A federal judge on Tuesday sent the U.S. Equal Employment Opportunity Commission back to the drawing board on regulations for increasingly popular workplace wellness programs, ruling in part that the agency failed to justify its 30 percent cap on cost incentives for participating workers.

AARP challenged the rule in October, arguing it would allow employers to illegally access private health information and potentially use that data in a discriminatory manner. The AARP, which lobbies on behalf of nearly 38 million people age 50 and older, also alleged the 30 percent limit on health care cost incentives was too high of a penalty for nonparticipating workers.

In the rulemaking process, the EEOC determined a wellness program could be considered “voluntary” so long as the cost incentives—or, seen another way, the penalty for nonparticipating employees—did not exceed 30 percent of the value of an individual’s plan.

In his decision, U.S. District Judge John Bates of the District of Columbia in Washington acknowledged the “tension that exists between the laudable goals behind such wellness programs”—which often entail collecting sensitive medical information from employees—and other federal regulations limiting employers’ access to such data. But he found that the EEOC had failed to adequately explain its decision to interpret the term “voluntary” in those other regulations—the Americans with Disabilities Act and the Genetic Information Nondiscrimination Act—to allow the 30 percent incentive threshold.

“Neither the final rules nor the administrative record contain any concrete data, studies or analysis that would support any particular incentive level as the threshold past which an incentive becomes involuntary in violation of the ADA and GINA,” Bates wrote. “To be clear, this would likely be a different case if the administrative record had contained support for and an explanation of the agency’s decision, given the deference courts must give in this context. But ‘deference’ does not mean that courts act as a rubber stamp for agency policies.”

The EEOC and AARP—represented by its litigation arm, the AARP Foundation Litigation—did not immediately respond to requests for comment.

Read more: Anthem, Cigna and Macy’s Sued Over Wellness Plan

Bates’ decision granted the AARP’s motion for summary judgment against the EEOC rule. But Bates declined to vacate the rule entirely out of concern for “significant disruptive consequences.”

If the rule were vacated, Bates said, employees who’ve already received wellness program incentives “would presumably be obligated to pay these back,” while employers who effectively imposed a penalty on nonparticipating employees “would likewise be obligated to repay to employees the cost of the penalty.”

Protected health care information that was already disclosed to companies “cannot be made confidential again,” Bates said.

“It is far from clear that it would be possible to restore the status quo ante if the rules were vacated; rather, it may well end up punishing those firms—and employees—who acted in reliance on the rules,” Bates wrote.