Closing the Gap: Health and Welfare Compliance

Even the most well-managed employee benefit plans may have certain compliance blind spots. From outdated documentation to missed filing deadlines, we have highlighted a few areas below where we often see gaps.

Plan documentation & Participant Communications – Do you know where your documents are and when they were last updated?

• Plan Document
  • Every ERISA-covered health and welfare plan must be documented in writing and must contain certain content.
    • Contracts with insurers or administrators often do not contain all required content alone.
  • Rather than maintaining many separate plan documents, you may use a wrap plan to bundle multiple benefit options together and file a single combined Form 5500.
• Summary Plan Description (SPD)
  • The SPD is the “plain English” version of your plan document – it must be distributed to new participants within 90 days of enrollment and updated at least every five years if there are changes (or every 10 years if not).
  • When you make a change to the plan that must be reflected in the SPD, you may provide a summary of material modifications rather than a full SPD update. Participants must be notified of changes no later than 210 days after the end of the plan year in which the change is adopted (or within 60 days of the change if it reduces/cuts benefits).

Annual Requirements – Do you have annual requirements calendared? Have you reviewed agreements with vendors assisting you with these obligations recently?

• Form 5500
  • A Form 5500 must be filed electronically with the Department of Labor (DOL) each year for every health and welfare plan that covers 100 or more participants or is funded (e.g., uses a trust).
  • Form 5500 is due by the last day of the seventh month after the end of the plan year (e.g., July 31 for calendar year plans) unless you timely file a Form 5558 to get an automatic 2½-month extension (until October 15 for calendar year plans).
• Annual Health Coverage Reporting
  • Applicable large employers (ALEs) are those with 50 or more full-time equivalent (FTE) employees who must annually report the health coverage they offered.
    • Note: FTEs include both full-time employees (those averaging at least 30 hours/week or 130 hours/month) and a combination of part-time employees whose hours collectively equal a full-time workload.
  • Form 1094-C is just filed with the IRS while Forms 1095-C are distributed to each full-time employee (or former employee) and filed with the IRS.
    • Recent changes in the law allow you to provide Forms 1095-Cs only on request but still require you to provide notice of availability of the Form.
  • Even employers who are not ALEs have reporting obligations via Forms 1094-B and 1095-B if they sponsor a self-funded health plan.
    • Forms 1095-B or -C were due to be distributed to employees by March 3, 2025, for 2024 reporting.
    • Electronic forms were due to be filed with the IRS by March 31, 2025, for 2024 reporting. (Only employers filing 10 or fewer returns may file on paper.)
  • Patient-Centered Outcomes Research Institute (PCORI) Fees
    • If you sponsor a self-funded health plan, which includes a level-funded health plan for this purpose, you must report and pay PCORI fees via Form 720 no later than July 31 following the end of the applicable plan year.
  • Summary of Benefits and Coverage (SBC)
    • The SBC is a standardized summary that helps employees easily compare health plan options by outlining key information like deductibles, copays, and coverage limits.
      • You must distribute the SBC when employees are first eligible, at open enrollment, within 90 days of special enrollment, and at least 60 days before certain mid-year changes.
      • If 10% or more of the population in a county where a SBC is distributed is literate only in a non-English language (e.g., Spanish), you must include a notice in that language on the SBC about the availability of language services and provide the SBC in that language upon request.

COBRA Compliance – Are your notices in good shape?

When a “qualifying event” occurs (e.g., a termination of employment or a reduction in hours that results in a loss of group health coverage), you must offer continuation of group health coverage under COBRA to “qualified beneficiaries”.

• Specific notices must be provided to eligible employees and their dependents when group health coverage begins, within 14 days of a qualifying event or a request for COBRA when coverage is unavailable, and when coverage ends early (e.g., for nonpayment).
• In recent years, many class action lawsuits have alleged that COBRA notices were missing required content or were not written in a way that the average participant could understand.

Medical Child Support Orders (MCSOs) – Do you have QMCSO procedures?

