Wellness programs sound great. They attack one of the root causes of rising healthcare costs: increasing demand for healthcare. By helping employees become healthier, and avoiding medical intervention, an employer will pay less for providing health coverage to those employees. Employees like being healthy, so they are happy, too. So why isn’t everyone doing it?

In general, there are two types of wellness programs. Health-contingent programs require employees to meet a specific health outcome, such as a target weight, cholesterol level or blood pressure. Participatory programs indirectly support healthy lifestyles with incentives such as diagnostic testing or screening, smoking cessation classes or gym membership reimbursements. As a result, they avoid many of the potential problems that health-contingent programs have with the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA).

The Equal Employment Opportunity Commission (EEOC), the federal agency that enforces the ADA and GINA, began aggressively challenging health-contingent wellness programs in 2012. Two recent cases illustrate the EEOC’s concern:

In a lawsuit against Orion Energy Systems in Wisconsin, the EEOC claimed Orion’s program violated the ADA because it required employees to complete a health-risk questionnaire and screening. Orion argued that its wellness program did not violate the ADA because it complied with a “safe harbor” provision in the ADA that shields such programs from liability if they are “voluntary.” The court ruled in September that Orion’s wellness program did not violate the ADA because it was voluntary, despite the fact that not participating in it meant that an employee had to pay 100 percent of the employee’s healthcare premiums.

The EEOC also sued Flambeau, Inc. (also in Wisconsin) after Flambeau discontinued an employee’s health insurance when he refused to take a health risk assessment and biometric test as part of Flambeau’s wellness program. The court ruled that Flambeau’s wellness program also fell under the ADA’s safe harbor. The EEOC has appealed, as it likely will with Orion.

A key issue in these lawsuits is the ADA’s safe-harbor provision, which exempts wellness plans from the ADA restrictions if the plan is associated with a voluntary insurance program. In response to these and other recent cases that employers won, the EEOC recently issued new regulations that provide this statutory safe harbor is not only subject to its regulations, but that those new regulations (effective in January 2017) will eliminate that safe-harbor. This far exceeds the traditional use of administrative agency power as being limited to interpret statutory law, not repeal it.

Under the new EEOC regulations, beginning in January there are five critical requirements that a wellness plan must satisfy:

Promote health or prevent disease. Wellness programs must be “reasonably designed to promote health or prevent disease.” Employers cannot collect employees’ health-related data without providing advice, counseling or follow-up information to the employees based on that data.

Be voluntary. Employers cannot force employees to participate in a wellness program or penalize them for abstaining from one. Threatening employees to join a wellness program or taking job-related action for those that do not violates this “voluntary” mandate (but see allowable incentives, below).

Comply with the EEOC’s limitations on incentives. The general rule—with lots of exceptions—is if employees must be enrolled in a specific health plan in order to participate in the wellness program, companies may offer financial incentives up to 30 percent of the total cost of self-only healthcare coverage.

Comply with notice rules. If a wellness program requests medical information or includes any disability-related inquiries, employers must provide written notice to employees describing what information will be collected, the purpose of collecting the information, how such data will be used, who will receive it and how the employer will prevent unauthorized disclosure of the data.

Keep medical information confidential. If an employer collects employee health data, it must comply with the Health Insurance Portability and Accountability Act (HIPAA). For example, employees not administering the wellness plan cannot have access to that health information. Failing to do so not only violates the EEOC regulations, it also triggers HIPAA penalties, which are extremely punitive.

In addition, the ADA’s requirement to reasonably accommodate disabled employees also applies to wellness plans. For example, a wellness plan has to accommodate employees with medical conditions that prevent them from taking a biometric test. Additionally, employers may need to provide program material in different formats to allow visual and hearing-impaired employees to participate in the program.

Wellness programs, even those that satisfy the new EEOC regulation, do not avoid disparate impact claims under Title VII and the Age Discrimination in Employment Act. Certain conditions (such as obesity, diabetes or hypertension) may disproportionately affect certain protected groups. However, a properly structured wellness plan should not create an adverse employment action.

Employers still considering wellness plans will either have to comply with the new EEOC regulations or wait until higher courts decide the pending EEOC cases and the EEOC’s ability to rewrite the law using regulations. Employers with existing plans need to meet the additional requirements outlined in the 2017 EEOC regulations. Either way, getting some good legal advice about the risks and compliance of your wellness plan is a good idea.

John D. Walch is a shareholder with Durham Jones & Pinegar. He works with employers to design, prepare and resolve issues relating to a broad range of qualified and non-qualified benefit plans. Walch has also designed, drafted and obtained IRS approval of hundreds of qualified retirement plans and has tried over 50 ERISA benefit cases in federal court.