What's happening
This bill establishes the Wellness Program Privacy Act, protecting personal data and prohibiting discrimination related to workplace or insurer wellness programs.
Why it matters
Sets strict limits on how employers and insurers can collect, use, and retain personal information from wellness programs. , requiring that only data necessary for the program's operation can be collected, used, or kept—helping protect employees' and enrollees' privacy beyond what current law may provide.
Prohibits sharing wellness program data with third parties. , closing a potential loophole for employers or insurers to sell or otherwise distribute sensitive health or behavioral information about individuals.
Bans retaliation or adverse actions against individuals who choose not to participate in wellness programs. , including denying coverage, increasing premiums, or reducing benefits, which protects personal choice and prevents coercion or discrimination.
Empowers individuals with rights to access, correct, and challenge their wellness program data, and gives them a private right of action if their rights are violated. , meaning affected people can sue for damages and attorneys’ fees—creating real accountability for companies and stronger enforcement of privacy and anti-discrimination measures.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Employees and insurance enrollees
The bill would give wellness participants rights to access and challenge their data, protect individuals who decline participation from adverse action, and let consumers sue over violations.
Employers with 50 or more employees and government employers
Those offering wellness programs would face limits on collecting, using and retaining personal information, a ban on third-party sharing, and protections against retaliation for nonparticipation.
Insurers and wellness program contractors
Insurers would face data privacy and disclosure requirements, with applicable collection and use requirements extending to contractors administering or operating their wellness programs.
State insurance regulators and the attorney general
The bill would authorize enforcement actions, provide civil penalties for violations, and direct the insurance superintendent to limit incentives to amounts deemed noncoercive.
Headline styles
Protect Wellness Program Privacy
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to insurance
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect Wellness Data Privacy
In Assembly Committee · Insurance · Sponsor Linda Rosenthal
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
7262
IN SENATE
January 15, 2020
Introduced by Sen. THOMAS -- read twice and ordered printed, and when printed to be committed to the Committee on Insurance
AN ACT to amend the insurance law, in relation to the establishment of the "Wellness Program Privacy Act"
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. This act shall be known and may be cited as the "Wellness Program Privacy Act".
§ 2. The insurance law is amended by adding a new section 3239-a to read as follows:
§ 3239-a. Wellness program privacy. (a) Definitions. For purposes of this section:
(1) "Employer" means:
(i) any person who directly employs fifty or more persons to perform services for a wage or salary; or
(ii) the state and any political or civil subdivision of the state, or any county or city or other municipality.
(2) "Collects," "collected," or "collection" means buying, renting, gathering, obtaining, receiving, or accessing any personal information or protected health information pertaining to a consumer by any means. This includes receiving information from such consumer, either actively or passively, or by observing such consumer's behavior.
(3) "Administration and operation of a wellness program" means, but is not limited to, the use of personal information when reasonably necessary and proportionate to achieve one of the following purposes:
(i) detecting and responding to security incidents arising from a wellness program and protecting against malicious, deceptive, fraudulent, or illegal activity related to a wellness program;
(ii) executing functions of a wellness program for the benefit of the insured;
(iii) undertaking internal research for technological development and demonstration related to a wellness program; or
(iv) undertaking activities to verify or maintain the quality or safety of a service or device that is owned by, manufactured by, manufac-
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD11029-01-9
S. 7262 2
tured for, or controlled by the insurer, or to improve, upgrade, or enhance the service or device that is owned by, manufactured by, manufactured for, or controlled by the insurer related to a wellness program.
(4) "Personal information" means information that identifies or could reasonably be linked, directly or indirectly, with a particular consumer, household, or consumer device. "Personal information" shall not include publicly available information.
(5) "Publicly available" means information that is lawfully made available from federal, state, or local government records, if any conditions associated with such information. "Publicly available" shall not mean information collected by an employer or insurer about an enrollee without the enrollee's knowledge. "Personal information" does not include enrollee information that is de-identified or aggregate enrollee information.
(6) "Retaliatory" or "adverse action" in the context of an employer offering a wellness program to its employees shall include: denial of coverage, termination of employment, requiring one hundred percent payment of medical care premiums when an employer pays a portion of the premium for wellness program participants, or reducing contributions to participants' health savings accounts.
(7) "Retaliatory" or "adverse action" in the context of an insurer offering a wellness program shall include: denial of coverage, termination of coverage based on non-participation or failure to achieve wellness targets, or adjustments to insurance premiums.
(b) Fair collection and use of personal information. (1) Any insurer or employer that collects a wellness program participant's personal information in the administration and operation of a wellness program shall limit its collection to what is reasonably necessary to operate the wellness program in which a consumer is enrolled.
