Many companies offer wellness programs, but few employees are aware of just how much private data they are giving away when they use them
It sounds outlandish that your employer-sponsored wellness program could learn if you stop birth control. Or know how susceptible you are to diabetes based on your credit card history, which reveals what you spend on everything from gym membership to where you eat. But a recent report in the Wall Street Journal says that they can do just that.
Most people think that the information collected in employer wellness programs is covered under health privacy laws, so they dont worry about the personal information that gets collected. But they should worry, because most wellness program data doesnt fall under federal health privacy laws, and programs have greatly expanded the scope of their data collections.
Today, employers and their wellness program consultants often request consent from employees for access to health records. They may also ask for consent to genetically test employees in wellness programs. For example, one employer wellness program asked employees to consent to genetic testing for three susceptibility genes related to obesity. Now, some also purchase personal data about employees from commercial data brokers, without employees knowledge.
Commercial data broker information can be quite detailed and personal. The data can range from purchase histories to hobbies to reading habits to charitable donations to locations frequented, all non-work related activities. When wellness companies analyze this data to predict health and behavior, some use the predictions to pressure specific employees to act in healthier ways. That is, healthier according to non-transparent and unverified analytics, and not according to published medical research.
These activities dance around the edges of health and other laws meant to protect employee privacy, ensure fairness and provide due process. For example, recent reports suggest that some wellness programs use credit scores to predict employee health. The Fair Credit Reporting Act limits the use of credit records and credit scores derived from those records. According to the law, everyone must have a legally permissible purpose to use credit records.
However, to evade the law, some big data companies use aggregate credit scores as a stand-in for regulated credit scores. Unregulated aggregate credit scores rely on information about geographical area, shopping habits, propensity to vote and other digital exhaust. These scores supposedly mirror actual credit scores (none too accurate themselves), and they come with no regulatory strings because they apply to a group of individuals, not just one person. In short, data companies may allow employers to do indirectly what they cannot do directly.
Not only do wellness programs sometimes collect and use personal data outside of regulatory environments, they also create new pools of sensitive personal data that lack privacy protections. For example, when wellness programs cull information from employee health claims (legal if it is done with consent) this is a new data pool and it does not have privacy protections under the main federal health privacy rule.
Few people realize that the rule known as Health Insurance Portability and Accountability Act (Hipaa) only protects health data held by health care providers and insurers. Unless a fully Hipaa-covered entity, like a health care provider or insurer, operates a wellness program, data collected by and for the wellness program may have no privacy protection at all.
There are hot disputes whether wellness programs actually save money. However, it may not matter if employees dont do what they are told (lose 20lb!) and must pay more of their share of health insurance as a result. Shifting costs may be the real savings for employers.
Unfettered data promiscuity does not always make for a better world. Analytics that use statistical correlations rather than proven causation to predict the right way to live our lives is not progress. We need legal and ethical limits with balanced and fair rules. If an employer wellness plan uses your personal data to predict your health, make a decision about you, or offer you health advice, you should have rights. These rights include the right to know what data they have and where they obtained it. You should have the right to see your own data and to correct it if it is wrong. You should have the right to say no to data uses that offend you.
In the end, the creepiness inherent in many employer wellness programs may be the cause of their demise. Do we really want to live in a world in which our voting records are used to predict our health? Do we want our retail purchases, made in our private, non-working time, to become part of what our employers use to predict our health needs?
We have few privacy laws covering the data that wellness programs collect, and the big data companies are learning to evade the laws that we do have. These practices are likely to create a greater demand for more employee privacy protections than what is currently available. Congress may never act, but someday, the states probably will. Until then, watch for opt outs, and take them when you can.