How AI Can Predict Employee Health Risks

Start with the fence, because most employer health analytics projects I’ve seen go wrong at the property line. An employer that sponsors a group health plan doesn’t get to read that plan’s claims. The ADA lets it see wellness data only in aggregate, and GINA keeps family medical history off the table.

Here’s my position. AI predicts population health risk well. The useful version is aggregated, consented, and run by a third party. The version that scores individual employees is illegal in many of its forms and less accurate than most buyers think.

The HIPAA Privacy Rule, enforced since April 2003, treats the group health plan as a covered entity separate from the company paying for it. The employer, acting as plan sponsor, can receive protected health information only for plan administration, and only after amending the plan documents and certifying that the data won’t drive employment decisions. De-identified data sits outside the rule, which is why nearly all legitimate employer analytics lives there.

The ADA, on the books since 1990, limits medical questions for current employees to what’s job-related, with an exception for voluntary wellness programs. The EEOC’s regulation at 29 CFR 1630.14(d) says a program isn’t reasonably designed if it exists “simply to give an employer information to estimate future health care costs.” Read that twice before buying a risk-prediction tool. The same section allows the employer to receive wellness information only in aggregate terms that don’t disclose, and aren’t reasonably likely to disclose, the identity of any employee. GINA, binding on employers since November 2009, bars requesting genetic information, and family history counts.

Incentives are where the fence keeps moving. The EEOC’s May 2016 rules allowed rewards or penalties up to 30% of the cost of self-only coverage. In August 2017 a federal court in AARP v. EEOC found the agency hadn’t shown why that level was voluntary, and the incentive provisions were vacated effective January 1, 2019. A January 7, 2021 proposal limiting most programs to de minimis rewards, think a water bottle, was pulled on January 20, 2021. As far as I can find, nothing has replaced it, so counsel works from the statute and case law.

Employers should see cohorts, never people

Every project has a moment when someone in the room says it out loud.

“Employers should know everything about their workforce’s health. We pay for the plan.”

I’ve heard some version of that from a CFO on nearly every self-insured engagement. Paying for the plan buys the right to manage it, not to read it. Law aside, knowing everything wouldn’t even help. A benefits leader who sees one employee’s diabetes risk score can ignore it or act on it, and acting is what a plaintiff’s lawyer will later call an adverse action. Neither bends the cost curve.

The design I keep coming back to is what I call the firewall model. A third party holds the identified data: the TPA, the carrier, or a vendor working as a business associate of the plan. Models run there. Outreach to individuals happens there too, from a nurse or care coordinator who works for the plan, never for HR. What crosses the firewall to the employer is cohorts, something like “members at the two distribution centers show rising musculoskeletal risk, cohort of 600,” with no names, no IDs and no cell small enough to point at someone.

That isn’t a compromise. It’s the architecture that works.

Most of the firewall is an engineering problem rather than a data science one. When employers or digital health vendors commission it as custom work from teams offering medical software development services, the deliverables worth paying for first are the de-identification pipeline, the consent ledger and the minimum-cohort rule. Model tuning comes later, because a mediocre model behind a sound firewall is safe to improve, and a great model without one is a liability on day one.

Individual risk scores are weaker than the sales deck implies

Here’s the problem with profiling people. The math doesn’t support it.

In October 2016, the Society of Actuaries compared over 40 claims-based risk scoring models on a sample of 1 million commercial members drawn from MarketScan data. Using 2012 claims to predict 2013 costs, the prospective models explained between 8.6% and 24.8% of the variance in uncensored cost. Even the top performer left about three-quarters of next year’s spending unexplained.

For a population of 20,000, that’s fine. Individual errors wash out. For one person, the score is a rough guess dressed up as a number.

Then there’s bias. In 2019, Obermeyer and colleagues published an analysis in Science of a widely used commercial algorithm that predicted health care cost as a stand-in for health need. At the same risk score, Black patients were considerably sicker than White patients, because less money had historically been spent on their care. Correcting the label would have raised the share of Black patients flagged for extra help from 17.7% to 46.5%.

An employer acting on individual scores inherits both problems. The noise and the skew.

None of this means prediction is a waste. CDC figures put 90% of the nation’s $5.3 trillion in annual health care spending on people with chronic and mental health conditions, and a self-insured employer carries its share of that directly. Population prediction tells you where that money goes next and which programs to fund. Below is the signal map I use with benefits teams.

Medical and pharmacy claims carry the most signal and the most obligations

Claims are the backbone. Diagnosis codes, procedures, allowed amounts, and pharmacy fills form a longitudinal record no survey or device can match. Pharmacy data is the fast lane. A pharmacy claim adjudicates at the counter, while medical claims keep trickling in for months after the visit, so a new GLP-1 prescription or a lapse in statin refills shows up long before the related office visits do.

The features that earn their keep are rarely exotic. Medication adherence measured as proportion of days covered. Emergency department visits without a follow-up. Gaps in recommended care for members with diabetes or hypertension. On one project for a self-insured manufacturer, the most useful output wasn’t a risk score at all. It was a monthly count of members who had stopped refilling blood pressure medication, broken out by site for the employer and handed by name only to the carrier’s care team.

Predictive value: High, because claims combine diagnoses, utilization, and pharmacy timing, and they’re the inputs every serious risk model was built on.

Legal and trust risk: High, because claims are protected health information under HIPAA and must stay with the plan and its business associates, with only de-identified cohort output reaching the employer.