(2) Any insurer or employer that collects a wellness program participant's personal information in the administration and operation of a wellness program shall limit its use and retention of personal information to what is reasonably necessary to administer and operate the wellness program in which a consumer is enrolled and for related administrative and operational purposes.
(3) No insurer or employer shall share with third parties any personal information or data collected through a wellness program.
(4) Following the close of a wellness program, an employee's termination, or the end of an enrollee's term of insurance, any personal information or data shall be deleted or de-identified.
(5) Wellness program participants shall have the right to obtain a copy of their wellness program data, and shall have the right to challenge the completeness and accuracy of any data the program has about them.
(6) The requirements described in this subdivision shall apply, to the extent that they are applicable, to any entity that an insurer or employer contracts with for purposes of administering or operating a wellness program on such insurer or employer's behalf.
(c) Transparency. Any insurer or an employer that collects a wellness program participant's personal information in the administration and operation of a wellness program shall provide such participant with a written explanation of:
(1) all data collected in the program;
(2) practices related to data sharing, including who will have access to such data; and
S. 7262 3
(3) the wellness program enrollee's rights concerning the wellness program under federal and state laws, rules, and regulations.
(d) Prohibition of discrimination based on participation. (1) Any employer that offers a wellness program to its employees, or any insurer that offers a wellness program to enrollees, shall not engage in retaliatory or adverse action against individuals who do not participate in wellness programs.
(2) The total amount of all wellness program incentives shall be limited to an amount deemed by the superintendent not to be coercive.
(e) Enforcement and enrollee private right of action. (1) Any consumer who has suffered from a violation of this section by an employer or insurer may bring a lawsuit against such employer or insurer. A violation of this section shall be deemed to constitute an injury in fact to the consumer who has suffered from such violation, and the consumer need not suffer a loss of money or property as a result of the violation in order to bring an action for a violation of this section.
(2) A consumer who prevails in such a lawsuit shall obtain the following remedies:
(i) damages in an amount not greater than the increased health or life insurance premium cost due to penalties or lost incentives, or seven hundred fifty dollars per consumer per incident, or actual damages, whichever is greater;
(ii) injunctive or declaratory relief, as the court deems proper;
(iii) reasonable attorneys' fees and costs; and
(iv) any other relief the court deems proper.
(3) In assessing the amount of statutory damages, the court shall consider any one or more of the relevant circumstances presented by any of the parties to the case, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant's misconduct, and the defendant's assets, liabilities, and net worth.
(4) A consumer bringing an action shall notify the attorney general within thirty days that the action has been filed.
(5) The attorney general may bring a civil action, in the name of the people of the state, against any employer or insurer in violation of this section.
(6) The department may pursue enforcement action against health insurers, health plans, or life insurers in violation of this section.
(7) Any employer or insurer that violates this section may be liable for a civil penalty of up to seven thousand five hundred dollars for each intentional violation, and up to two thousand five hundred dollars for each unintentional violation.
§ 3. This act shall take effect immediately.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Purpose
This bill relates to the establishment of the wellness program privacy act.
Summary of specific provisions
Section one establishes that this act shall be known and may be cited as the "Wellness Program Privacy Act."
Section two amends the insurance law by adding a new section 3239-a.
Section three establishes the effective date.
Justification
Advances in fitness technology have drastically changed the landscape of employer-lead fitness programming. Fitness devices can electronically track a range of indicators and health metrics and relay this informa- tion to a central database controlled by employers. Employers claim these programs help improve employee health while helping to limit their medical spending, but these devices also pose significant privacy risks for employees. Sensitive personal information on the functions and performance of an individual's body and biology is often aggregated without the consent of program participants, who are left with little recourse or transparency on what is done with that information. This information can then be sold to third parties like insurers or health- care providers interested in targeting advertising to consumers with specific health needs.
This legislation aims to set forth a broad regulatory framework for wellness programs that makes paramount the privacy of program partic- ipants. The legislation establishes parameters for the types of personal information that can be collected and made publicly available, and guar- antees employees both the opportunity to opt out of such program and that information is tracked in full transparency. Critically, this bill affords program participants with complete control over their data, and prohibits the discrimination against employees based on their partic- ipation or the information aggregated via their participation. Finally, the legislation guarantees program participants specific pathways to legal recourse in the event that their employer does not meet the stand- ards for consent and transparency set forth in this legislation.
Legislative history
This is a new bill.
Fiscal implications
Undetermined.
Effective date
This act shall take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.