Federal authorities, in two new announcements, have validated employers’ use of healthcare plan-related wellness programs to incent employees to obtain a COVID-19 vaccine and confirmed that the HIPAA privacy rules do not prevent employers from asking employees or other individuals if they have received a particular vaccine, including a COVID-19 vaccine.
The wellness program announcement, made by the Departments of Labor, Treasury and Health and Human Services (HHS) in the form of several frequently asked questions, also noted that employers may not deny healthcare plan eligibility or coverage of treatment of a COVID-19 infection based on vaccination status.
The HIPAA announcement, issued by HHS, reminds the public that the HIPAA privacy rules apply only to “covered entities” like health plans and healthcare providers, not employers acting in their capacity as employers, or in their capacity as business entities requesting information from customers and others.
Vaccine-related wellness programs
Lockton has, from the start of discussions about vaccine-related wellness programs, taken the position that a vaccine-related wellness program under a group healthcare plan is an activities-based, rather than a mere participation-based program, meaning (1) the incentive must be capped and (2) individuals with a health reason for not getting vaccinated must be offered a reasonable alternative method to obtain the incentive (or simply granted the incentive). Lockton also cautioned plan sponsors not to limit or exclude coverage of COVID-19 treatment with respect to unvaccinated healthcare plan enrollees.
Federal authorities confirmed those conclusions in the recent FAQs. The regulators make clear that a vaccine-based incentive is an activities-based wellness program because some individuals cannot or should not receive the vaccine due to their health status:
A premium discount that requires an individual to perform or complete an activity related to a health factor, in this case obtaining a COVID-19 vaccination, to obtain a reward would be considered a wellness program that must comply with the five criteria for activity-only wellness programs described in … the final wellness program regulations.
This means that the premium discount (or surcharge) cannot exceed 30% of the total cost of the employee’s coverage (i.e., the cost of self-only coverage, if the incentive is offered only to the employee). In addition, the 30% calculation must take into account other activities- or outcome-based incentives under the wellness program. Employees unable to obtain the vaccine due to a health condition (such as an allergy to vaccines) must either have the vaccine requirement waived, or they must be offered a reasonable alternative method for obtaining the incentive. And, as with any activity-based wellness program, the plan must provide notice of the availability of a reasonable alternative method.
Lockton comment:The FAQs indicate that a reasonable alternative could include requiring the employee to attest to complying with masking recommendations. Further, the FAQs note that employers could take other steps to ensure the wellness program is reasonable. The FAQs suggest, for example, that assisting employees with either receiving the vaccine (for a variety of reasons employers should not administer the vaccine, but could provide information on where to obtain the vaccine), or satisfying the alternative standard will help ensure the wellness program is not overly burdensome.
Some of our clients have wondered whether requiring the employee to regularly show proof of a negative COVID-19 test is a reasonable alternative to vaccination. We suspect that sort of alternative, if it does not become an unreasonable burden on the employee (and the employer pays for the regular testing), is permissible. It will be interesting to see how federal regulators mesh this issue regarding reasonable alternatives with vaccination alternatives that will apparently be allowed under the Biden administration’s plan to require federal employees, most healthcare entities, federal contractors and other larger employers to mandate vaccinations of employees or require weekly proof of a negative COVID-19 test.
Regulators also put the kibosh on denying or limiting coverage or treatment of a COVID-19 infection, if the affected individual was not vaccinated:
[Federal law and regulations] generally prohibit plans … from discriminating against participants, beneficiaries, and enrollees in eligibility, premiums, or contributions based on a health factor … Accordingly, plans … may not discriminate in eligibility for benefits or coverage based on whether or not an individual obtains a COVID-19 vaccination.
Regulators also confirmed that, when determining the affordability of an individual’s healthcare coverage offer under the Affordable Care Act’s employer mandate, employers must assume that nobody qualified for a vaccine-related premium discount (or, in the case of a surcharge, everyone suffered the surcharge).
Lockton comment:The FAQs also addressed the mandate, imposed by Congress last year on non-grandfathered healthcare plans, to provide coverage of COVID-19 vaccinations and their administration without cost sharing. Earlier guidance suggested that the mandate applied to any federally-approved or authorized vaccine starting 15 business days after the approval or authorization of that particular vaccine. Regulators have now changed their minds; they believe the coverage mandate for approved or authorized vaccines took effect on Jan. 5, 2021, and applies to any subsequently approved or authorized vaccine immediately upon the vaccine’s approval or authorization.
The new FAQs also make clear regulators’ view that the mandate also applies to coverage of “the administration of an additional dose to certain individuals, administration of booster doses, or the expansion of the age demographic for whom the vaccine is authorized or approved.”
HIPAA privacy and vaccine status
Many employers have had employees question whether the employers’ inquiries or requests for documentation about employees’ COVID-19 vaccination status is a violation of the HIPAA privacy rules. HHS’s guidance assures businesses that HIPAA does not prevent such inquiries. In other words, businesses may ask employees (and others, such as customers) about vaccination status or request documentation without implicating HIPAA privacy concerns. In addition, if an individual volunteers their vaccination status to a colleague or business owner, the HIPAA privacy rules will not come into play.
Lockton comment:The focus here is on HIPAA medical privacy concerns with regard to requests for vaccination status and an individual’s own disclosure of such information to an employer. Keep in mind that other federal or state laws, not addressed here, may affect how businesses handle the information once it is received (e.g., the ADA requires vaccination records to be kept confidential).