2026 Newfront Compliance Considerations for Self-Insured Plans Guide

NEWFRONT

Compliance Considerations for Self-Insured Plans

2026 Edition

Audio

Presented by: Brian Gilmore | Lead Benefits Counsel, VP

Guide Topics

Self-Insured Health Plans: The Big Picture

Going Self-Insured Triggers Multiple Additional Compliance Items

• Employers primarily consider moving to self-insured plans because they become large enough that it is potentially a more cost-effective option vs. fully insured and it provides additional options for customization • The move to self-insured comes with a number of additional compliance burdens that are not always considered until after the fact • This guide reviews the key additional items that employers must address when they offer a self-insured health plan • Keep in mind that all plans that are not fully insured are treated as self-insured for compliance purposes • In particular, level funded plans are subject to self-insured compliance requirements

Self-Insured Health Plan Compliance Topics for Discussion:

1 ACA Reporting: Self-insured employers have additional §6055 reporting required (ALEs in Part III of Form 1095-C, non-ALEs via Forms 1094-B and 1095-B)

2 CAA: Most issues are likely handled by the TPA, but employers are responsible for certain notice requirements

3 HIPAA: A brief overview of the primary HIPAA privacy and security matters (full training still required!)

4 ERISA: Preemption of state insurance mandates and fiduciary issues for self-insured employers

5 Additional Items: PCORI, §105(h) nondiscrimination, COBRA, domestic partners, leave considerations

Which Plans are Considered Self-Insured?

General Rule: Plans That are Not Fully Insured are Treated as Self-Insured for Compliance Purposes

It is helpful to think of the distinction among funding arrangements as follows: • Fully Insured; and • Not Fully Insured (including self-insured and level-funded) Plans that are not fully insured (i.e., no insurance policy) are treated as a self-insured plan for compliance purposes.

Level-Funded Plans are Treated as Self-Insured Plans for Compliance Purposes • Level-funded plans are not fully insured, and therefore they are treated as self-insured for compliance purposes • These are arrangements where the employer pays a level fee each month to the TPA (includes an administrative fee, estimated cost for benefits, and a stop-loss premium) • If the plan’s claims experience is lower than expected in a level-funded plan, the employer will share in the surplus

Technical Definition of Self-Insured: §105 • IRC §105(h)(6): • "The term 'self-insured medical reimbursement plan' means a plan of an employer to reimburse employees for expenses referred to in subsection (b) for which reimbursement is not provided under a policy of accident and health insurance."

Technical Definition of Self-Insured: §105 Regulations • Treas. Reg. §1.105-11(b)(1)(i): • "A plan or arrangement is self-insured unless reimbursement is provided under an individual or group policy of accident or health insurance issued by a licensed insurance company..."

Remember: Level-Funded Plans Treated as Self-Insured • Level-funded plans feel like a hybrid because of the level payment approach, but they are not fully insured (no policy of insurance) • Plans (including level-funded plans) that are not fully insured are treated as self-insured for compliance purposes • Always apply self-insured plan rules to level-funded plans!

01 ACA Reporting Additional Steps for Self-Insured Plans

Which Employers Need to Report?

Self-Insured Medical Plan

• All employers with a self-insured medical plan (including level-funded plans) must report regardless of size • Non-ALE employers under 50 full-time employees (plus full-time equivalents) will be reporting only for §6055 (minimum essential coverage) via Forms 1094-B and 1095-B • Employers that are “applicable large employers” will report both for §6055 (minimum essential coverage) and §6056 (employer mandate) via Forms 1094-C and 1095-C

Insured Medical Plan

• Only “applicable large employers’ – those with 50 or more full-time employees (plus full-time equivalents). • For insured plans, the insurance carrier reports for §6055 (minimum essential coverage) via 1095-B • However, the insurance carrier will not report for §6056 (employer mandate)—that is always the employer’s responsibility via Forms 1094-C and 1095-C

Full Details Available Here: ACA Reporting Deadlines and Compliance Requirements for 2026

Which Employers Need to Report?

Is the Medical Plan Fully Insured?

No Yes

ALE? Yes No

§6055 & §6056 Form 1094-C Forms 1095-C Part III (MEC): Yes

ALE? Yes No

§6056 Form 1094-C Forms 1095-C Part III (MEC): No

§6055 (MEC Only) Form 1094-B Forms 1095-B

None! No ACA Reporting

Form 1095-C: Offer Details and Coverage

. This form is completed for every full-time employee . Self-insured plans also need to report all individuals covered (self-insured non-ALEs use Form 1095-B) . Two main topics being reported:

§6055: Individuals covered by MEC for individual mandate compliance . Self-insured plans only – Employers with fully insured plans leave Part III blank. . For insured plans, the insurance carrier uses the Form 1095-B to report MEC. . Requires Social Security Number (or reasonable efforts to obtain) for all covered individuals
§6056: Employer mandate compliance for §4980H penalties . All ALEs must report on this – both self-insured and fully insured . Requires detail as to plan’s offer of coverage to all full-time employees

Form 1095-C: Employer Offer Details and Coverage

Part III Coverage Information – Self-insured Plans

Self-insured plans must include MEC coverage information in Part III of the Form 1095-C: • Names of all covered individuals • SSNs of all covered individuals • Must make “reasonable efforts” to obtain the SSN for all covered individuals • Requires three attempts to solicit the SSN:

Account Opened Solicitation: Initial solicitation upon the employee’s election to enroll the dependent
First Annual Solicitation: If not received, second solicitation within 75 days of the employee’s election to enroll the dependent
Second Annual Solicitation: If not received, third solicitation by December 31 of the year following the year the employee elected to enroll the dependent • Enter date of birth for any covered individuals who don’t provide the SSN • Months of coverage (not just offered coverage, but actually enrolled) for all covered individuals in the plan

Form 1095-C: Employer Offer Details and Coverage

Part III Coverage Information – COBRA Reporting

Self-insured plans must report the coverage information in Part III for everyone enrolled—including COBRA • The Form 1095-C coding for terminated employees is one of the trickier areas of ACA reporting • Terminated Employee Enrolled in COBRA: Months After Termination of Employment in Year of Termination • Line 14: 1H (not offered coverage) • Line 15: Blank • Line 16: 2A (not employed) • Part III: Enter coverage information for employee and dependents for all months of active/COBRA coverage • Terminated Employee Enrolled in COBRA: Active Coverage Ended Previous Year • Line 14: 1G (not an employee for all 12 months) • Line 15: Blank • Line 16: Blank • Part III: Enter coverage information for employee and dependents for all months of COBRA coverage • Note: Employer may choose to report for the former employee on a separate Form 1095-B instead

Form 1095-C

Parts I & II

1095-C Employer-Provided Health Insurance Offer and Coverage Do not attach to your tax return, Keep for your records. Go to www.ni.gov/Form1095C for instructions and the latest information.

VOID OMB No. 1545-2251 CORRECTED 2024

Part I Employee 1 Name of employee (first name, middle initial, last name) 2 Social security number (SSN) 7 Name of employer 8 Employer identification number (EIN) 3 Street address (including apartment no.) 8 Street address (including room or suite no.) 10 Contact telephone number 4 City or town 5 State or province 6 Country and ZIP or foreign postal code 11 City or town 12 State or province 13 Country and ZIP or foreign postal code

Part II Employee Offer of Coverage Employee's Age on January 1 Plan Start Month (enter 2-digit number): 14 Offer of Coverage paid required code 15 Employee Required (new instructions) 16 Coverage added Sale Held state Offer Postal code # applicable 17 ZIP Code For Privacy Act and Paperwork Reduction Act Notice, see separate Instructions. Cat. No. 60705M Form 1095-C (2024)

Form 1095-C

• Part III

Form 1095-C (2024)

400320 Page 3

Part III Covered Individuals If Employer provided self-insured coverage, check the box and enter the information for each individual enrolled in coverage, including the employee.

Months of coverage

Name of covered individual(s) First name, middle name, last name

55N or other TN 100N if 50N or other TN is not available

17 months

Jan Feb Mar Apr May June July Aug Sept Oct Nov Dec

18 19 20 21 22 23 24 25 26 27 28 29 30

Form 1095-C (2024)

Self-Insured Plan (Note: Includes Level-Funded Plans)

Self Insured Health Plans (Includes Level Funded)

Employer

Form 1095-C

IRS and/or State Tax Department

Information is generally relevant only if in state with individual mandate or had Marketplace coverage.

Tax Return

1095-C helps you identify whether:

• You are eligible for premium tax credit ("PTC") if you purchased individual coverage on the Marketplace (healthcare.gov or state exchange). • You have satisfied any state individual mandate by maintaining coverage for you and any dependents.

