Employers cannot request genetic information from employees, spouses, or children in exchange for a wellness incentive, and family medical history counts as genetic information under federal law. There's exactly one narrow carve-out: a spouse's current or past health status (not genetic test results, not family history) can be tied to an incentive, but only if participation is voluntary, the spouse gives prior written authorization, and the total reward stays within a hard cap.
Miss any one of those conditions and you have a GINA problem, not a paperwork problem.
- Never ask for family medical history on any HRA tied to a reward, gift card, or premium discount.
- A spouse's blood pressure or cholesterol numbers can be incentivized. A spouse's genetic test results cannot, ever.
- Children's health information, genetic or otherwise, is off-limits for incentive purposes, full stop.
Two federal regimes police this. The EEOC enforces Title II as an employment discrimination matter. The DOL, HHS, and Treasury oversee Title I obligations when the wellness program runs through a group health plan. Your HR team needs to know which lane your program sits in before you build the intake form.
Key Takeaways
| Point | Details |
|---|---|
| Never incentivize genetic data | Family history and genetic test results cannot be tied to any wellness reward, for employees, spouses, or children. |
| Spouse exception has three conditions | Voluntary participation, prior written authorization, and a combined 30% cap on self-only coverage cost. |
| Split your HRA into two forms | One incentive-linked form excludes genetic questions; a separate voluntary form handles genetic services with its own authorization. |
| Notice must be prominent, not buried | Genetic-information instructions belong on the form itself, not in a linked privacy policy nobody reads. |
| Consider a lifestyle-first program design | Hadaco's evidence-based approach targets chronic disease and preventive care, avoiding genetic-data collection while delivering measurable savings. |
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Table of Contents
- What GINA Means for Wellness Programs and Why It Applies
- What GINA Prohibits: Genetic Information, Inducements, and Data Collection Limits
- The Spouse Exception: How the 30% Incentive Cap Actually Works
- Who GINA Covers: Employers, Group Health Plans, and Overlapping Rules
- A Compliance Checklist for Designing or Auditing a Wellness Program
- Notice, Consent, and Data Handling That Actually Holds Up
- What Happens When Someone Files a Complaint
- Meeting Health Goals Without Ever Touching Genetic Data
- Why the Real Risk Isn't the Law, It's the Vendor Contract
- Get a Compliance-First Wellness Program Without the Genetic-Data Risk
- Sources
What GINA Means for Wellness Programs and Why It Applies
The Genetic Information Nondiscrimination Act of 2008 was written for a narrower fight than most HR teams realize. Congress passed it to stop health insurers and employers from using genetic test results and family medical history to deny coverage or make employment decisions. Wellness programs became a flashpoint almost by accident, because a well-meaning health risk assessment (HRA) that asks "does anyone in your family have a history of heart disease or diabetes" is, legally, a request for genetic information.
GINA splits into two titles with different enforcement paths, and mixing them up is one of the most common HR compliance errors.
- Title I governs group health plans and health insurance issuers. It bars underwriting decisions, premium adjustments, and eligibility rules based on genetic information. The DOL's compliance guide is administered jointly across the Department of Labor, HHS, and Treasury/IRS, since group health plans touch ERISA, public health, and tax code all at once.
- Title II governs employment. It prohibits employers from requesting, requiring, purchasing, or using genetic information in hiring, firing, promotion, or benefits decisions. This is the EEOC's territory, and it covers employers with 15 or more employees.
Here's why this split matters practically: a single wellness program can trigger both titles at once. If your program is offered as part of the group health plan, Title I's underwriting restrictions apply to how the plan handles the data. If the same program touches employment decisions, hours, or job status, Title II kicks in too. HRAs and biometric screenings sit right at that intersection because they routinely ask questions that brush up against genetic information, even when nobody intended them to.
The trigger isn't malicious intent. It's the questions themselves. A biometric screening that measures blood pressure and cholesterol is fine on its own. Add a family history questionnaire to the same intake packet, tie the whole bundle to a $200 premium discount, and you've built a GINA violation into your wellness platform without meaning to.
What GINA Prohibits: Genetic Information, Inducements, and Data Collection Limits
Genetic information under GINA is broader than most HR professionals expect. It covers an individual's own genetic test results, the genetic test results of family members, the manifestation of a disease in family members (family medical history), and requests for or receipt of genetic services. It does not cover an employee's own current or past health status, like their own blood pressure, weight, or cholesterol reading. That distinction between "genetic" and "current health status" is the single most important line in this entire statute.
