Employer wellness programs can gather medical information from employees and spouses — so long as financial incentives or penalties don't exceed 30 percent of the annual cost for an individual in the company's group health plan, according to final rules issued by the Equal Employment Opportunity Commission Monday.

Although such penalties or incentives could run into the hundreds or even thousands of dollars, the programs are considered voluntary — and therefore legal, the commission said.

The rules seek to ensure "wellness programs actually promote good health and are not just used to collect or sell sensitive medical information about employees and family members or to impermissibly shift health insurance costs to them," the EEOC said. But the final rules drew immediate concern from some groups. Jennifer Mathis, director of programs for the Bazelon Center for Mental Health Law, says the new rule rolls back protections in existing law.

"Voluntary inquiries can now come with steep financial penalties, according to the EEOC, for choosing not to answer," she said. "That's a troubling precedent for the application of civil rights laws."

The highly anticipated rules from the Equal Employment Opportunity Commission will go into effect next January and will help define how these rapidly expanding wellness programs are run. They are also an effort to coordinate consumer provisions in several competing federal laws, including the Americans With Disabilities Act, the Affordable Care Act and Genetic Information Nondiscrimination Act of 2008.

Generally, employers reacted cautiously to the new rules. Many groups had advocated for stricter provisions and even higher penalties or incentives.

"Wellness programs … are making progress in helping employees and their families be healthier," Brian Moynihan, CEO of Bank of America and chair of the Business Roundtable's health committee, said in a statement. "Companies will review the new guidelines with a view toward ensuring that these programs are able to continue to make a positive impact."

But consumer and disability-rights advocates, who had sought broad changes when the draft rules were presented last year, were clearly disappointed. The regulations don't provide enough privacy protections, they said, and the programs can't be considered voluntary with the level of incentives and penalties that were approved by the EEOC.

"This could coerce employees into providing information that they would otherwise not provide about their health," said Sarah Fleisch Fink, senior policy counsel with the National Partnership on Women & Families, which was among dozens of groups that wrote comment letters seeking changes in the draft rule.

The final rules cover a wide variety of issues, from the financial incentives to how the medical information gathered must be protected.

One rule clarifies what wellness programs must do to comply with the requirements of the Americans with Disabilities Act, a law aimed at preventing discrimination. The ADA generally prohibits employers from asking questions related to health or disability, except in limited circumstances, such as through voluntary workplace wellness programs.