Both Fully Insured & Self-Insured Plans (Note: Self-Insured Includes Level-Funded Plans)

Fully Insured Health Plans 1095-B helps you identify whether you have satisfied any state individual mandate by maintaining coverage for you and any dependents.

1095-C helps you identify whether you are eligible for premium tax credit ("PTC") if you purchased individual coverage on the Marketplace (healthcare.gov or state exchange).

Self Insured Health Plans 1095-C helps you identify whether: • You are eligible for premium tax credit ("PTC") if you purchased individual coverage on the Marketplace (healthcare.gov or state exchange). • You have satisfied any state individual mandate by maintaining coverage for you and any dependents.

Self-Insured Non-ALE Plan (Note: Includes Level-Funded Plans)

Self Insured Health Plans for Non-ALEs (Includes Level Funded)

Generally Under 50 Lives

Employer

Form 1095-B

IRS and/or State Tax Department

Information is generally relevant only if in state with individual mandate or had Marketplace coverage.

Tax Return

1095-B helps you identify whether:

• You are eligible for premium tax credit (PPTC) if you purchased individual coverage on the Marketplace (healthcare.gov or state exchange).

• You have satisfied any state individual mandate by maintaining coverage for you and any dependents.

The Individual Mandate is Dead, Long Live the (State) Individual Mandate

Multiple States Have Imposed State-Based Individual Mandates

• The ACA originally modelled its federal individual mandate (which took effect in 2014) on the state individual mandate first imposed in Massachusetts during the Governor Romney administration in 2006 • Since the removal of the ACA federal individual mandate tax penalty, a number of states have considered a state-based approach to protect the individual market risk profile • These new state individual mandates typically mirror the tax penalty scheme previously applied under the ACA • For example, California’s tax penalty is generally the greater of 2.5% of gross income over the filing threshold or $900/adult and $450/child • States with individual mandates now include Massachusetts, California, New Jersey, Rhode Island, Vermont, and Washington D.C.

What About State Individual Mandate Reporting?

• States are mostly relying on the Forms 1095-B (carrier reporting for fully insured) and 1095-C (self-insured) to gather coverage information for residents • Generally the carrier’s obligation to provide the Form 1095-B to the state where the plan is fully insured • Generally the employer’s obligation to provide the Form 1095-C to the state where the plan is self-insured • Note that some states have not provided the same 30-day extension available from IRS for furnishing Form 1095-C • What happens if §6055 reporting is eliminated? States would devise their own forms, likely modelled after the Form 1099-HC in Massachusetts

State Individual Mandate Highlights

State Law Effective date Employer reporting requirements Employee penalties

California Individual Mandate Health Care Mandate Website Reporting Health Insurance Information January 1, 2020 All self-insured employers regardless of size must submit forms 1094-C and 1095-C if ALE, and 1094-B and 1095-B in non-ALE to Franchise tax Board by March 31 but will not be penalized if filed on or before May 31. Health insurers are required to submit form 1095-B for all fully insured plans. Self-insured employers must provide 1095-C forms to employees by January 31. No penalty is imposed for failure to provide forms to individual by the deadline. Employers providing these statements to employees under the ACA on or before the CA deadline, do not have to provide a second statement. For fully insured employers, the insurer is responsible for providing the 1095-B to employees by January 31. The penalty for not reporting is $50 per individual who was provided health coverage.

New Jersey NJ Health Mandate NJ Shared Responsibility Requirement January 1, 2019 Reporting due March 31; self-insured employers required to file the 1094-C transmittal form and 1095-C (or 1094-B/1095-B as applicable). Fully insured employers should check with carrier to ensure carrier is filing. 1095-C forms should be provided to employees by March 1. No penalties for late filing

Massachusetts Health Care Reform for Individuals January 1, 2007 Insurance carriers and certain employers legally required to issue form MA 1099-HC no later than January 31 of the following year. Verify with the carrier if they are issuing the form. Employers with 6 or more employees must also annually between 11/15-12/15 file a Health Insurance Responsibility Disclosure (HIRD). Failure to issue form MA 1099-HC could subject employer to penalties of $50 per individual up to a maximum of $50,000

A taxpayer who does not have an exemption and does not have coverage will be subject to a penalty the higher of $900 per adult, and $450 for each dependent child under 18, or up to 2.5% of household income.

A taxpayer who does not have an exemption and does not have coverage will have a shared responsibility payment based on filing status and household income, capped at the statewide average annual premium for bronze health plans. The minimum penalty for an individual taxpayer is $695 and the maximum is $4,284.

Penalties apply only to residents age 18 and older who are deemed able to afford health insurance but did not enroll and vary depending on income, age, and family size. The penalty cannot exceed one-half of the least expensive monthly premium available through the Massachusetts Health Connector (Connector).

State Individual Mandate Highlights

State Law Effective date Employer reporting requirements Employee penalties

Rhode Island Health Coverage Mandate Reporting Requirements FAQ January 1, 2020 Employers submit their ACA reporting forms or a state specific return to Rhode Island Division of Taxation. Employers must provide forms to employees March 1. Deadline for employer reporting to the state is March 31. Penalties reviewed and assessed on a case by case basis. For late furnishment and late filing.

Taxpayer who does not have an exemption and does not have coverage will have a shared responsibility payment (greater of $695/person; $347.50 for each child, or 2.5% of your household income) capped at the Rhode Island statewide average premium for bronze-level plans offered through the Rhode Island health benefits Exchange.

Vermont Health Coverage Mandate January 1, 2020 Currently no employer reporting or distribution requirements.

Enforcement mechanism to be determined. Currently no financial penalty for failing to maintain coverage under the Vermont law. Individuals are required to indicate on their state income tax return whether they had MEC for each month of the year.

Washington DC Individual Taxpayer Health Insurance Responsibility Requirement Washington DC FAQ January 1, 2019 Employers must electronically submit their ACA reporting forms through www.MyTax.DC.gov to Washington DC by April 30; 1095 Forms to employees by March 1. No penalties for late filing or failure to furnish forms.

A taxpayer who does not have an exemption and does not have coverage will have a shared responsibility payment (greater of $795/person; $397.50 for each child, up to a maximum of $2,385, or 2.5% of your household income over the federal tax whiling threshold) capped at the average premiums for bronze level health plans available on DC Health Link.

02 The CAA New Patient Protection and Transparency Measures 18

CAA Effective Dates Timeline

February 10, 2021 • Mental Health Parity Comparative Analysis Documentation

First Plan Year on or After January 1, 2022 • Primary Care Provider Designation • Expanded to non-grandfathered plans • Preventing Surprise Medical Bills: Emergency Services (No Surprises Act) • Preventing Surprise Medical Bills: Non-Emergency Services (No Surprises Act) • Ending Surprise Air Ambulance Bills (No Surprises Act) • Reporting requirement delayed pending final regulations • Continuity of Care (No Surprises Act) • Good faith, reasonable interpretation of the CAA provisions until regulations issued • Medical ID Card Cost-Sharing • Good faith, reasonable interpretation of requirements until the Departments issue regulations

July 1, 2022 • Machine-Readable In-Network Rates and Out-of-Network Allowed Amounts with Detailed Pricing Information • Delayed from first plan year beginning on or after January 1, 2022

CAA Effective Dates Timeline

December 27, 2022 • Annual Reporting on Pharmacy Benefits and Drug Costs • Departments issued FAQ guidance on December 23, 2022 providing a grace period for first submission through January 31, 2023, and announcing a good faith efforts standard for enforcement of initial report (now annually required by 6/1)

First Plan Year on or After January 1, 2023 • Price Comparison Tool for First 500 Shoppable Items/Services • ACA regulations and CAA have nearly identical provisions, ACA provision delayed from 1/1/22 • The New CAA Surprise Billing Notice (Version 2) • For employers that maintain a public website for their group health plan

December 31, 2023 • Gag Clause Prohibition Compliance Attestation • Covers the period from date of CAA enactment (December 27, 2020) through the date of the attestation

First Plan Year on or After January 1, 2024 • Price Comparison Tool for Remaining Shoppable Items/Services • In addition to first 500 required by first plan year on or after 1/1/23

The New/Modified CAA Patient Protections: No Surprises Act

Preventing Surprise Medical Bills: Emergency Services

Medical plans that cover emergency services must generally cover such services:

Without any prior authorization requirement;
Regardless of whether the provider is in-network;
Without imposing any requirement or limitation that is more restrictive for out-of-network emergency providers than in-network emergency providers;
Without any greater cost-sharing than would apply for in-network emergency services (no balance billing); and
By applying the cost-sharing payments for out-of-network emergency services toward any in-network deductible or out-of-pocket maximum in the same manner as if the services were provided in-network