Employers are strictly barred from offering financial or other inducements in exchange for an employee's, spouse's, or child's genetic information, according to the EEOC's background guidance on Title II. That means:
- No gift cards, premium discounts, or reduced deductibles offered in exchange for family medical history questions on an HRA.
- No purchasing genetic test data from third-party vendors, even anonymized panels, for use in plan design or risk stratification.
- No using genetic information collected incidentally (more on that below) for underwriting, eligibility, or coverage decisions.
Pro Tip: Run every wellness intake form through a simple test: would answering this question require someone to disclose a family member's diagnosis, a genetic test result, or hereditary risk? If yes, that question cannot sit on the same form as an incentive.
There is a genuinely narrow exception for incidental collection. If a wellness vendor is conducting a health risk assessment and a participant volunteers genetic information without being asked, that isn't automatically a violation, but the safe harbor comes with conditions that are easy to miss. The form must explicitly and prominently instruct participants not to provide genetic information, the information collected cannot be used for underwriting, and it cannot be shared with the employer beyond aggregate reporting that doesn't identify individuals.
Deep in the compliance weeds, this is where most vendor contracts fall short. Generic privacy boilerplate buried in paragraph nine of a terms-of-service document does not satisfy the "explicit and prominent" standard the EEOC has laid out. The instruction not to disclose genetic information needs to appear where the family history question would otherwise go, not in a disclaimer nobody reads.
The stakes here connect directly to why more employers are rethinking wellness program design altogether. Peer-reviewed survey research on employed adults' knowledge and perceptions of workplace genetic testing found real gaps in understanding around how genetic data gets used in employment contexts, gaps that translate into legal exposure the moment a program design leans on family history or genetic screening rather than straightforward lifestyle metrics. Programs built around cholesterol, activity levels, and chronic disease management sidestep this entire category of risk because they never ask the genetic question in the first place.
The Spouse Exception: How the 30% Incentive Cap Actually Works
The spouse exception is the single most misunderstood part of GINA, and getting the mechanics wrong is an easy way to build a noncompliant program with the best of intentions.
Here is what the rule actually permits. Employers may offer an incentive for a spouse's current or past health status, things like a spouse's blood pressure, glucose level, or BMI collected through a biometric screening or HRA, according to the EEOC's final rule on wellness programs. Health status is not genetic information. A spouse's own diagnosis history is not the same as that spouse's genetic test results or their family's medical history. The exception exists precisely because it stays on the "current health" side of the line, never the "genetic" side.
Three conditions have to be true simultaneously for this exception to apply:
- Voluntary participation. The spouse cannot be required to participate, and the employee's own coverage and benefits cannot be conditioned on the spouse's answers.
- Prior, knowing, written authorization. The spouse must sign an authorization before providing any information, not after the fact and not through a generic enrollment checkbox.
- The 30% cap. The total incentive, combining what's offered to the employee and the spouse together, cannot exceed 30% of the total cost of self-only coverage under the plan.
That cap calculation trips people up constantly. The Federal Register's regulatory text makes clear the 30% figure is a combined ceiling tied to self-only plan cost, applied across the whole household incentive structure. If your self-only plan costs $7,200 a year, the entire wellness incentive pool for employee and spouse combined tops out at $2,160, not $2,160 twice.
Children's health information remains prohibited from any incentive structure, regardless of the 30% math. There is no equivalent carve-out for dependents the way there is for spouses. If your wellness platform vendor has built a "family wellness" incentive that includes rewards tied to a child's biometric data or health history, that's a compliance gap worth flagging to legal counsel before renewal.
Who GINA Covers: Employers, Group Health Plans, and Overlapping Rules
Coverage under GINA depends on which title applies, and the threshold matters more than most HR handbooks acknowledge. Title II, the employment discrimination provisions enforced by the EEOC, applies to employers with 15 or more employees. Smaller employers fall outside Title II's direct reach, though many still voluntarily follow its standards because state law or group health plan design pulls them in anyway.
Title I applies differently. It governs the group health plan itself, regardless of the sponsoring employer's headcount, because the obligations run to the plan and the insurer, not to the employer as an employer. When your wellness program is administered as part of your group health plan (biometric screenings tied to premium tiers, HRAs bundled into open enrollment), Title I's underwriting restrictions apply on top of whatever Title II requires.
