For brokers, agents & benefits consultants · Updated 2026
WMHMDA for Insurance Brokers & Benefits Consultants
Insurance brokers and benefits consultants often assume their entire book of business is covered by HIPAA because they work adjacent to health plans. In practice, a broker's own intake questionnaires, biometric screening coordination, and quote-comparison tools frequently sit outside HIPAA's definition of a covered entity or business associate — which means WMHMDA applies to that data directly. See WMHMDA vs HIPAA for the underlying distinction.
In short: Health questionnaires, biometric screenings, and quote-comparison data collected by a broker are typically consumer health data under WMHMDA, independent of any HIPAA-covered plan relationship. Sharing results with carriers for premium calculations needs its own disclosure. Generate your documents below.
Read the full guide for insurance brokers & benefits consultants
Why "we work with health plans" doesn't make a broker HIPAA-covered
HIPAA covers health plans, health care clearinghouses, and providers — plus their business associates under a signed business associate agreement. An independent insurance broker or benefits consultant who collects health information directly from individuals or employer groups, outside of a formal business associate relationship with a specific covered plan, is often not covered by HIPAA for that collection. That gap is exactly where WMHMDA applies, since the statute defines consumer health data by content, not by who collected it.
Data categories brokers commonly collect
- Health questionnaires — medical history, current conditions, and medication questions used to quote life, disability, or supplemental health policies.
- Biometric screening coordination — arranging and receiving results from workplace biometric screenings (blood pressure, cholesterol, BMI) for group wellness incentive programs.
- Wellness program participation data — step counts, health-risk-assessment scores, and program completion status used to calculate group premium discounts.
- Quote-comparison tool inputs — health status and condition answers entered into online quote-comparison or eligibility tools.
Where brokers get compliance wrong
- Assuming carrier HIPAA compliance covers the broker's own intake — a carrier's HIPAA obligations don't extend backward to the broker's separate collection of health data during the sales or quoting process.
- Sharing biometric or wellness results with a carrier without a specific opt-in — using screening results to calculate group premium discounts is a distinct "sharing" event under WMHMDA, separate from collecting the data in the first place.
- No retention schedule for sensitive health questionnaires — health intake forms for declined or unbound policies are often kept indefinitely with no documented deletion process.
- Online quote tools with no consent flow — a web-based quote comparison tool that asks health questions before any privacy disclosure or consent step is a common, easily fixed gap.
Example: a benefits consultant coordinating a group wellness incentive program
A benefits consultant coordinates an annual biometric screening event for an employer's group health plan enrollees and reports aggregate risk scores to the carrier to unlock a group premium discount. This consultant needs: a privacy policy disclosing that biometric data is collected and shared with the carrier for premium calculation; opt-in consent from each participating employee before screening; a documented retention and disposal schedule for screening results; and a process for an individual to request their data be deleted from the consultant's own records after program participation ends.
Get compliant documents for your brokerage
The WMHMDA Compliance Pack builds a privacy policy, consent form, sale authorization, retention schedule, and rights form matched to how your intake forms, screenings, and carrier reporting actually work. Read everything free before you pay — $99.99 one-time.
Generate My Compliance Pack — $99.99Legal limitations
Whether HIPAA, ERISA, state insurance regulation, or WMHMDA (or more than one) applies to a specific broker relationship depends on the exact structure of the plan, the broker's role, and any business associate agreements in place. This is a fact-specific question; have an attorney confirm your specific arrangement before relying on any generated document.
FAQ
Are insurance brokers automatically exempt from WMHMDA because insurance is HIPAA-regulated?
No — HIPAA covers health plans and covered entities, not automatically every broker; broker-side collection outside a covered plan relationship is typically subject to WMHMDA.
Does collecting health data to quote a policy trigger WMHMDA?
Yes — health questionnaire answers and medical history collected to underwrite or quote a policy are consumer health data under RCW 19.373.
Can a broker share biometric results with a carrier for premium discounts?
That sharing needs its own disclosure and, in many cases, separate consent from the individual, distinct from the original data collection.
Does this apply to independent agents, not just large brokerages?
Yes — there's no size or revenue exemption; scope depends on what data is collected and how it's shared, not the size of the agency.