• "Cost-sharing" for these purposes includes copayments, coinsurance, and (unlike the original ACA protection) deductibles

• Full details: The CAA Patient Protections

The New/Modified CAA Patient Protections: No Surprises Act

Preventing Surprise Medical Bills: Non-Emergency Services

Medical plans that cover out-of-network non-emergency services must generally cover such services:

Without any cost-sharing requirement that is greater than would apply if provided in-network (no balance billing);
By calculating the cost-sharing as if the total amount charged by the provider is the "recognized amount" for such items and services;
With initial notice of payment or denial transmitted to the provider within 30 calendar days of the bill for such services;
With payment to the provider within 30 days of the determination date for amounts exceeding the cost-sharing owed by the participant; and
By counting the cost-sharing payments toward any in-network deductible and out-of-pocket maximum in the same manner as if the services were provided in-network

• The "recognized amount" is generally an averaging of cost determination, with the specific determination set based on state law if applicable, or otherwise set based on the Social Security All-Payer Model Agreement • The CAA adds an independent dispute resolution process that permits the plan to engage in a 30-day negotiation process with the out-of-network provider • Notice and Consent Exception: Protections against balance billing do not apply where health care provider provides notice and obtains participant's consent meeting a number of strict requirements for exception to apply • Full details: The CAA Patient Protections

The New/Modified CAA Patient Protections: No Surprises Act

Preventing Surprise Medical Bills: Employee Notice New Model Notice to Post by First Plan Year Beginning on or After January 1, 2023: • Available via CMS website, use “Version 2” • Employers sponsoring a self-insured health plan must make the notice available on a public website of the plan • No Surprises Act (NSA) rules require that health plans and insurance carriers post the notice on a public website of the plan • Website must be “publicly available” to satisfy rules • For employers with a public group health plan website, post version 2 of the Notice to that site • For employers with a fully insured plan but without a public group health plan website, insurance carrier is required to post on their site • For self-insured plans, Tri-Agency FAQ Guidance confirms that employers without a public website for the group health plan can rely on third-party administrator (TPA) where there is a written agreement for the TPA to post the files on its website on behalf of the plan • Full details: The CAA Surprise Billing Notice

The New/Modified CAA Patient Protections: No Surprises Act

Preventing Surprise Medical Bills: Employee Notice

New Model Notice Issued to Post by First Plan Year on or After January 1, 2023:

• Available via CMS website, use "Version 2" • Full details: The CAA Surprise Billing Notice

Your Rights and Protections Against Surprise Medical Bills

When you see a doctor or other health care provider, you may owe certain out-of-pocket costs like a copayment, coinsurance, or deductible. You may have additional costs or have to pay the entire bill if you see a provider or visit a health care facility that isn't in your health plan's network.

"Out-of-network" means providers and facilities that haven't signed a contract with your health plan to provide services. Out-of-network providers may be allowed to bill you for the difference between what your plan pays and the full amount charged for a service. This is called "balance billing". This amount is likely more than in-network costs for the same service and might not count toward your plan's deductible or annual out-of-pocket limit.

"Surprise billing" is an unexpected balance bill. This can happen when you can't control who is involved in your care—like when you have an emergency or when you schedule a visit at an in-network facility but are unexpectedly treated by an out-of-network provider. Surprise medical bills could cost thousands of dollars depending on the procedure or service.

CAA Prescription Drug Data Collection Reporting (RxDC)

Annual Reporting on Rx Benefits and Drug Costs

• Reporting is designed “as a means to promote competition and bring down overall health care costs” by collecting: • General information regarding the plan or coverage; • Enrollment and premium information, including average monthly premiums paid by employees versus employers; • Total health care spending, broken down by type of cost (hospital care; primary care; specialty care; prescription drugs; and other medical costs, including wellness services), including prescription drug spending by enrollees versus employers and issuers; • The 50 most frequently dispensed brand prescription drugs; • The 50 costliest prescription drugs by total annual spending; • The 50 prescription drugs with the greatest increase in plan or coverage expenditures from the previous year; • Prescription drug rebates, fees, and other remuneration paid by drug manufacturers to the plan or issuer in each therapeutic class of drugs, as well as for each of the 25 drugs that yielded the highest amount of rebates; and • The impact of prescription drug rebates, fees, and other remuneration on premiums and out-of-pocket costs.

Reports Due Annually by June 1 for Prior Year

• FAQ guidance issued 12/23/22 extended grace period for initial 2020/2021 reporting from 12/27/22 through 1/31/23 • Guidance also announced a good faith effort standard for enforcement for this initial reporting submission • Going forward the due date is June 1 annually to report on prior calendar year • June 1, 2025 reported on 2024 calendar year • June 1, 2026 reports on 2025 calendar year • No good faith efforts standards or extensions apply • Employers rely on their insurance carrier or TPA/PBM to submit the Prescription Drug Data Collection (RxDC) Report • For self-insured plans, the obligation lies with the employer, but the rules permit (and expect) employers to delegate to TPA/PBM • Full details: RxDC Reporting Considerations for Employers

CAA Mental Health Parity Comparative Analysis

MHPAEA Overview

• The Paul Wellstone and Pete Domenici Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA) generally provides that financial requirements (such as coinsurance and copays) and treatment limitations (such as visit limits) imposed on mental health or substance use disorder (MH/SUD) benefits cannot be more restrictive than the predominant financial requirements and treatment limitations that apply to substantially all medical/surgical benefits within its set classification

• Group health plans and insurance carriers may not impose non-quantitative treatment limitations (NQTL) with respect to MH/SUD benefits in any classification unless, under the terms of the plan as written and in operation, any processes, strategies, evidentiary standards, or other factors used in applying the NQTL to MH/SUD benefits in the classification are comparable to, and are applied no more stringently than, the processes, strategies, evidentiary standards, or other factors used in applying the limitation to medical/surgical benefits in the same classification

CAA Imposes New MHPAEA Documentation Requirement

• CAA expands upon the MHPAEA by requiring group health plans and insurance carriers that offer both medical/surgical benefits and MH/SUD benefits, and that impose NQTLs on MH/SUD benefits, to perform and document a comparative analysis of the design and application of the NQTLs.

Comparative Analysis Disclosure

• The CAA requires group health plans and insurance carriers that offer both medical/surgical benefits and MH/SUD benefits, and that impose NQTLs on MH/SUD benefits, to make their comparative analysis of the design and application of NQTLs available to the Departments (DOL/HHS/IRS) or applicable state authorities

• July 2023 Tri-Agency MHPAEA Report to Congress reported EBSA issued 25 letters requesting comparative analyses for 69 NQTLs from Nov. 2021 – July 2022

• Newly finalized regulations require plan sponsors to certify they have engaged in a prudent process to select/monitor the preparer of the comparative analysis

• Full details: The CAA Mental Health Parity Comparative Analysis Requirement

The MHPAEA Employer Certification (Delayed) Full Details: The Mental Health Parity Employer Certification Requirement

The Departments issued a lengthy set of new regulations in 2024 to address many aspects of the CAA MHPAEA comparative analysis requirement. These have been delayed at least 18 months after lawsuit challenging rules—unclear if/when a certification will be required. • The Departments delayed enforcement (originally effective 2025) pending litigation and reconsideration of the rule. It may eventually be removed.

The Certification Requirement:

Employer as fiduciary must certify: • They have engaged in a prudent process to select the service provider(s) to perform and document a comparative analysis in accordance with applicable law • The analysis is based on the imposition of any nonquantitative treatment limitations (NQTL) that apply to mental health and substance use disorder benefit (MH/SUD) under the plan • They have satisfied their duty to monitor the service provider(s) per the standard ERISA duty of prudence with respect to the performance and documentation of the comparative analysis

What the DOL Expects of Employers:

DOL expects employers as fiduciary to: • Review the comparative analysis prepared by or on behalf of the plan with respect to an NQTL applicable to mental health and substance use disorder benefits and medical/surgical benefits • Ask questions about the analysis and discuss it with service providers, as necessary, to understand the findings and conclusions documented in the analysis • Ensure that the service provider provides assurance that the comparative analysis complies with the requirements of MHPAEA

Enforcement Process:

Available Upon Request • The plan must provide the comparative analysis to the relevant department (DOL/IRS/HHS) within 10 business days of the relevant department's request • The plan has 45 calendar days to correct issues if determined to be noncompliant
Notify Employees • If the plan receives a final determination of noncompliance, it has 7 business days to notify all enrolled employees • Header: “Attention! The Department of [X] has determined that [plan name] is not in compliance with the MHPAEA!”