This is where GINA compliance starts overlapping with two other statutes HR teams already juggle:
- The ADA requires that any disability-related inquiries or medical exams in a wellness program be voluntary and that the program be reasonably designed to promote health, not simply a data-collection exercise for underwriting.
- HIPAA's nondiscrimination rules require that health-contingent wellness incentives offer a reasonable alternative standard for people who can't meet a biometric target for medical reasons.
None of these three laws cancel each other out. They stack. Legal review of a new wellness vendor contract should check all three boxes at once, not sequentially.
A Compliance Checklist for Designing or Auditing a Wellness Program
Building a GINA-compliant program isn't complicated once you separate the pieces that need separating. Most violations trace back to a single design choice: bundling genetic questions into the same form as incentive dollars.
- Split your HRA into two separate instruments. One version is tied to the incentive and explicitly, prominently instructs employees not to answer any family medical history questions. A second, entirely separate voluntary genetic or family-history service exists outside the incentive structure and requires its own prior written authorization before anyone answers a single question.
- Build in a reasonable alternative standard. Employees or spouses who decline to provide health information, or who can't meet a biometric target for medical reasons, need an equivalent path to the same incentive. This isn't optional generosity, it's what keeps your program on the right side of both GINA's voluntariness requirement and the ADA's parallel rule.
- Audit every vendor contract for confidentiality and data-use limits. Your wellness vendor should be contractually barred from using collected data for underwriting, contractually required to report to you only in aggregate form that doesn't identify individuals, and contractually on the hook for breach notification timelines. A biometric screening program that runs through a third-party clinical vendor needs these terms spelled out before the first screening date, not negotiated after a data incident.
- Document consent at every step. Keep signed authorization records for spouse health-status incentives, keep a copy of every version of your HRA language, and keep a log of when reasonable-alternative offers were made and accepted. If the EEOC or DOL ever asks, "show me," you want an answer that takes minutes, not weeks.
- Train HR staff and vendor account managers on the specific line between health status and genetic information. This is the recurring failure point. Most violations aren't malicious, they're the product of a well-meaning benefits coordinator who didn't realize "any history of cancer in your family?" is a different legal category than "have you had a mammogram this year?"
- Schedule an annual policy refresh. Wellness vendors update their platforms, HR staff turn over, and incentive structures get adjusted at renewal. A yearly compliance pass, checking your health risk assessment design against current EEOC guidance, catches drift before it becomes a pattern an investigator can point to.
Pro Tip: Keep your incentive menu simple and behavior-based instead of biometric-heavy. Rewarding participation in a walking challenge or a coaching call carries zero GINA exposure, because there's no health data collection tied to the dollar amount at all.
The through-line across every one of these steps is separation. Separate the incentive from the genetic question. Separate the mandatory from the voluntary. Separate what the vendor sees from what the employer sees. Programs that blur those lines are the ones that end up explaining themselves to a federal investigator.
Notice, Consent, and Data Handling That Actually Holds Up
Generic privacy language does not satisfy GINA's notice requirements, and this is where a lot of otherwise well-designed programs fall apart on paper even when the underlying practice is fine. The EEOC's guidance on final rules for employer wellness programs requires that any notice about genetic services be clear and prominent, placed where the question would otherwise appear, not buried in a privacy policy nobody opens.
A compliant notice needs to state, in plain language, what information is being requested, that providing genetic information is entirely voluntary and unconnected to any incentive, who will see the results, and how confidentiality will be maintained. Written authorization for spouse health-status incentives needs its own signature line, separate from general benefits enrollment paperwork.
Incidental collection, when a participant volunteers family history despite clear instructions not to, has to route into aggregate-only reporting. The employer should never see individually identifiable genetic information, full stop. Vendor platforms should be configured so that even accidental disclosures get stripped before any employer-facing dashboard or report generation, a design question worth asking any wellness analytics platform before you sign a contract.
Technical and organizational safeguards work together here:
- Role-based access limiting genetic or family-history data to a small, defined vendor team, never the employer's HR or benefits staff directly.
- Encryption at rest and in transit for any health data, with SOC 2 or HIPAA compliance attestations from every vendor touching the pipeline.
- A documented breach response plan with notification timelines that match state and federal requirements, tested at least annually.