You must honor certain legal orders requiring coverage for a participant’s child (usually a child living with a noncustodial parent). There are two main types of MCSOs:

• Qualified Medical Child Support Orders (QMCSO): These are court-issued orders requiring a plan to provide health coverage to a child. You must review the order promptly to determine if it is “qualified”, notify the participant and custodial parent of the determination, and provide coverage if the order is qualified.
• National Medical Support Notices (NMSN): These are standardized forms sent by state child support enforcement agencies. They are legally binding and must be processed just like a court-issued order.
  • You should maintain written QMSCO procedures, as required under ERISA.

HIPAA Privacy Requirements – Are your HIPAA practices current?

Self-funded group health plans are required to follow fulsome Security and Privacy rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Two such requirements are highlighted below:

• HIPAA Privacy Procedures
  • Plans must maintain written HIPAA privacy procedures outlining how protected health information (PHI) is used, disclosed, and safeguarded. While these rules have been in place since 2003, new regulations required updates be made to HIPAA policies and procedures and training practices by December 23, 2024, addressing protections for reproductive health care data.
• HIPAA Notice of Privacy Practices
  • This notice explains how participants’ health information is handled and their rights under HIPAA and must be provided at initial enrollment and reissued every three years or when there is a material change.
    • An updated version addressing reproductive health protections must be distributed by February 16, 2026.

Wellness Programs – What incentives do you offer?

If your wellness program collects “health information” (e.g., data related to an individual’s physical or mental health, medical history, biometric data, or responses to health risk assessments), it must comply with laws like the American Disabilities Act and the Genetic Information Nondiscrimination Act, among others, that limit what information may be requested/collected and what rewards or penalties may apply, including that an annual notice regarding information to be collected and its use is required to be distributed.

• Incentives tied to wellness programs must not be so high that they become coercive. Under the Affordable Care Act (ACA) and HIPAA, incentives must generally be capped at 30% of self-only coverage (50% for tobacco cessation).

Tobacco Surcharges – Do you apply a tobacco surcharge?

Group health plans can charge higher premiums to tobacco users if the surcharge complies with ACA and HIPAA, including that the plan must offer a reasonable alternative, such as a smoking cessation program. If a participant completes the alternative, the surcharge must be waived even if he or she does not cease tobacco use, which surcharge waiver must be clearly explained in writing.

• Recently, several class action lawsuits regarding tobacco surcharges have been brought alleging the required alternative was not offered/communicated, etc.

Transparency and Disclosure Obligations – Are you confident you are on-top-of all these new and changing requirements?

Group health plans are subject to a growing set of rules aimed at improving transparency and protecting participants from unexpected costs. Two of the laws getting a lot of attention in this space are highlighted below:

• Mental Health Parity
  • Under the Mental Health Parity and Addiction Equity Act (MHPAEA), group health plans that offer mental health or substance use disorder (MH/SUD) benefits must treat those benefits no less favorably than medical or surgical benefits (e.g., same standards for determining medical necessity and equal limits on the number of visits or treatment duration).
  • While enforcement action related to some portions of the MHPAEA has been paused, plans must still maintain a written analysis showing that any non-dollar-based limits (like prior authorization or step therapy) applied to MH/SUD benefits are no more restrictive than those applied to medical/surgical benefits.
    • This analysis is complex. If you maintain a self-funded plan, your administrator may provide a standard document for this purpose that needs to be updated for any variations in your coverage from the administrator’s default.
  • Gag Clause Prohibition Compliance Attestation
    • Group health plans must affirm by December 31 of each year that their contracts with insurers, administrators, and other vendors do not include terms that restrict the disclosure of cost or quality of care information.

As only a few of the areas where we often see gaps are highlighted above, it is clear there are lots of things to be thinking about in ensuring your health and welfare plans are compliant. We recommend you engage in an internal audit/checkup on these areas (and others) to confirm you have good practices and procedures in place and/or identify a few areas that could use some extra attention this year. This insight was authored with assistance from summer associate Sterling Russ.