CAA Gag Clause Prohibition Compliance Attestation

Prohibited Gag Clauses Under CAA

To increase transparency by removing gag clauses on price and quality information, CAA prohibits plans from entering into agreements with health care providers, network, TPA, or other service providers that have restrictions on releasing certain information:

Provider-specific cost or qualify of care information or data through a consumer engagement tool or any other means;
Electronic de-identified claims and encounter information or data for individuals upon request and consistent with HIPAA, GINA, and the ADA;
The ability to share information or data in 1) and 2) above (or to direct information be shared) with a HIPAA business associate, consistent with HIPAA, GINA, and the ADA.

CAA Imposes Gag Clause Prohibition Compliance Attestation Requirement (GCPCA)

• The CAA includes an annual attestation requirement for plans to certify their compliance with the gag clause prohibition. This is referred to as the annual Gag Clause Prohibition Compliance Attestation, or "GCPCA".

Satisfying the GCPCA

• For fully insured plans, the employer and carrier are both responsible, but FAQ guidiance confirms both will be treated as satisfying if carrier submits • For self-insured plans, the employer may satisfy the attestation requirement by entering into a written agreement with the TPA to complete • Attestation is due by December 31 annually (first was due in 2023), completed at the Gag Clause Prohibition Compliance Attestation website • Full details: The CAA Gag Clause Prohibition Attestation Requirement

Price Transparency Revolution Underway with ACA and CAA

Machine-Readable Files (MRF): Enforced as of July 1, 2022

Detailed Pricing Information Covering the Individual and Group Markets • Available to consumers, researchers, employers, third-party developers, and the rest of the public • Standardized format with monthly updates required • Three separate machine-readable files with detailed pricing information:

In-Network: Negotiated rates for all covered items and services between plan and in-network providers
Out-of-Network: Historical payments to, and billed charges from, out-of-network providers
Prescription Drugs: Previously delayed pending implementation of broader CAA Rx reporting rules—new guidance states there is no meaningful difference with CAA, so it is required going forward

Employer Issues: The Public Group Health Plan Website Conundrum

Employers Must Post Links to Machine-Readable Files in Some Situations • Transparency in Coverage (TiC) rules require that “group health plan or health insurance issuer must make available on an internet website” the machine-readable files • Website must be “publicly available” to satisfy rules • For fully insured plans, this requirement is simply satisfied by the plan’s insurance carrier • For self-insured plans, issue is that many employers do not have a public website for the group health plan • CMS Technical Guidance and Tri-Agency FAQ Guidance both confirmed that employers without a public website for the group health plan can rely on TPA where there is a written agreement for the TPA to post the files on its website on behalf of the plan • Full details: The CAA Machine-Readable File Posting

Price Transparency Revolution Underway with ACA and CAA

Internet-Based Tool: Personalized & Real-Time Out-of-Pocket Cost Information

The New State of the Art for Shopping and Comparing Prices Before Receiving Care • Employees will be able to access actual out-of-pocket cost information prior to receiving service or purchasing item • Four main components of the internet-based tool:

Cost-Sharing Information: The deductible, coinsurance, and copay for any covered item or service
Accumulated Amounts: The participant's YTD amounts incurred toward the deductible and out-of-pocket maximum
In-Network Rate: The plan's negotiated rate (reflected as dollar amount) for an in-network provider for the covered item or service
Out-of-Network Allowed Amount: How much the plan will pay for an out-of-network item or service (dollar or percentage)

Staggered Availability: Final Phase of Tool Available in 2024

First Plan Year Beginning On or After January 1, 2023 • For the first plan year these rules are in effect, the plan was required to disclose an initial list of 500 shoppable services • CMS summary: 500 Items and Services List for Price Comparison Tool

First Plan Year Beginning On or After January 1, 2024 • The remaining prices for covered items and services must be disclosed via the internet-based tool

Employers Will Rely On Insurance Carrier or TPA • Rules provide that employer can enter into a written agreement for carrier/TPA to maintain this internet-based tool • Potential $100/day penalties apply for non-compliance • Full details: The TiC Participant-Level Disclosures

03 HIPAA Privacy Additional Obligations for Self-Insured Plans 31

HIPAA Privacy 101: Key Terms

Covered Entity • Health Plan • Employer-sponsored group health plans • Health insurance carriers (including HMOs) • Medicare, Medicaid, VA, IHS, TRICARE, etc.

• Health Care Clearinghouse • Health Care Provider (who transmits health information electronically) • Doctors, nurses, hospitals, clinics, psychologists, dentists, chiropractors, nursing homes, pharmacies, etc.

Business Associate • An entity that performs a listed function or activity on behalf of a covered entity; and • Creates, receives, maintains, or transmits PHI on behalf of the covered entity • Examples: Claims processing, data analysis, utilization review, billing, legal, actuarial, accounting, consulting, data aggregation

Protected Health Information (PHI) • Individually identifiable health information maintained or transmitted by a Covered Entity or Business Associate • Excludes enrollment/disenrollment information used by the employer for employment purposes (that does not include any substantial clinical information)

HIPAA Privacy Overview

Self-Insured Plans: Do Not Have Reduced Compliance Burden Available for Fully Insured Plans

• With fully insured plans, both the group health plan and the insurance carrier are HIPAA covered entities • Generally, employers sponsoring a fully insured plan do not need HIPAA policies and procedures documents, to provide employees with a notice of privacy practices, to engage in business associate agreements, or undergo HIPAA training • The insurance carrier is directly responsible for those requirements • Applies where employers receive only summary health information for limited purposes and enrollment/disenrollment information • Most employers offer a health FSA, which is a self-insured group health plan that technically is directly subject to these HIPAA requirements • From a practical perspective, it is common for employers not to take all of the HIPAA steps described above (other than entering into a BAA with the TPA for the health FSA) where the only self-insured group health plan is the health FSA—although no technical exemption exists • Employers with a self-insured medical plan clearly do not enjoy this exemption from documentation, disclosure, and training requirements

Working with Vendors (Business Associates)

When is a BAA Required for Self-Insured Plans?

• HIPAA business associates can include third-parties in many different areas that create, receive, maintain, or transmit Personal Health Information

• Examples include (but are not limited to): • Claims processing or administration, data analysis, legal, actuarial, accounting, consulting, data aggregation, administrative, financial services

• Employers cannot permit such third-party vendors (business associates) to access PHI under their self-insured plan without entering into a business associate agreement (BAA) on behalf of the health plan (the HIPAA covered entity) • Fully insured plans generally do not need HIPAA BAAs • Note that enrollment/disenrollment information maintained by the employer (that does not include any substantive clinical information) is not PHI

• BAA will impose certain required safeguards on the business associates related to HIPAA privacy and security compliance • Note that the HITECH Act also imposes direct HHS liability on business associates—regardless of the terms of the BAA

HIPAA Privacy and Security

Why Should Plan Sponsors Care? • Any employer that provides group health benefits is affected based on the level of exposure to PHI • Employers with self-insured plans effectively are directly subject to the rules • Even fully insured plans need to be sensitive to HIPAA • Company access to employee health plan records for employment reasons (including administration of benefit plans) is severely limited • Civil and criminal actions may be brought by HHS • If HHS fails to act, state attorney generals may bring civil suits • Civil monetary penalties (indexed) can be assessed by HHS, and were significantly increased by HITECH

Culpability Minimum Penalty per Violation Maximum Penalty Per Violation Annual Limit

No Knowledge $141 $71,162 $25,000*

Reasonable Cause $1,424 $71,162 $100,000*

Willful Neglect (Timely Corrected) $14,232 $71,162 $250,000*

Willful Neglect (Not Corrected) $71,162 $71,162 $1,500,000*

Based on 2019 HHS enforcement policy that sets penalty caps below current indexed levels.

When is Training Required?

HIPAA is the only required employee benefits training! But there are a number of restrictive qualifications that significantly limit which employees actually need the training.

