Voluntary participation
No penalty, pressure, or hidden employment consequence for participation or nonparticipation.
Privacy and trust
Make the privacy promise enforceable.
Trust depends on rules responders can understand and leadership can audit. Set access, use, aggregation, retention, vendor, off-duty collection, breach response, and accountability before collecting wellness information.
01
The central separation
Individual wellness information
ProtectedParticipation and personal trendsScreens, symptoms, and referralsClinical and support informationResponder-facing or held by the authorized support roleEnforced boundary
Organizational information
ActionableSchedules, staffing, and workloadService capacity and accessSafely aggregated outcomesNo individual wellness recordThe separation belongs in contracts, systems, consent, access controls, vendor agreements, and department policy. Employer wellness information does not automatically receive the same protections as a clinical record.
02
Eight governance commitments
Purpose limitation
Every field has a written purpose; no secondary employment, disciplinary, investigative, or productivity use.
Command separation
Personal wellness data remain outside routine command access. Command receives operating facts and safely aggregated workforce information.
Small-cell suppression
Aggregate views use prespecified minimum cohort sizes, time windows, and suppression to reduce reidentification risk.
Data minimization
Collect the least data required; justify off-shift collection, retention, processors, and deletion.
No automated employment decisions
No fitness-for-duty, assignment, promotion, credentialing, firearm-status, or disciplinary action from wellness data.
Responder access and correction
Participants can see their own program data, understand how it was derived, and challenge errors.
Joint governance
Labor, counsel, clinical, resiliency, security, and command stakeholders approve the rules before collection.
03
Who may see what
RoleMay accessMust not access through wellness
Responder
Their own information, how it was derived, available choices, consent status, access history, and correction process.
Other participants’ information or unsupported peer rankings.
Clinician or care provider
Only the information needed for care within the provider’s lawful clinical workflow.
Routine command reporting of diagnoses, notes, medications, referrals, or private trends.
Wellness leader or navigator
The minimum information needed to explain resources, connect the responder, and confirm whether navigation worked.
Covert individual alerts, inferred off-duty behavior, clinical records, or employment decisions.
Administrative office
Only the minimum information required by an established, responder-authorized administrative process.
Biometrics, scores, symptoms, diagnoses, clinical notes, or rationale not required for that process.
Command
Operating conditions it controls, service performance, and organizational outcomes that meet the written reporting rules.
Named participation, nonparticipation, screens, physiology, diagnoses, referrals, utilization, or individual risk labels.
Vendor or processor
The minimum fields and retention period required to provide the contracted function.
Secondary advertising, data sale, unrelated model training, product development, or unapproved combination with other data.
04
Keep wellness separate from employment decisions
Personal wellness information belongs in the support system.
DisciplineInvestigationPromotionAssignmentCredentialingFirearm statusFitness for dutyProductivity scoringInsurance decisionsCovert surveillance
Use established lawful occupational-health, emergency, and employment processes for their intended purposes. Do not recreate those processes through a voluntary wellness channel.
Legal and implementation reference points
HHS: workplace wellness and HIPAA EEOC wellness privacy principles DOJ officer wellness best practices
This page provides design guidance, not legal advice. Final rules require agency counsel, labor participation, clinical and security review, applicable law, and written contracts and policy.
Related guidance
Put the protections inside the operating model.
The department readiness framework shows how governance, measurement, access, physical recovery, leadership action, and outcomes work together.
Open the readiness framework