29 CFR Part 1630, Regulations to Implement the Equal Employment Provisions of the ADA (Title I Regulations with amendments issued through May 2016)

(iv) A covered entity shall not require an employee to agree to the sale, exchange, sharing, transfer, or other disclosure of medical information (except to the extent permitted by this part to carry out specific activities related to the wellness program), or to waive any confidentiality protections in this part as a condition for participating in a wellness program or for earning any incentive the covered entity offers in connection with such a program.