Only Employers With Self-Insured Health Plan • Employers with fully insured plans are not required to train employees • Training not required because such employers receive only summary health information for limited purposes and enrollment/disenrollment information

Only Employees Within the HIPAA Firewall • Only those employees with a plan-related need to access PHI for plan administrative functions are within the HIPAA firewall • These are the only employees who have access to PHI—and therefore the only employees who need training in how to handle PHI • Generally required only for benefits and HR professionals • Finance, accounting, payroll, C-suite, etc. generally do not need training (because they access only enrollment/disenrollment information that is not PHI as employment records)

Only New Hires & Upon a Material Change in Policies and Procedures • Training required within a "reasonable period of time" after hire • After the initial training, re-training required only upon a material change in the plan's HIPAA privacy policies and procedures • Best practice: Retrain once every two years regardless of changes

The Part 2 Rule: Substance Use Disorder Protections Notice of Privacy Practices Update Required

What is the Part 2 Rule? • Protects the records of the identity, diagnosis, prognosis, or treatment of any patient in connection with any federal program or activity relating to substance use disorder (SUD) • Includes education, prevention, training, treatment, rehabilitation, or research • Designed to address concerns that discrimination and fear of prosecution might deter treatment for SUD

What’s New With Part 2? • The CARES Act required the Part 2 rules to be more aligned with the HIPAA rules • Final Part 2 rules issued February 8, 2024 completed that alignment • Was initially addressed in combination with new reproductive health PHI protections, but a court vacated the reproductive health components as inconsistent with statutory authority

The Action Item Notice of Privacy Practices (NPP) Update by 2/16/26 • Originally the new Part 2 rules were largely addressed with the reproductive health rules that required a new attestation and NPP updates • After the court decision, only the Part 2 SUD piece remains • Requires NPP update by February 16, 2026 to reflect new SUD rights (but no longer includes reproductive health)

HIPAA Self-Insured Checklist

Administrative

Appoint a HIPAA Privacy Official • Typically listed by title (rather than name) in HIPAA materials

Determine Which Employees Will Have Access to PHI • This defines the HIPAA firewall • Should be limited to employees with a plan administrative functions • Remember this generally does not include enrollment/disenrollment information • Key point: Employees who wear HR and HIPAA hats must be careful never to permit PHI to be used or disclosed for employment-related purposes

Implement Routine Training Schedule • Rule of thumb for employees within the HIPAA firewall at an employer: • Train within a reasonable period after hire and refresh training every two years • Only those within the HIPAA firewall need HIPAA training

Clean Desks, Locked Files, Secure Fax • Don't leave PHI visible, lock hard copies of PHI, don't use main fax line for PHI

Documentation

Establish HIPAA Policies and Procedures • Internal document governing use and disclosure of PHI

Distribute Notice of Privacy Practices (NPP) • Employee-facing document summarizing policies and procedures • Re-distribute within 60 days of a material change (new changes needed by February 2026) • Provide notice of availability of the NPP at least once every three years

Enter Into Business Associate Agreements (BAAs) • Required for most third-party plan service providers with access to PHI • Newfront generally needs a BAA as consultant for a self-insured major medical

Plan Document and SPD HIPAA Provisions • Ensure wrap plan document and wrap SPD in place with standard provisions governing employer responsibilities with respect to PHI

Don’t Forget: Complete Full HIPAA Training

Newfront HIPAA Training Webinar

Click here for an on-demand HIPAA training you can use!

NEWFRONT

Office Hours Webinar

HIPAA Training for Employers

October 9, 2025

Presented by: Brian Gilmore | Lead Benefits Counsel, VP

Don’t Forget: Document Training

Template Employee HIPAA Training Sign-in Sheet

Click here for a fillable pdf employee sign in sheet you can use!

NEWFRONT

Employee HIPAA Training Sign-in Sheet

Topic: HIPAA Privacy and Security Training Presenter: Brian Gilmore, Newfront Lead Benefits Counsel Date: Time:

Employee Name Employee Signature

1 2 3 4 5 6 7 8 9 10

04 ERISA Preemption of State Law and Fiduciary Duties 41

ERISA Federal Preemption Three Layers of Analysis

Express Preemption Clause • ERISA expressly preempts state laws that relate to employee benefit plans • Generally means that state laws and state court orders relating to employee benefit plans are not enforceable against the plans • Federal law (ERISA) preempts the enforcement of such state laws and court orders • Set forth in ERISA §514, U.S. Supreme Court has stated the purpose is “to provide a single uniform national scheme for the administration of ERISA plans without interference from laws of the several States”

The Savings Clause • Applies to fully insured plans • Provides that ERISA does not preempt any state insurance laws for a fully insured plan • An exception from the express preemption clause • Typically referred to as the “Savings Clause” because state insurance mandates are “saved” from ERISA preemption with respect to a fully insured plan • Practical result is that employer-sponsored plan options that are fully insured must satisfy the state insurance coverage mandates for the state where the policy is sitused

The Deemer Clause • Applies to self-insured plans • Self-insured plans are not subject to any state insurance mandates • ERISA confirms that self-insured plans cannot be treated as subject to state insurance law • Typically referred to as the “Deemer Clause” because self-insured plans cannot be “deemed” to be an insurance policy subject to state insurance mandates • Practical result is employer-sponsored plan options that are self-insured (including level-funded) are not subject to any state insurance coverage mandates

ERISA Federal Preemption

State Insurance Mandates Preempted by ERISA

• The ERISA express preemption clause generally renders any state insurance mandate unenforceable against the plan—and therefore it has no effect and is to be ignored • Employers may consider offering benefits mandated in certain states, but no requirement for self-insured plans • Result: Employers have complete flexibility in plan design for covered benefits (other than federal law requirements)

Exceptions

• Fully insured plans have to offer state insurance mandates for the state in which the policy is sitused • State criminal laws of general applicability apply to all plans, including self-insured plans • For example, state embezzlement laws and state slayer statutes that prohibit individuals from receiving a benefit caused by the death of a person if the beneficiary intentionally killed that person (e.g., life insurance proceeds) • Many questions outstanding about how this exception might apply in the abortion-related travel assistance area

Example

• Employer Empire State ERISA Services is based in New York and offers employees a self-insured group major medical plan • New York imposes a state insurance mandate requiring health plans to cover three cycles of IVF used in the treatment of infertility

Result

• The New York state insurance mandate does not apply to Empire State ERISA Services' group health plan • Employer can choose what (if any) infertility services to cover as a matter of plan design • Note: If plan were fully insured and sitused in New York, the IVF mandate would apply to all covered employees (regardless of state of residence)

ERISA Federal Preemption

State Court Orders Preempted by ERISA

• The ERISA express preemption clause generally renders any state court order attempting to require coverage not enforceable against the plan—and therefore cannot be followed because it has no effect • Unless an exception applies, state domestic relations and related court orders are preempted by ERISA • Result: Terms of the plan govern as written and cannot be modified by the terms of any such state court order

Exceptions

• ERISA has created exceptions to federal preemption that make specific state domestic relations orders enforceable against an ERISA plan—but no exception to give effect to an order requiring health plan coverage for a former spouse • Primary exceptions:

Qualified Medical Child Support Order (QMCSO): Requires employee to cover a child under the health plan
Qualified Domestic Relations Order (QDRO): Former spouse right to a portion of an employee’s retirement plan

Example Result • Maria and Arnold divorce with court order stating Maria must continue to cover Arnold under her employer’s group health plan • Maria’s group health plan is subject to ERISA • The health plan is not a fully insured plan sitused in Massachusetts • The order relating to Arnold’s health coverage is preempted by ERISA and therefore has no effect • Plan cannot offer active coverage to former spouse • Exception: Massachusetts state insurance law for fully insured plans recognizes the order to preserve former spouse’s eligibility until the former spouse remarries

ERISA Fiduciary Duties Derived from trust law–described by courts as “the highest duties known to the law.”

1 Duty of Loyalty (Exclusive Benefit Rule) 2 Duty of Prudence 3 Duty of Diversification 4 Duty to Follow Plan Terms

The Named Fiduciary for Appeals

ERISA Fiduciary Duties The Core Four Fiduciary Duties

Duty to Follow Plan Terms • Must administer the plan in accordance with its written terms in documents governing the plan • Commonly arises in the context of employee requests to make an exception to the plan terms to provide additional benefits not covered under the written terms of the plan • Plan will typically have a discretionary clause granting employer fiduciary right to interpret plan terms for purposes of eligibility for benefits • If the employer makes an “exception,” the employer has interpreted the plan terms to permit the coverage, and must apply this interpretation consistently for all similarly situated employees • Effectively means that “exceptions” create an ERISA plan precedent, and a potential claim for breach of fiduciary duty (or claim for benefits) for any employees denied in similar circumstances

ERISA §404(a)(1)(D): (1) Subject to sections 403(c) and (d), 4042, and 4044, a fiduciary shall discharge his duties with respect to a plan solely in the interest of the participants and beneficiaries and— ... (D) in accordance with the documents and instruments governing the plan insofar as such documents and instruments are consistent with the provisions of this title and title IV.

ERISA Fiduciary Duties The Named Fiduciary for Appeals

Employers Need to Ensure Major Medical Plan TPA Designated Appeals Fiduciary • ERISA requires that appeals be determined by a named fiduciary of the plan • For fully insured plan, this is by default the insurance carrier • For self-insured plans, the TPA has to acknowledge their status in writing as the named appeals fiduciary • This is a critical point for employers to confirm for the major medical plan • With very few exceptions, employers should not assume the appeals fiduciary status for a major medical plan • Nearly all employers are not in a position to make medical necessity determinations (which require an experienced medical professional's judgment), work within the strict confines of the ERISA appeals procedures, address urgent care claims in as short a timeframe as 24 hours where required, etc.

