Employers seeking to get workers to join wellness programs and provide medical information can set financial rewards – or penalties – of up to 30 percent of the cost for an individual in the company’s health insurance plan, according to controversial rules finalized by the Equal Employment Opportunity Commission Monday.

Although such penalties or incentives could run into the hundreds or even thousands of dollars, the programs are considered voluntary — and therefore legal, the commission said.

Jennifer Mathis, director of programs for the Bazelon Center for Mental Health Law, says the new rule rolls back protections in existing law.

“Voluntary inquiries can now come with steep financial penalties, according to the EEOC, for choosing not to answer,” she said. “That’s a troubling precedent for the application of civil rights laws.”

The highly anticipated rules from the Equal Employment Opportunity Commission will go into effect next January and will help define how these rapidly expanding wellness programs are run. They are also an effort to coordinate consumer provisions in several competing federal laws, including the Americans With Disabilities Act, the Affordable Care Act and Genetic Information Nondiscrimination Act of 2008.

Generally, employers reacted cautiously to the new rules. Many groups had advocated for stricter provisions and even higher penalties or incentives.

“Wellness programs … are making progress in helping employees and their families be healthier,” Brian Moynihan, CEO of Bank of America and chair of the Business Roundtable’s health committee, said in a statement. “Companies will review the new guidelines with a view toward ensuring that these programs are able to continue to make a positive impact.”

But consumer and disability-rights advocates, who had sought broad changes when the draft rules were unveiled last year, were clearly disappointed. The regulations don’t provide enough privacy protections, they said, and the programs can’t be considered voluntary with the level of incentives and penalties that were approved by the EEOC.

“This could coerce employees into providing information that they would otherwise not provide about their health,” said Sarah Fleisch Fink, senior policy counsel with the National Partnership on Women & Families, which was among dozens of groups that wrote comment letters seeking changes in the draft rule.

The final rules cover a wide variety of issues, from the financial incentives to how the medical information gathered must be protected.

One rule clarifies what wellness programs must do to comply with the requirements of the Americans with Disabilities Act (ADA), a law aimed at preventing discrimination. The ADA generally prohibits employers from asking questions related to health or disability, except in limited circumstances, such as through voluntary workplace wellness programs.

Another rule extends the ability of employers to seek health information from workers’ spouses. This can include asking spouses to fill out health risk questionnaires or have medical exams, so long as the programs are considered voluntary.

To further clarify what’s voluntary, the EEOC rules — in effect — say that employers cannot charge workers the full cost of their health insurance if they choose not to participate in wellness programs, saying “safe harbor” provisions in the ADA do not apply to wellness programs. Last December, the EEOC lost a federal court case, EEOC v. Flambeau, when an employer used the ADA’s “safe harbor” clause to argue that it could charge a nonparticipating worker full costs for health care.

The $6 billion a year workplace wellness industry is booming as employers aim to reduce the high costs of health care by promoting prevention. Typically, employers contract with a firm to gather employee information and provide wellness services.

Most employers have some type of program, but there is little evidence that these efforts save money or improve health.

The new rules apply to wellness programs offered as part of an employer’s health insurance package of benefits and to those that are separate from the health plan.

Some wellness programs are simple: They offer discounts to gyms or access to weight loss programs. Increasingly, however, programs ask workers to fill out some kind of health risk assessment questionnaire. And an increasing percentage also want employees to take medical tests, such as those for high cholesterol, blood pressure, weight or diabetes.

Workers’ advocates had sought a provision in the final rule to give employees an exemption to filling out the risk assessment or having a medical exam if they instead provided doctors’ certifications that they were under medical care. The final rule did not add that exemption.

The rules also kept the limits on financial incentives that was in the draft regulation largely intact. Slightly more than half of workplace wellness program use financial rewards or penalties to encourage workers to participate. Those incentives range from small-dollar gift cards to discounts for the health plan premium or annual deductible. Employees who don’t participate don’t get the discounts, which some advocates say is a penalty.

The rules say the total dollar amount of the incentive or penalty can’t exceed 30 percent of single-only coverage offered by the employer. At an average cost of roughly $6,000 a year, that could be about $1,800. That amount could be doubled if the employee has a spouse on the plan, according to the rule.

Smokers, however, may see higher costs if they choose not to participate. Those who acknowledge their smoking can face financial incentives — or penalties — of up to half the cost of single-only coverage. But, if an employer requires medical testing to determine if employees smoke, the limit drops back to 30 percent under the rules.

Employers had pushed to keep the higher smoking limit even with a test. Republican lawmakers, too, wanted the incentives to be allowed to go as high as 50 percent of the cost of health plan coverage for smokers who participate, just as the federal health law allows insurance premiums to vary by up to 50 percent for smokers.

Senate Health and Labor Committee Chairman Lamar Alexander, R-Tenn., said Monday that the rules “contradict the law and continue the confusion the agency has caused.”

Employers also sought to set the total dollar amount of incentives higher, at 30 percent of the cost of family health insurance coverage, which averages more than $17,000 a year.

As the programs start asking about ever more sensitive areas — genetics, mental health issues, finances, sleep habits and overall well-being — there’s growing concern about whether existing privacy and anti-discrimination regulations are adequate.

The new rules aim to address those concerns by requiring employers to tell workers which entities — such as the third party administrators that typically run wellness programs for employers — can access their personal medical data.

Additionally, any data gathered by the wellness company and then shared with employers must generally be in an aggregate form that isn’t likely to disclose the identity of individual employees.

Still, advocates say, the regulations have a loophole that does allow employers to see individual data provided to the wellness programs if needed to administer their health plans.  That is designed to avoid delays in patients getting treatment and making sure bills are paid on time. But consumer advocates raise concerns that such rules open a loophole for too much information sharing with health plan sponsors, which can include self-insured employers.

“The privacy protections are still weak,” said David Certner, legislative counsel for the AARP.

In a section added since the draft proposal was released, the rules also require that wellness programs may not require employees “to agree to the sale, exchange, sharing, transfer or other disclosure of medical information … as a condition of participating.”

Additionally, wellness programs can’t collect the medical information simply to have it.

Instead, it must be used to advise a worker how to improve health or to design a wellness program.

Such programs must be “reasonably designed” to improve health and not a “subterfuge for violating … laws prohibiting employment discrimination.”

AARP was one of the consumer groups issuing statements Monday saying the new rules fall short.

“Older workers, in particular, are more likely to have the very types of less visible medical conditions and disabilities — such as diabetes, heart disease, and cancer — that are at risk of disclosure by wellness questionnaires and exams,” the AARP said in its statement. “By financially coercing employees into surrendering their personal health information, these rules will weaken medical privacy and civil rights protections.”