Health Risk Assessment HRA Consent and Data Privacy Authorization Template

HEALTH RISK ASSESSMENT (HRA) CONSENT AND DATA PRIVACY AUTHORIZATION

I. DOCUMENT CONTROL

• Effective Date: [Date]
• Version: 1.0
• Jurisdiction/Scope: [State/Country] / Internal Corporate Wellness Program

II. OFFICIAL NOTICE & COMPLIANCE DISCLAIMER

LEGAL NOTICE: This document constitutes a formal authorization for the collection, processing, and storage of Protected Health Information (PHI) and/or Personally Identifiable Information (PII). This form is designed to comply with applicable privacy regulations, including the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR), where applicable. Consult internal legal counsel prior to implementation to ensure regional compliance.

III. PARTIES & DEFINITIONS

This Health Risk Assessment (HRA) Consent ("Agreement") is entered into by and between:

• Company: [Company Name], located at [Company Address] ("Company").
• Participant: [Full Legal Name], residing at [Participant Address] ("Participant").

IV. OPERATIVE CLAUSES

1. Voluntary Participation: The Participant acknowledges that participation in the HRA is strictly voluntary. No adverse employment action shall be taken against the Participant for declining participation.
2. Scope of Assessment: The HRA may include biometric screenings, health questionnaires, and lifestyle surveys. The Participant understands that these assessments are for wellness purposes and do not constitute a diagnostic medical examination.
3. Data Privacy & Security: All data collected shall be maintained in strict accordance with [Applicable Privacy Law/Standard]. Data will be stored on secure, encrypted servers, accessible only by authorized personnel and third-party wellness vendors bound by Business Associate Agreements (BAA).
4. Data Usage: The Company shall receive only de-identified, aggregated reports. No individual health data shall be shared with Company management, human resources, or supervisors to influence employment decisions or insurance premiums.
5. Right to Withdraw: The Participant reserves the right to withdraw consent at any time by providing written notice to [Privacy Officer/Department Email]. Upon withdrawal, existing data will be purged as required by law.
6. Limitation of Liability: The Company assumes no responsibility for medical advice or diagnostic results provided by the HRA vendor. Participants are encouraged to consult their personal physician regarding any findings.

V. SIGNATURES & ACKNOWLEDGMENT

By signing below, I certify that I have read, understood, and voluntarily agree to the terms of this HRA Consent.

Participant: ___________________________
Printed Name: [Full Legal Name]
Date: [Date]

Company Authorized Representative: ___________________________
Title: [Title]
Date: [Date]

VI. EXECUTION GUIDE

• Distribute Securely: Provide this document via an encrypted portal or physical copy. Ensure the Participant receives a fully executed copy for their personal records.
• B2B Verification: Before execution, verify that the HRA service provider has signed a Business Associate Agreement (BAA) with the Company, ensuring the vendor assumes liability for data breaches under HIPAA/GDPR.
• Data Minimization: Strictly limit the collection of health data to only what is necessary for the stated wellness goals. Retain signed consent forms in a separate, restricted folder from the Participant's general employment file.
• Periodic Review: Schedule an annual audit of the HRA process to ensure data handling practices remain aligned with the specific privacy representations made in Section IV.