29 CFR §2560.503-1(h)(1):

(h) Appeal of adverse benefit determinations. (1) In general. Every employee benefit plan shall establish and maintain a procedure by which a claimant shall have a reasonable opportunity to appeal an adverse benefit determination to an appropriate named fiduciary of the plan, and under which there will be a full and fair review of the claim and the adverse benefit determination.

ERISA Fiduciary Duties The Named Fiduciary for Appeals

Employers Need to Ensure Major Medical Plan TPA Designated Appeals Fiduciary • Employers sponsoring a self-insured medical plan have greater flexibility with many aspects of the plan • However, it’s a misconception that the employer can override the TPA’s appeal denial to approve the claim • Where TPA is the named fiduciary for appeals, any attempt to override the TPA’s appeal determinations would violate the requirement that appeals be determined by a named fiduciary • This violation could result in the loss of the deferential standard of review in federal court in litigation • Known as the “Firestone standard,” which provides that the participant can prevail on the claim only if the plan abused its discretion by acting in an arbitrary and capricious manner in making the determination • Failure to have appeals determined by TPA could cause the “de novo” standard of review to apply, and make it much more likely the plaintiff participant would prevail against the plan.

Template Language for TPA Agreement: Notwithstanding any provisions in this Agreement to the contrary, TPA agrees to act as the Plan’s named appeals fiduciary pursuant to 29 CFR §2560.503-1(h)(1) with full and final discretionary authority to determine claims and appeals for benefits under ERISA. Plan Sponsor delegates only this appeals fiduciary status to TPA. All other ERISA fiduciary duties remain with the Plan Sponsor (or its delegate other than TPA).

ERISA Fiduciary Duties The Named Fiduciary for Appeals

Employers Need to Ensure Major Medical Plan TPA Designated Appeals Fiduciary Employers have two options where they disagree with the TPA’s (name appeals fiduciary’s) determination:

Amend the plan for all participants to change the plan terms and specifically cover or exclude the item or service at issue
Alternatively, employers have the discretionary authority to interpret plan terms on a consistent basis for all participants • Employers can therefore direct the TPA in writing to interpret plan provision at issue in a manner consistent with the employer’s understanding of those plan terms • TPA will generally accommodate such direction unless it clearly is contrary to the plan terms

New DOL Guidance on Cybersecurity Full Details: Compliance Assistance Release No. 2024-01

The DOL put out cybersecurity guidance in 2021 that was widely regarded as directed toward retirement plans. In 2024, the DOL clarified that employers have the same fiduciary responsibility to include cybersecurity matters as part of the process to prudently select and monitor vendors for non-retirement plan benefits. • The guidance provides a useful set of materials that employers can use to satisfy the fiduciary standards for cybersecurity.

Tips for Hiring a Service Provider: • A number of tips for employers of all sizes and for all types of ERISA plans for what to ask and evaluate with respect to any service provider’s cybersecurity practices. Also includes suggested contractual terms: • Information Security Reporting • Clear Provisions on the Use and Sharing of Information and Confidentiality • Notification of Cybersecurity Breaches • Compliance with Records Retention and Destruction, Privacy and Information Security Laws • Insurance

Cybersecurity Best Practices: • 12 best practice approaches for plan service providers to ensure proper mitigation of cybersecurity risks. Includes the following key themes: • Identify the risks to assets, information and systems • Protect each of the necessary assets, data and systems • Detect and respond to cybersecurity events • Recover from the event • Disclose the event as appropriate • Restore normal operations and services

Online Security Tips: Tips for employees to reduce the risk of fraud and loss online: • Register, set up and routinely monitor your online account • Use strong and unique passwords/passphrases • Use Multi-Factor Authentication • Keep personal contact information current • Close or delete unused accounts • Be wary of free wi-fi • Beware of phishing attacks • Use antivirus software and keep apps and software current

The J&J Prescription Drug Case Makes Waves Full Details: The J&J Case Practical Considerations (ERISA Fiduciary Duties); (ERISA Trust Rules)

ERISA Fundamentals Revisited

The Allegation: Excessive Prescription Drug Costs • The class plaintiff in Lewandowski v. Johnson & Johnson, et. al. principally allege that the company breached its fiduciary duty by mismanaging the health plan’s Rx benefits • Argument is that cost employees millions in the forms of higher Rx payments, higher premiums, higher cost-sharing, and lower wages or limited wage growth • Class plaintiff alleges that J&J breached its fiduciary duty of prudence by failing to engage in a prudent and reasoned decision-making process to lower the cost of drugs

Key Points to Keep in Mind • The J&J plaintiff did not prevail, and it is unclear whether these novel breach of fiduciary duty theories can be successful—so try to avoid knee-jerk overreactions • The J&J plan is very large and funded by a trust, which allows the plaintiff to establish a clear connection between the employer’s fiduciary duties and the trust funds held as plan assets • This area of law remains unsettled with the J&J (and similar Wells Fargo/JPMorgan) litigation, so employers should be cautious considering any radical changes to plan governance • Best practice: Return to the basics of proven ERISA compliance methods/strategies while monitoring developments for any outcomes that may drive new best practices going forward

Fiduciary Committee Considerations • J&J’s plan had a fiduciary benefits committee but was still the target of this case • The individuals serving on the committee were a clear target as defendants, with the CHRO and VPs of HR personally named • H&W Plan committees are rare because of the time/cost • Trump Administration may seek reduced plan burdens • For more details: The Pros and Cons of a Health and Welfare Plan Fiduciary Committee

What to Make of the Court’s J&J Decisions? Full Details: Newfront ERISA Fiduciary Library

Court (Twice) Grants J&J Motion to Dismiss on Procedural Grounds

Lewandoski v. Johnson & Johnson et. al., D.N.J., No 3:24-cv-00671:

Plaintiff’s injury is not redressable because, as Defendants raise in their factual challenge to her standing, she has reached her prescription drug cap for each year she asserts in the Amended Complaint. In straightforward terms, a favorable decision would not be able to compensate Plaintiff for the money she already paid. Even if Defendants were to reimburse Plaintiff for her out-of-pocket costs cap a given drug—that is, the higher amount of money she spent as a result of Defendants’ breaches—that money would be owed to her insurance carrier to reimburse it for its expenditures on other drugs that same year. In short, there is nothing the Court can do to redress Plaintiff’s alleged injury.?

The Court expresses no opinion as to the standing of a hypothetical plaintiff in the same situation who has not reached its annual out-of-pocket cap for expenditures.

Implications?

• An initial win for employers, shows difficulty for employees to bring this type of claim • Key quote: “Put simply, it is too speculative that the allegedly excessive fees the Plan paid to its PBM ‘had any effect at all’ on Plaintiffs’ contribution rates and out-of-pocket costs for prescriptions.” • Wells Fargo case came to similar conclusion, will any of these be able to address the merits? Not clear at this point • Continue to monitor whether any of these can get standing and survive motion to dismiss

Plaintiff Lacked Standing:

• Found that any higher prescription drug costs than appropriate still would not have caused plaintiff to pay more in cost-sharing (because already reached the plan’s OOPM) • Also found it speculative whether the higher prescription drug costs might have caused plaintiff to pay higher premium

Only Document Request Piece Remains:

• The court granted the motion to dismiss on the core complaints • Second court decision again affirmed that J&J motion to dismiss • However, it denied the (much smaller) motion with respect to failure to timely provide requested ERISA documents

05 PCORI Fees Self-Insured Medical Plans and HRAs 53

PCORI Fee for Self-Insured Plans

Congress Extended the PCORI Fee for Another Decade (to 2029)

• 2019 was to be the final year the Patient Centered Outcomes Research Institute (PCORI) fees were required • Major industry groups (AHIP, BCBSA, ERIC, NRF, US Chamber) pushed for 10-year extension to 2029 • That legislation was ultimately incorporated into the same massive “Further Consolidated Appropriations Act, 2020” • Employers with self-insured medical plans (including level funded plans) need to file and pay for the PCORI fee! • Only employers with a self-insured major medical plan (including level funded plans) and/or HRA (special HRA rules apply) must file for and pay the PCORI fee (the insurance carrier files/pays for fully insured plans)

PCORI Fees July 31, 2025 Form 720 PCORI Filing July 31, 2026 Form 720 PCORI Filing

Plan Year Ends January 1–September 30 Applicable Rate: • $3.22 per covered individual Applicable Rate: • $3.47 per covered individual

Plan Year Ends October 1–December 31 (Including Calendar Plan Years) Applicable Rate: • $3.47 per covered individual Applicable Rate: • $3.84 per covered individual

