick look at what this post covers:

• When HIPAA applies to employer wellness programs and when it doesn’t
• What the February 2026 HIPAA update changed for substance use disorder records
• What employers can legally access without violating a single rule
• Which other laws pick up where HIPAA leaves off
• What every employee should ask before enrolling in any wellness program

When HIPAA Applies and When It Doesn’t

HIPAA’s reach inside the workplace depends entirely on structure. If a wellness program is connected to a group health plan, it falls under HIPAA. The plan is the covered entity, and your protected health information held by that plan is shielded accordingly.

But if an employer runs a wellness program outside the group health plan, funded independently and administered directly, HIPAA doesn’t apply. The employer isn’t acting as a covered entity. It’s acting as an employer. That’s a different legal category, and it carries far fewer restrictions on what happens with your data.

This isn’t a loophole. It’s by design. Understanding the difference between informed participation and a surprise.

What the February 2026 HIPAA Update Actually Changed

The February 2026 update to HIPAA’s Notice of Privacy Practices requirements introduced tighter protections specifically for substance use disorder records. Plan sponsors now face new disclosure obligations about how this category of information is handled, shared, and protected.

Why does this matter? Substance use disorder data carries unique risks, professional, social, and financial. The update signals that regulators are paying closer attention to sensitive health categories inside workplace benefit structures. For plan administrators, compliance isn’t optional. For participants, it’s worth knowing these specific protections now exist and asking whether your plan’s Notice of Privacy Practices reflects them.

The Employer vs. Plan Sponsor Distinction

Here’s where most explanations get fuzzy. HIPAA protects health information held by the health plan. It does not protect health information held by the employer in its capacity as an employer.

When a company acts as a plan sponsor, it takes on certain HIPAA obligations. But the moment that same company processes health data through an HR function, outside the plan, it’s operating under a different legal role. Same organization. Different rules.

This distinction is why how employers structure their health benefit models matters far beyond the fine print of an enrollment form.

What HIPAA Does Not Protect

Several common wellness program components fall completely outside HIPAA’s scope:

• Wearable device data collected through employer-sponsored challenges
• Self-reported health assessments not connected to plan enrollment
• Biometric screenings administered directly by the employer
• Survey responses about lifestyle habits, stress levels, or mental health

None of these are automatically protected under federal privacy law simply because they’re health-related. They require protection from other sources, and those sources are inconsistent.

H2: Where Other Laws Step In

The Americans with Disabilities Act limits how employers can use disability-related health information gathered through voluntary wellness programs. The Genetic Information Nondiscrimination Act restricts incentivized collection of genetic data. State laws, including California’s CPRA and Virginia’s VCDPA, add another layer, but only for residents of those states.

For wellness programs that cross into research, ethics frameworks like IRB oversight provide structure that HIPAA alone doesn’t require. This layered approach is increasingly relevant as predictive analytics enter chronic disease management at the employer level. Multiple frameworks working together offer more protection than any single law can.

What a Well-Structured Wellness Program Should Look Like

Strong privacy practices don’t require legislation to mandate them. They reflect organizational design choices. Look for these in any program worth trusting:

• De-identification standards that remove personally identifiable information before any analysis
• Aggregate-only reporting to the employer, so results reflect population trends rather than individual profiles
• Third-party administration that creates structural distance between employer decision-makers and individual health data
• Voluntary participation with real opt-out rights and clear data retention policies

LifeX Research builds these principles into its operational framework. Research Associates, the participants who contribute health data to LifeX studies, do so voluntarily and with full disclosure of how their information is used. Employers connected to the program receive population-level insights, not individual records. The structure isn’t just policy. It’s the architecture itself.

As ethical data use in predictive medicine becomes a standard expectation rather than a differentiator, this kind of structural accountability will define which programs earn long-term trust.

Questions to Ask Before You Enroll

Before signing up for any employer wellness program, these questions are worth raising with HR, with the program administrator, or with whoever hands you the enrollment form:

• Is this program connected to my group health plan, or does the employer run it separately?
• Who administers it, the employer directly or an independent third party?
• What data is collected, and in what form does my employer receive it?
• Can I withdraw, and what happens to my data if I do?
• Does the program follow de-identification standards, or can individual records be traced back?

Asking these questions isn’t paranoia. It’s due diligence. Any program worth participating in should have clear answers ready.

Closing

HIPAA is a meaningful protection, but it wasn’t written to cover every corner of the modern workplace wellness industry. Knowing where its authority ends is the starting point for making informed decisions about your own health data.

The programs worth trusting are the ones that protect your information, whether the law requires it or not.