"Under the proposed rule, employers (not just the group health plan like HIPAA) will be limited to receiving aggregated/de-identified medical information from the wellness program, except as needed to administer the program and other limited purposes. Additionally, employers cannot require employees to agree to the sale, exchange, sharing, transfer, or other disclosure of medical information, or waive confidentiality protections as a condition of participating in the program."

MORE >>