How much privacy about my health am I giving up if I participate in my employer's wellness screening program?

Question

My employer is having a "Wellness Screening Fair" where you can receive free testing for things like cholesterol and insulin, and I imagine advice about how to interpret the results. Sounds good.. But when I click through to register, I see that the tests are administered by Quest Diagnostics, and that I have to sign away some privacy concerning the results of the tests.

The legal disclaimer is copied below. In plain language, can you explain the most important privacy rights that I am giving up in exchange for this free testing?

A few questions:

• It seems they may tell my benefits plan, which isadministered by my employer, about my results [Paragraph 2]. So could my insurance go up if they find out my cholesterol is high?
• Also, it sounds like they are going to add my genetic data to my spouse's record [Paragraph 2]. My spouse also works at the same company. Why would they need to do this?
• Would they be allowed to use my sample to conduct additional genetic tests on me without my knowledge (for instance, for markers of common diseases)?

Here is the link: https://my.questforhealth.com/mobile/welcome/home

You need a registration key, which may be unique to each company, to view the legal disclaimer. I've copied the disclaimer her:

1. Terms of Service: Quest Diagnostics Health & Wellness represents health benefit management programs with policies in place to maintain the confidentiality of your information consistent with Quest Diagnostics Notice of Privacy Practices, which may be found at QuestDiagnostics.com/home/privacy-policy/online-privacy.html Our Privacy of Protected Health Information (PHI) policy requires that we“must obtain, maintain, use and disclose patient protected health information in a manner that protects patient privacy and complies with all state and federal laws." Though this is a voluntary program, should you choose not to accept these Terms and Conditions, you will not be able to participate.
2. By participating in the wellness screening program(s) you acknowledge, and consent to, Quest Diagnostics Health & Wellness’ disclosure of the data and outcomes of your Health Questionnaire and test results in accordance with the requirements of the Health Insurance and Portability and Accountability Act (HIPAA) and any other applicable laws. If you are providing family medical history or other genetic information through a Health Questionnaire or test results, you are also authorizing and consenting to the use of such genetic information for the purposes of the wellness screening program as described in paragraph 3 below. If you are a spouse or dependent of another participant in the wellness screening program, you are also authorizing and consenting to the use of your genetic information, which genetic information may include blood pressure, BMI, and blood work results such as cholesterol, glucose, and triglycerides, in your spouse’s data. Your employer will not receive your results in any form that may match the data to you; however your employer’s benefits plan, which may be self-administered, may receive identifiable information for purposes of managing the benefits plan or administering incentives on your behalf
3. If your employer or program sponsor selects additional health benefits management services as part of this wellness screening then, at the direction of your employer or program sponsor, your data may be shared with health care professionals/companies and/or your employer’s Group Health Plan representatives who offer additional services provided by your employer. Data sharing with authorized third parties will be performed via a secure data exchange process designed to keep your personal and protected health information secure. In no event will Quest Diagnostics sell, exchange, or otherwise disclose your data except as stated in these Terms of Service.
4. To ensure optimal participation in a wellness program, your employer or plan sponsor has engaged Quest Diagnostics Health & Wellness to contact you regarding your voluntary participation in the program. You may receive communications via telephone, email, and/or cell phone text messaging that include reminders, confirmations and instructions to participate, using information that you have provided, or that your employer and/or plan sponsor has provided to Quest Diagnostics Health & Wellness via an eligibility file.
5. If information was provided through an eligibility file from your employer or plan sponsor, then as part of the registration process you were asked to verify and/or update your personal information. You are responsible for the accuracy of your personal information and at any time, you can return to the My.QuestForHealth.com site, log in, and provide additional updates to your personal information.
6. If you provided a cell phone number as a means to contact you, you acknowledge and consent that we may contact you by telephone, voicemail and/or text message with respect to Quest Diagnostics Health & Wellness at that number. You also consent that we may contact you at that phone number using an automatic dialing and/or announcing device that may play pre-recorded messages. You are not required to provide a cell phone number and participation in Quest Diagnostics Health & Wellness is not conditioned on providing a cell phone number. If you wish to be contacted at another number or by another means, please edit your profile information at My.QuestForHealth.com By accepting these terms, you consent to receiving these contacts intended to provide helpful and timely guidance regarding these services.
7. Use of the information collected through participation in this program is limited to the purposes stated in this notice. The personal information collected or generated through participation in this program is retained for as long as is required by applicable state and federal laws. Upon the expiration of that retention period it is disposed of in a secure manner compliant with the requirements of HIPAA.
8. The information you receive from participating in this program does not constitute the practice of medicine, and is provided to you for informational purposes only. You may share this information with your personal physician for medical treatment purposes, or for interpretation of the results, when appropriate.

Answer 1

HIPPA prohibits unnecessary access to private health information

1. Need to review Quest's privacy policy on Quest's website

2. "Your employer will not receive your results in any form that may match the data to you; however your employer’s benefits plan, which may be self-administered, may receive identifiable information for purposes of managing the benefits plan or administering incentives on your behalf"

The problem here is that someone in your company might find out something you don't want them to know. They wouldn't be able to tell your president (or any random person). But it would be difficult to prevent them from making statements that the president (or random person) would understand without knowing the specifics.

3. All of the healthcare professionals involved will have access as necessary

4. Some of the healthcare professionals involved may contact you, meaning they might leave a voicemail message or speak to someone other than you who answers your phone, or send electronic mail that someone other than you might see, or send you physical mail that someone other than you might be able to read. None of this should include private health information. It probably wouldn't be "Jack, you've got AIDS." But it might provide information that you are seeing a specific type of specialist that would raise questions about why you're visiting such a specialist.

The problem here is that anyone might find out something you don't want anyone to know.

5. You're responsible for the correctness and completeness of the information you provide. You can update it at any time. If you're allergic to orange juice and you fail to tell them and they give you orange juice, they can deny responsibility. They're going to ask you about stuff like this a million times. If you never tell them, that would be bad for you.

6. This looks like 4. My head will spin if I try to figure out the difference right now.

7. Per HIPPA, they can only use your information for the purpose stated and agreed. They will keep the information as required by law. Then they'll delete it.

8. Nothing they do is the practice of medicine. They aren't diagnosing you or treating you. You can't sue them for malpractice if (1) they fail to tell you that you have only 3 days left to live, (2) they fail to tell you that you might survive with treatment, (3) they tell you that you have 3 days to live when you're actually fine, or anything else. You can share the information with your physician and its your physician's responsibility to provide health care services as s/he deems appropriate given the information.