- Recurring staff training that covers the genetic information versus health status distinction specifically, not generic HIPAA privacy training that never mentions GINA.
| Requirement | What it looks like in practice |
|---|---|
| Prominent notice | Genetic-information instructions sit directly on the intake form, not in a linked privacy policy |
| Written authorization | Separate signature specifically for spouse health-status data, apart from general enrollment forms |
| Aggregate-only reporting | Employer dashboards never display individually identifiable health or genetic data |
| Vendor safeguards | Contractual SOC 2 or HIPAA attestations plus breach notification clauses |
What Happens When Someone Files a Complaint
Enforcement runs through two different doors depending on which title got violated, and knowing which door matters when you're deciding how to respond.
The EEOC handles Title II employment discrimination complaints. An employee who believes their employer improperly requested or used genetic information can file a charge with the EEOC, which can result in an investigation, mediation, or litigation, with remedies that can include back pay, compensatory damages, and injunctive relief requiring program changes.
DOL, HHS, and Treasury handle Title I violations tied to group health plans, things like an insurer using family history for underwriting or a plan denying coverage based on genetic risk. These agencies can require plan corrections and impose penalties on the plan sponsor or issuer.
If a complaint lands on your desk:
- Preserve every version of the HRA, consent forms, and vendor contracts immediately, before anything gets overwritten in a system update.
- Contact your wellness vendor and require cooperation with any records request, since most violations trace back to vendor-side form design.
- Loop in legal counsel before responding substantively to any agency inquiry, and consider a voluntary program pause if the exposure looks structural rather than a one-off error.
Meeting Health Goals Without Ever Touching Genetic Data
The cleanest way to avoid every issue covered above is to build a program that never asks the genetic question in the first place. Hadaco's approach centers on evidence-based interventions for chronic disease, preventive care, and employee engagement, the kind of programming that improves outcomes through behavior change and clinical risk management rather than family history intake or genetic screening.
That design choice isn't just a compliance shortcut. It reflects where the actual health impact lives: evidence-based wellness programming built on chronic disease management and preventive care produces measurable results without ever needing to ask about a family member's diagnosis.
- Employers using Hadaco's programs have seen an average savings of $451 per employee in year one, with no upfront fees required to start.
- A transparent savings estimator lets HR model expected outcomes before committing to a program design.
- Quarterly reporting gives benefits leaders measurable, aggregate outcome data, without any individual health or genetic information ever reaching the employer's desk.
For HR teams already managing GINA, ADA, and HIPAA compliance simultaneously, a program built around lifestyle and chronic disease intervention removes an entire category of legal exposure rather than requiring you to manage it more carefully.
Why the Real Risk Isn't the Law, It's the Vendor Contract
Most employers who run into GINA trouble didn't set out to violate federal law. They signed a wellness vendor contract that bundled a family history questionnaire into an HRA nobody in legal ever reviewed line by line. What actually causes exposure is the gap between what HR assumes a vendor's platform is asking and what the intake form actually says.
The conventional advice, "just make sure your wellness program is voluntary," undersells how specific GINA's requirements actually are. Voluntariness alone doesn't save a program that lacks a reasonable alternative standard or that buries genetic-information instructions where nobody will read them. Compliance here is a design discipline, not a disclaimer.
If there's one priority above the rest, it's this: audit your intake forms before you audit your incentive structure. The dollar amount rarely causes the violation. The question on line fourteen does.
— Gene
Get a Compliance-First Wellness Program Without the Genetic-Data Risk
Hadaco gives employers a way to hit real cost-reduction targets without ever building a genetic information question into the incentive structure. Instead of HRAs that risk crossing GINA's line, Hadaco's programs run on chronic disease management, preventive care, and engagement tools that produce measurable savings, an average of $451 per employee in the first year, with no upfront fees and no disruption to your existing benefit plan.
Every Hadaco engagement comes with a transparent savings estimator so your finance team can see projected numbers before signing anything, plus quarterly reporting that gives your benefits committee real accountability instead of a vague promise of "improved wellness." If you're evaluating vendors alongside partners like Kin Wellness for service delivery models, Hadaco's compliance-first design is worth putting side by side with anything that leans on biometric or genetic intake. Run your numbers through Hadaco's savings estimator and book a consultation to see what a compliant, evidence-based program could save your organization this year.
Sources
- EEOC's final rule on employer wellness programs and the Genetic Information Nondiscrimination Act
- Genetic Information Nondiscrimination Act compliance guide (DOL/EBSA)
- Regulations under the Genetic Information Nondiscrimination Act (Federal Register)
- The Genetic Information Nondiscrimination Act and workplace genetic testing: Knowledge and perceptions of employed adults in the United States (2024)