Wearables and wellness app data predict behavior better than disease

Step counts, sleep and resting heart rate make lovely dashboards and weaker clinical predictors. With enough history, the data shows activity patterns, sleep disruption or a sustained rise in resting heart rate. It says far less about who will be hospitalized next year.

The bigger issue is who’s wearing the device. In every rollout I’ve seen, the early adopters are the people who already run on weekends. The Illinois study discussed below found exactly that pattern for wellness program participants, and I’d expect wearables to follow it even more strongly, though that study didn’t test devices directly. A model trained on enthusiasts learns about enthusiasts.

The legal picture is thinner than people expect, and that cuts both ways. When an employer-sponsored app collects the data outside the group health plan, HIPAA often doesn’t apply at all. The FTC’s Health Breach Notification Rule, amended in 2024, and state laws such as Washington’s My Health My Data Act fill part of that gap, and the ADA still applies if the program asks medical questions. Fewer federal rules. Same employees. Their trust breaks the first time someone learns their sleep data was visible to a manager.

Predictive value: Medium, because activity and sleep trends are real signals, but the wearing population skews healthy and device churn erodes the history models need.

Legal and trust risk: Medium, because federal coverage is patchy, yet employees treat this data as more personal than their claims, so a single leak does outsized damage.

Biometric screenings mostly tell you who showed up

On-site screenings for blood pressure, cholesterol, glucose and BMI produce genuine clinical numbers, which the individual should take to their own doctor. As a workforce prediction source, they’re shakier.

The best evidence comes from the Illinois Workplace Wellness Study by Jones, Molitor and Reif, published in the Quarterly Journal of Economics in 2019. The researchers randomly assigned program eligibility and incentives to nearly 5,000 University of Illinois employees, with annual biometric screenings and health risk assessments at the core. The study results are blunt. The program raised screening rates. It produced no significant causal effect on total medical spending, other health behaviors or productivity over more than two years. Participants had lower spending and healthier habits before the program started, and the authors’ confidence intervals rule out 84% of earlier estimates on medical spending and absenteeism.

So the screening data mostly describes the healthy volunteers. Train a model on it and you get a confident map of the wrong population.

The legal exposure is heavy. A biometric screening is a medical examination under the ADA, so participation must be voluntary and the employer may see only aggregates. If the health risk assessment asks about family history, GINA comes into play. And with no incentive rule in force, the size of any reward tied to screening is a judgment call for counsel.

Predictive value: Medium, because the measurements are clinically meaningful but self-selected, so they underrepresent the members most likely to drive cost.

Legal and trust risk: High, because screenings are ADA medical exams with aggregate-only reporting, often touch GINA, and sit under an unresolved incentive standard.

Absence and disability data predict well and sit too close to HR

Benefits teams underrate this signal. Short-term disability claims, FMLA leave patterns and unplanned absence predict future absence, long-term disability and, at the cohort level, rising musculoskeletal and behavioral health costs.

The trap is where the data lives. HHS’s own guidance says the Privacy Rule doesn’t protect employment records, even when they contain health information. That sounds like freedom. It isn’t. The ADA’s confidentiality rules still cover medical information in those files, FMLA records carry their own confidentiality requirements, and the data sits in the same HRIS that managers use for scheduling, reviews and promotions. Not a privacy rule gap. A proximity problem.

The fix is to move modeling to the absence administrator or disability carrier, which already holds the diagnosis. HR gets case status and cohort trends, never a predicted likelihood that a named employee will go out on leave.

Predictive value: High, because past absence and disability history are among the most reliable predictors of future absence and claim duration.

Legal and trust risk: High, because the data sits next to employment decisions, and any individual prediction that reaches a manager looks like discrimination even when nobody intended it.

Engagement surveys and EAP usage only work as aggregates

Pulse surveys on workload and burnout, plus EAP utilization by category, can flag behavioral health pressure months before it appears in claims. A department where reported workload spikes and EAP contacts for anxiety climb in the same quarter deserves attention, through staffing reviews, manager training or better therapy access.

All of that works only at the cohort level. Small teams are the danger. A unit of eight people with one EAP contact for substance use isn’t a statistic, it’s a person, and everyone in that unit can guess who. EAPs that provide counseling often count as group health plans in their own right, which brings HIPAA along with them. Vendors will report utilization by category, but those reports need suppression rules and a lag, or they turn into a guessing game.

Predictive value: Medium, as an early cohort signal for behavioral health costs and turnover, and close to useless for any individual’s clinical risk.

Legal and trust risk: Medium, rising to high the moment a reporting cell is small enough to identify someone, because employees will stop using the EAP if they suspect it reports back.

A governance charter in six clauses keeps the firewall standing

Here is the whole signal map on one page.

A table enforces nothing. A charter signed by benefits, legal, HR and the vendor does. These are the six clauses I ask for before any model goes live.

1. No individual score crosses the firewall. Models may score members inside the plan’s vendor for clinical outreach, and the employer receives cohort output only.
2. The minimum cohort size is written down. Pick a floor, such as 50 members, and suppress every cell below it in dashboards, drill-downs and exports.
3. Consent is specific and revocable. Each data source gets its own opt-in, and withdrawing stops the feed within one business day.
4. Every model is audited for proxy bias. Any model trained on cost is tested against clinical measures by race, sex and age before launch and once a year after.
5. Outputs serve care and plan design only. Predictions may shape benefits, programs and outreach, and never hiring, promotion, scheduling or termination.
6. An independent reviewer checks the data flows annually. The findings go to employees in plain language, not just to the board.

The best employee health model is the one your HR team can’t open.