WPF files comments on wellness programs and privacy: urges EEOC to address privacy challenges

The World Privacy Forum filed comments about wellness programs and privacy impacts to the Equal Employment Opportunity Commission (EEOC). Many Americans take part in employer wellness programs, and they are increasingly and justifiably concerned about the sensitive information these programs are gathering, sometimes in return for incentives such as discounts on pricing for health insurance.

In our comments, we supported the portions of the proposed EEOC rules that are positive and privacy protective, and we expressed concerns and made suggestions for areas that need attention. Our comments focused on fairness, privacy and sensitive personal information, due process, voluntariness, and the impact of the Internet of Things.

Most wellness information is not covered under HIPAA

One concern we addressed in the comments was about the privacy of personally identifiable information that is collected and used in employer wellness programs. Much wellness information falls outside of the protections of the privacy and security rules of the Health Insurance Portability and Accountability Act (HIPAA). Much wellness program information also falls outside of the protections of other federal and state privacy laws.

Individuals often erroneously think that the HIPAA rules protect the privacy of any health information, and they may let their privacy guard down as a result. This is particularly true of wellness programs, and it is a serious concern that remains unaddressed at all levels. We urged the Commission to address this issue.

Programs may not be truly voluntary

We agreed with the Commission’s concerns that wellness programs may not be truly voluntary. WPF is concerned that a certain percentage of individuals will be unable to meet wellness program requirements for valid reasons such as pregnancy, disability, allergy, temporary illness, family emergencies, or travel. But some individuals will also opt to not participate for non-medical reasons, such as religious objections. We therefore supported the Commission’s proposal to include participation-based incentives in the 30 percent overall limit on wellness incentives.

Additionally, because we believe that incentives for participation in wellness program should only be positive ones, we recommended that the Commission rules should ban negative incentives that impose additional costs on non-participating employees. If all incentives are positive, then the problem of offering incentives to employees who cannot participate in wellness programs for medical (or religious) reasons is a smaller concern.

Notifying people about how their sensitive information is used

In it’s proposal, the Commission discussed new rules for notification to wellness program participants that the wellness information may be used by secondary parties. We urged the Commission to provide notice, and to go further and privacy true agency and rights to individuals. We wrote:

The best outcome would be a rule that all non-program uses and disclosures require the informed and affirmative consent of each affected individual, including spouses and children who can lawfully have a say in their own health care.

Internet of Things and wellness programs

We also urged the Commission to think about the way devices are interacting with wellness programs, as well as the Internet of Things. The IoT promises to connect sensors to smartphones to smart homes to smart cars and other sensor-rich items such as health and fitness monitoring devices. As such, the IoT is set to become a way that health monitoring can be seamlessly integrated into an individual’s daily life, and fitness and health-related wearables as part of this equation are forecast to grow substantially, driven in part — some research indicates driven largely — by wellness programs.

As the IoT rolls out, wellness programs could be expanded in both the scope and precision of tracking. As the IoT rolls out, wellness programs could be expanded in both the scope and precision of tracking. It is reasonable to forecast that some wellness programs tied to IoT platforms will develop both as part of health plans and independently of health plans.

For the full comments, see WPF Comments to EEOC on wellness programs and privacy (PDF)

Posted June 22, 2015 in De-Identification and reidentification, Equal Employment Opportunity Commission (EEOC), Health Privacy, Internet of Things, Public Comments, Sensitive Data issues, Wellness programs

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.