PCORI Fees: Plans Subject to PCORI

PCORI Fee Applies to Major Medical Plans and HRAs

• Major Medical Plans PCORI fee does not apply to dental and vision coverage or health FSAs that qualify as excepted benefits (virtually all dental/vision/health FSAs qualify) • EAPs and wellness programs also not subject to PCORI as long as the plans do not “provide significant benefits in the nature of medical care or treatment” • Where medical plan is fully insured (and employer does not sponsor an HRA), the insurance carrier pays the PCORI fee—no action item for the employer! • Where medical plan is self-insured (including level-funded) or employer offers an HRA, employer must pay the PCORI fee via Form 720 by July 31 annually

• Health Reimbursement Arrangements (HRAs) • HRAs are a self-insured health plan subject to the PCORI fee • Includes HRAs designed to cover cost-sharing under the major medical plan • Includes specialty HRAs such as those designed to cover infertility, abortion-related travel assistance, gender dysphoria, mental health, etc. • Two Special HRA PCORI Rules:

Self-Insured Medical: If employer’s medical plan is self-insured and has the same plan year as the HRA, PCORI fee not required for HRA (only medical)
Fully Insured Medical: Employer must pay PCORI fee for HRA, but only required to pay for covered employees (not for covered dependents)

Who Pays the PCORI Fee?

Fully Insured Medical Plan: • Health insurance carrier pays • Fee is built into premium cost

Self-Insured Medical Plan: • Employer pays via Form 720 • Includes level-funded plans

Fully Insured Medical Plan with an HRA: • Carrier pays for medical plan • Employer pays for HRA

Self-Insured Medical Plan with an HRA: • Employer generally pays only for medical plan (not HRA)

PCORI Fees: Plans Subject to PCORI

Completing the Form 720

• Page 1 • The employer will complete their name and address and employer identification number at the top of the form. • Quarter ending will be June and the current year in which they are filing. • Final return will be checked if the employer is going out of business, or no longer has a self-insured medical plan or HRA. • Address change will be checked if the employer has changed their address since the last filing.

• Page 2 • Part II, line 133 – Applicable self-insured health plans and choose the plan year ending. Line (c) is for plan years ending before October 1 (non-calendar year plans) and line (d) is for plan years ending on or after October 1 (generally calendar year plans) • Enter the number of lives on either line (c) or (d) using one of the methods outlined in the IRS PCORI fee homepage. You may enter the number of lives on both lines if you are filing for a full 12-month plan year and a short plan year. • Multiply the number of lives in lines (c) or (d) by the rate in column b and enter the result in column (c) Fee • Bring the total of lines (c) and (d) in the Fee column over to the tax column • Bring the same total down to Line 2 Total

• Page 3 • Line 3: bring the same total from Line 2 forward to this line • Line 10: bring the amount from line 3 down to line 10 • Sign and date the form and return with payment.

Additional Notes • PCORI fee is always paid on the second quarter Form 720, regardless of plan year • Penalties for failure to timely file Form 720 can range from 5% to 25% of amount due • Penalties for failure to timely pay PCORI fee can range from 0.5% to 25% of amount due • Any person authorized by the company can sign the form • Payment can be made by check or electronically via IRS EFTPS • Form 720 is quarterly, but PCORI fee is only filed in Q2!

06 Section 105(h) Nondiscrimination Rules for Self-Insured Plans 57

§105(h) Nondiscrimination Rules for Self-Insured Health Plans Self-insured group health plans are subject to the §105(h) nondiscrimination rules — There are three main components to the rules:

Eligibility Test • Can exclude or provide different eligibility terms for categories of employees only if the classification is “reasonable and nondiscriminatory” • Definition of “reasonable and nondiscriminatory” specifically refers to distinctions based on the nature of compensation, such as hourly vs. salaried, and geographic location • Generally fine for employers to provide different health plan eligibility terms to employees based on hourly vs. salaried or employee groups in different regions

Benefits Test • Requires that all benefits provided to eligible Highly Compensated Individuals (HCIs) under the plan also be available to all eligible non-HCIs • Creating different classes of benefits for eligible employees can be a problem because it may result in non-HCIs in the lower tier class not receiving the richer benefits available to HCIs in the higher class • §105(h) rules do allow employers to disaggregate into separate plans for testing purposes by specifying in the health plan document that the different arrangements are treated as separate plans

Operational Discrimination • Umbrella provision preventing self-insured group health plans from discriminating against non-HCIs in operation—a facts and circumstances test based on each plan’s specific arrangement • Unlikely to become an issue in health plan design because plan is not considered discriminatory merely because HCIs participating in the plan utilize benefits to a greater extent than non-HCIs • Main practice to avoid is employer selectively establishing, amending, or terminating the self-insured plan in a manner designed to benefit HCIs (e.g., to specifically cover only certain HCIs expenses)

HCI Definition • The §105(h) rules define highly compensated individuals (HCIs) differently than the §125 highly compensated participant (HCP) and §129 highly compensated employee (HCE) definitions • For purposes of §105(h), an HCI is: • One of the top five highest-paid officers; • A shareholder who owns more than 10% of the value of the employer's stock; or • Among the highest-paid top 25% of all employees in the current plan year

Separate Plans Provision • Template health plan document provision to disaggregate the plan for §105(h) purposes: • Pursuant to the "Multiple plans" provisions set forth in Treas. Reg. §1.105-11(c)(4), each coverage level, each group of Employees covered by the Plan, and each class of benefits provided under the Plan constitute a separate "plan" for purposes of the Internal Revenue Code §105(h) nondiscrimination requirements and any other applicable law.

Failing the §105(h) Rules • If the IRS were to audit a health plan and find its arrangement to be discriminatory under §105(h): • All HCIs would be taxed on all or a portion of the benefits they received under the plan, referred to as the "excess reimbursement" • This could be a significant tax liability depending on the amount and cost of services received by the HCIs

Fully Insured NDT Rules Delayed Until……?

ACA Added Fully Insured Nondiscrimination Rules

• The ACA provides that insured group health plans will be subject to rules “similar to” the nondiscrimination requirements that have long applied to self-insured plans under Internal Revenue Code §105(h) • These rules technically were scheduled to apply at the same time as the first wave of market reforms (first plan year on or after September 23, 2010) • However, the IRS issued Notice 2011-1 at the end of 2010 confirming that employers are not required to comply until the Departments issue regulations or other administrative guidance to implement the rules

Will IRS Finally Implement/Enforce?

• The Notice states that any such guidance will not apply until plan years beginning a specified period after issuance • For example, they may not apply until the first plan year beginning on or after six months following the regulatory issue date • Will Treasury/IRS now finally take up these rules? They seem to have largely slipped off the radar • If they do implement the rules, we should still have plenty of time before they take effect to revise any problematic plan structures

07 COBRA Subsidy Strategies and No State Mini-COBRA 61

COBRA Subsidies: Fully Insured vs. Self-Insured COBRA subsidies to cover all or a portion of the premium for a set period are very common as part of severance benefits and for extended non-protected leaves. There are some key considerations to keep in mind depending on the plan’s funding arrangement.

Fully Insured Plan COBRA Subsidies Permitted (Extended Period Caution)

Self-Insured Plan §105(h) Nondiscrimination Taxable Compensation Alternative

Tax-free direct COBRA subsidies are common because no nondiscrimination rules apply to fully insured plans • The ACA added fully insured plan nondiscrimination rules originally to take effect in 2011 • IRS Notice 2011-1 indefinitely delayed until further notice from IRS/DOL/HHS • Employer should consider stating in any materials communicating an extended subsidy (e.g., six months or longer) that it may convert the subsidy to taxable compensation if the nondiscrimination rules take effect during the subsidy term

§105(h) generally prohibits COBRA subsidies of greater amount or duration to HCIs than available to non-HCIs • Violation of §105(h) could result in all HCIs being taxed on all or a portion of the benefits received (referred to as the “excess reimbursement”) • Taxable cash compensation avoids creating issues under the §105(h) rules (which apply only to self-insured plans) • Can be based on the amount the COBRA subsidy would have been • Employer may choose to gross up the payments to make employees whole

Template Provision for Self-Insured “Subsidy”

Sample Language—Recommended provision to describe taxable income alternative to direct COBRA subsidies

The Company will pay you an additional amount of [Enter amount—can be in regular intervals or lump sum] in standard taxable compensation, subject to withholding and all applicable payroll taxes, intended to cover the cost of your [Optional: “major medical plan” to exclude all other coverage] COBRA premium for [Enter duration]. This amount is based on [“your full” or [“X percentage” of your”] [Optional: “employee-only”] COBRA premium, including the 2% administrative fee.

