For HR & corporate wellness vendors · Updated 2026
WMHMDA for Employee Wellness Programs
Employer-sponsored wellness programs — step-count challenges, biometric screenings, mental health check-ins, and third-party wellness apps offered as a workplace benefit — sit in a genuine gray zone. HR teams often assume that because the program is offered through the employer, HIPAA or a general employment-law framework covers it. In most cases, neither does, and the Washington My Health My Data Act (WMHMDA) applies to the wellness vendor directly.
In short: Most employee wellness vendors are not HIPAA covered entities or business associates, so WMHMDA applies to the biometric, fitness, and mental-health data they collect from Washington-based employees. Watch for employer-visible dashboards and insurance-broker data sharing — both need their own disclosure and consent. Generate your documents below.
Read the full guide for employee wellness programs
Why "employer-sponsored" usually doesn't mean "HIPAA covered"
HIPAA applies to group health plans and their business associates — not automatically to every vendor an employer contracts with for a wellness perk. A standalone wellness app, a step-challenge platform, or a third-party biometric-screening company hired to run a health fair is typically not part of the employer's group health plan and is not a HIPAA covered entity itself. That means the wellness vendor's own collection, use, and sharing of employee health data usually falls outside HIPAA entirely — and squarely inside WMHMDA if any employee is a Washington resident.
Data categories a typical employee wellness program collects
- Biometric screening data — blood pressure, cholesterol, glucose, BMI, and body composition collected at workplace health fairs.
- Fitness and activity data — step counts and activity minutes from company step-challenges or connected wearables.
- Sleep data — sleep tracking integrated into some corporate wellness point systems.
- Mental health and stress data — check-in surveys, stress-score assessments, and Employee Assistance Program (EAP) intake data routed through a wellness platform.
- Weight and nutrition data — weigh-ins and nutrition coaching tied to wellness incentive programs.
Where employee wellness programs get compliance wrong
- Assuming "internal use" means no consent is needed — WMHMDA's opt-in consent requirement applies regardless of whether the data stays inside the company or goes to a vendor.
- Employer-visible dashboards — some vendors give HR or a wellness committee aggregate or even individual-level participation and biometric data; sharing that data with the employer is a distinct disclosure and consent event, separate from collecting it in the first place.
- Insurance broker and premium-incentive sharing — sharing wellness participation or biometric outcomes with an insurance broker to calculate premium discounts can constitute "sharing" or even "selling" consumer health data if anything of value flows back to the vendor or employer.
- Assuming the employer's HIPAA notice covers the vendor — a group health plan's HIPAA Notice of Privacy Practices does not extend to a separate wellness vendor's own data collection outside the plan.
Example: a step-challenge and biometric-screening vendor
A wellness vendor runs a company-wide step challenge and an annual biometric screening (blood pressure, cholesterol, weight) for an employer's staff, then reports aggregate participation and average risk scores back to HR each quarter. This vendor needs: a privacy policy disclosing that fitness and biometric data is collected and that aggregate results are shared with the employer; opt-in consent from each employee before collecting screening data; a separate opt-in specifically covering the employer-facing reporting, since that's a "sharing" event distinct from collection; and a documented retention schedule for biometric results, since health screening data is exactly the kind of sensitive record that should not be retained indefinitely.
Get compliant documents for your wellness program
The WMHMDA Compliance Pack builds a privacy policy, consent form, sale authorization, retention schedule, and rights form matched to how your program actually collects and shares employee wellness data. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
Whether HIPAA, ERISA, or WMHMDA (or more than one) applies to a specific employee wellness arrangement depends on how the program is structured — whether it's part of a group health plan, who administers it, and what data flows to the employer. This is a fact-specific question; have an attorney confirm your program's structure before relying on any generated document.
FAQ
Does WMHMDA apply to an employer-sponsored wellness program?
Often yes — if the program is run by a separate wellness vendor outside the employer's group health plan, that vendor is typically not HIPAA-covered and WMHMDA applies to it directly.
Is a corporate biometric screening considered consumer health data?
Yes — blood pressure, cholesterol, weight, and similar screening results collected through a workplace wellness event or app are consumer health data under RCW 19.373.
Can an employer see individual employees' wellness app data?
If wellness data is shared with the employer, HR, or an insurance broker, that sharing needs its own disclosure and typically its own separate consent from the employee.
Does wmhmda or mhmda apply to step-challenge or corporate fitness-tracking platforms?
Yes, if the platform collects fitness, biometric, or health-related data from Washington-based employees and isn't itself a HIPAA covered entity.