lead-magnets

Employer Wellness App Privacy Audit Checklist

A checklist for evaluating workplace health and wellness apps, covering what data employers can access, HIPAA applicability, and your opt-out rights.

The Core Problem: HIPAA Probably Does Not Apply Most employees assume that their health data in a workplace wellness app is protected by HIPAA. This assumption is usually wrong. The gap between expectation and reality is where privacy risk lives. HIPAA applies to covered entities: healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses. It also applies to their business associates, meaning companies that handle protected health information on behalf of covered entities. Employer wellness platforms occupy a gray area. If your employer's wellness vendor contracts directly with your health plan (the insurer), HIPAA may apply to that relationship. If the vendor contracts directly with your employer as a general corporate wellness benefit, HIPAA likely does not apply. The distinction is contractual, not functional. The same app handling the same data can be HIPAA covered or not, depending on who signed the contract. What this means for you: The wellness app's privacy policy is your primary protection, not federal health privacy law. Privacy policies are changeable, enforceable only by the FTC (which acts on deception, not on permi