[Optional: The Company will also pay you a “gross up” amount intended to cover the tax liability from this additional payment.]

State Mini-COBRA Laws Do Not Apply

Small employers are not subject to federal COBRA, and therefore only state mini-COBRA laws apply. State mini-COBRA laws apply only to fully insured policies sitused in that state. These laws provide enhanced continuation of coverage rights. Note: State mini-COBRA laws do not apply to self-insured plans.

Small Employers (2-19 EEs) State Mini-COBRA Only (Inapplicable if Self-Insured)

Large Employers (20+ EEs) Mini-COBRA Extension (Inapplicable if Self-Insured)

Small Employer Defined • Fewer than 20 full-time employees (including full-time equivalents) on at least 50% of its typical business days in the prior calendar year • Small employer plans are not subject to federal COBRA

Example: Cal-COBRA for Small Employers • Applies only to fully insured health plans sitused in CA • Applies to medical, dental, and vision • Maximum coverage period is 36 months • Premium amount is 110% (not 102%) • Administered by the insurance carrier (not employer or employer's COBRA TPA)

Example—Cal-COBRA 18-Month Extension Applies to: • Large employers subject to federal COBRA • Only for fully insured medical plans sitused in California • Does not apply to self-insured plans

How the State Mini-COBRA Extension Works in CA (Cal-COBRA) • Qualified beneficiary first exhausts the 18 months of federal COBRA • Can extend continuation coverage for the major medical plan for another 18 months through Cal-COBRA (36 months total) • Extension does not apply for self-insured plans, dental/vision plans, or 36-month federal COBRA events

08 Domestic Partners Coverage Options 65

Domestic Partner Considerations for Self-Insured Plans

Fully Insured Plans May Be Required to Cover Registered Domestic Partners

• For example, California requires insurance carriers to provide coverage for RDPs on the same basis as spouses • This means that for any fully insured plan option, RDPs must have access to the same benefits as spouses • This requirement does not apply to self-insured plan options because state insurance laws are preempted by ERISA

Self-Insured Plans Should Consider Honoring Same Approach for RDPs

• Although not required, employers generally will include RDPs as eligible dependents and on equal terms as spouses

Some Employers Prefer to Offer Broader DP Coverage

• Registered Domestic Partner coverage is restrictive because of the community property rights and previous age limitations for opposite-sex couples • It may be difficult to recruit and retain employees if the employer does not offer a broader scope of domestic partner coverage based on its own DP policy • The stop-loss provider will almost always defer entirely to the company’s definition of domestic partnership • Self-insured plans may consider offering company-defined domestic partner coverage (not required)

Employer May Offer “COBRA-Like” Coverage for Domestic Partners

• Treats domestic partners as a qualified beneficiary in the same manner as a spouse with independent election rights • Confirm with stop-loss provider if permitted before offering

09 Leaves Common Non-Protected Leave Policy Approaches 67

Non-Protected Leaves – The Big Picture

What Are Non-Protected Leaves?

• Any leave not protected by FMLA, CFRA, PDL (or other state equivalents) • Many reasons employers may make non-protected leaves available: • Employer is not subject to FMLA/CFRA (or other state equivalents) • Employee is not eligible for FMLA/CFRA (or other state equivalents) • Leaves that extend beyond protected leave period (e.g., longer new child leaves) • Sabbatical leaves as a way to reward/retain long-term employees • In many cases, employers will be very accommodating in these situations (i.e., provide some form of company leave, not terminate EE for job abandonment)

Plan Eligibility Generally Limited to Full-Time Employees

• Default approach is coverage will terminate for employees not working full-time • Non-Protected Leave from Outset: Coverage will generally terminate as of the start of leave (or end of the month in which the leave begins) • Transition from Protected to Non-Protected Leave: Coverage will generally terminate as of the end of protected leave status (or end of that month) • COBRA qualifying event occurs in either case: • Loss of coverage caused by reduction in hours or failure to return from FMLA leave

Employer Non-Protected Leave Policy

Employers frequently have a leave policy to permit continuation of active health coverage during non-protected leaves. Within limits, carriers (and stop-loss providers) will generally permit this policy.

Typical Employer Leave Policy Continuing Active Coverage

Important Consideration Stop-Loss Provider Approval

Common approach will continue active coverage until the later of:

The end of the protected leave period (if any); or
Six months following the start of the leave • Note: Protected leave period in CA can extend up to seven months for extended pregnancy disability leaves followed by CFRA baby bonding • COBRA rights at end of this period

• Stop-loss providers for self-insured plans typically permit the employer to offer active coverage during a non-protected leave period pursuant to the employer’s leave policy • Must be very careful not to extend active coverage beyond the period the stop-loss provider will permit • That could result in the need for employer to self-fund claims with no stop-loss coverage • Most stop-loss providers permit employer policies that extend coverage up to six months

10 Review Checklist for Self-Insured Plans 70

Checklist: Compliance Considerations for Self-Insured Plans

ACA Reporting • §6055 (all self-insured employers) and §6056 (ALEs) reporting requirements apply • Means ALEs must complete coverage information in Part III (in addition to Parts I and II) of the Forms 1095-C (self-insured non-ALEs complete Form 1095-B) • Also need to provide Forms 1095-C to states for state-based individual mandate reporting where applicable (Forms 1095-B for self-insured non-ALEs)

CAA Transparency • Patient protection against surprise billing notice and machine-readable files links required to be posted if employer has public website for the self-insured plan • Ensure TPA is handling (or handle internally) Rx reporting, MHPAEA comparative analysis disclosure, gag clause attestation, and internet-based cost tool

HIPAA Privacy/Security • Self-insured employers have to address documentation, disclosure, and training requirements • Enter into BAAs with vendors (e.g., Newfront), create a HIPAA firewall, use/disclose the minimum necessary, and remember enrollment information is not PHI • See HIPAA checklist and link to full training/documentation materials in HIPAA section of this deck

ERISA • Self-insured plans enjoy ERISA preemption from state insurance mandates—huge benefit of self-insuring! • Ensure major medical plan TPA has accepted delegation appeals fiduciary status in writing

Checklist: Compliance Considerations for Self-Insured Plans

PCORI Fee • Must pay this fee each year via Q2 Form 720 by July 31 for self-insured major medical and/or HRA

§105(h) Nondiscrimination • Eligibility classes must be reasonable and nondiscriminatory (e.g., hourly vs. salaried or geographic location) • All benefits provided to eligible HCls under the plan must also be available to all eligible non-HCls

COBRA • Use taxable cash as an alternative to standard COBRA subsidies to avoid §105(h) nondiscrimination issues • State mini-COBRA laws (e.g., Cal-COBRA) do not apply to self-insured plans because of ERISA preemption

Domestic Partners • State registered domestic partner coverage requirements do not apply because of ERISA preemption • Employers should consider a domestic partner policy to cover RDPs and company-defined domestic partners • Consider including “COBRA-like” coverage to provide DPs with independent election rights to mirror spousal rights

Leaves of Absence • Confirm with stop-loss provider any policy to extend active coverage where not required by protected leave laws

Content Disclaimer

Compliance Considerations for Self-Insured Plans

The intent of this analysis is to provide the recipient with general information regarding the status of, and/or potential concerns related to, the recipient’s current employee benefits issues. This analysis does not necessarily fully address the recipient’s specific issue, and it should not be construed as, nor is it intended to provide, legal advice. Furthermore, this message does not establish an attorney-client relationship. Questions regarding specific issues should be addressed to the person(s) who provide legal advice to the recipient regarding employee benefits issues (e.g., the recipient’s general counsel or an attorney hired by the recipient who specializes in employee benefits law).

Newfront makes no warranty, express or implied, that adherence to, or compliance with any recommendations, best practices, checklists, or guidelines will result in a particular outcome. The presenters do not warrant that the information in this document constitutes a complete list of each and every item or procedure related to the topics or issues referenced herein. Federal, state or local laws, regulations, standards or codes may change from time to time and the reader should always refer to the most current requirements and consult with their legal and HR advisors for review of any proposed policies or programs.

Thank you

Brian Gilmore Lead Benefits Counsel, VP brian.gilmore@newfront.com

License #01h5918 Newfront Disclaimer: The information provided is of a general nature and an educational resource. It is not intended to provide advice or address the situation of any particular individual or entity.

Any recipient shall be responsible for the use to which it puts this document. Newfront shall have no liability for the information provided. While care has been taken to produce this document, Newfront does not warrant, represent or guarantee the completeness, accuracy, efficiency or fitness with respect to the information contained in this document. The information provided does not reflect new circumstances or additional regulatory and legal changes. The issues addressed may have legal or financial implications, and we recommend you speak to your legal and financial advisors before acting on any of the information provided.