lead-magnets

Employer Wellness App Privacy Audit Checklist

A checklist for evaluating workplace health and wellness apps, covering what data employers can access, HIPAA applicability, and your opt-out rights.

The Core Problem: HIPAA Probably Doesn't Apply Most employees assume that their health data in a workplace wellness app is protected by HIPAA. This assumption is usually wrong, and the gap between expectation and reality is where privacy risk lives. HIPAA applies to covered entities: healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses. It also applies to their business associates — companies that handle protected health information on behalf of covered entities. Employer wellness platforms occupy a gray area. If your employer's wellness vendor contracts directly with your health plan (the insurer), HIPAA may apply to that relationship. If the vendor contracts directly with your employer as a general corporate wellness benefit, HIPAA likely does not apply. The distinction is contractual, not functional — the same app handling the same data can be HIPAA covered or not depending on who signed the contract. What this means for you: The wellness app's privacy policy is your primary protection, not federal health privacy law. Privacy policies are changeable, enforceable only by the FTC (which acts on deception, not on permissiv