Summary. A group benefits program is a set of ERISA plans, each requiring a written document, a summary plan description, a fiduciary process, and a filing calendar — and most small and mid-sized employers have insurance certificates instead of plan documents, a broker instead of a fiduciary process, and no idea which obligations run to the plan rather than the carrier. This toolkit builds the program from the plan documents outward: the fiduciary structure and the fee analysis now required, the health plan overlay of COBRA, the ACA mandate and reporting, HIPAA, parity, and transparency, the retirement plan operational requirements, and the correction programs.

What this toolkit is for, and who should use it

Benefits compliance failures are documentary and uniform, which makes them cheap to prevent and expensive to discover. A COBRA election notice missing a required element goes to every terminated employee. A plan operating without a written document is out of compliance for every participant. A 401(k) with a definition-of-compensation error has been wrong for every deferral since the error began.

This toolkit is for a human resources leader, a CFO, and counsel advising a company with fewer than a thousand employees and no dedicated benefits staff.

Roadmap at a glance

  1. Identify the plans and what ERISA requires of each.
  2. Plan documents and summary plan descriptions.
  3. Fiduciary structure and process.
  4. Service providers and fees.
  5. Filings and participant disclosures.
  6. COBRA.
  7. The ACA employer mandate and reporting.
  8. HIPAA — portability, privacy, and security.
  9. Parity, transparency, and the No Surprises Act.
  10. Cafeteria plans and account-based arrangements.
  11. Retirement plan operation.
  12. Audits, corrections, and transactions.

Stage 1 — Identify the plans

  • ERISA covers employee welfare benefit plans — medical, dental, vision, prescription drug, health flexible spending arrangements, health reimbursement arrangements, life, disability, employee assistance programs providing medical care, and severance in many configurations — and employee pension benefit plans, including 401(k), profit sharing, defined benefit, and certain deferred compensation arrangements.
  • Not covered: payroll practices such as ordinary vacation and sick pay from general assets; voluntary employee-pay-all arrangements meeting the safe harbor; and governmental and church plans, which are exempt but subject to their own rules and to state law.
  • List every benefit offered and classify each. A surprising number of employers discover an unintended ERISA plan — a severance practice, a wellness program, or an EAP with medical components.
  • Determine, for each, whether it is insured or self-insured, because the obligations that fall on the employer rather than the carrier differ sharply.

Stage 2 — Plan documents and SPDs

  • Every ERISA plan requires a written plan document establishing the terms and identifying a named fiduciary and a funding policy.
  • A summary plan description must be furnished within 90 days of coverage beginning and every five years thereafter (ten if unchanged), in language calculated to be understood by the average participant, containing prescribed content.
  • A summary of material modifications within 210 days after the plan year of a change, or 60 days for a material reduction in group health benefits.
  • Insurance certificates and benefit booklets are not plan documents. The most common finding in a Department of Labor health plan audit is exactly that gap, and a wrap document solves it inexpensively.
  • Maintain claims and appeals procedures meeting the regulatory requirements, including timeframes and, for group health plans, external review.
  • Distribute and document distribution. An SPD prepared and never furnished satisfies nothing.

Resources

Stage 3 — Fiduciary structure and process

  • A fiduciary is anyone exercising discretionary authority over plan management or administration, or control over plan assets — a function, not a title.
  • Duties: loyalty solely in the interest of participants; prudence; diversification where applicable; and following plan documents insofar as consistent with ERISA.
  • Establish a plan committee with a written charter, defined membership, a meeting cadence, and delegated authority from the board.
  • Document the process: agendas, materials, minutes reflecting the questions asked and the alternatives considered, and the basis for each decision. Prudence is a process standard, and the minutes are the evidence.
  • Settlor versus fiduciary functions: designing, amending, and terminating a plan are business decisions; administering it is fiduciary. Expenses follow the classification.
  • Prohibited transactions under ERISA § 406 with parties in interest, subject to statutory and administrative exemptions.
  • Bonding under § 412 for persons handling plan funds, and fiduciary liability insurance, which is distinct from the bond and which the plan may or may not pay for depending on its terms.

Stage 4 — Service providers and fees

  • Section 408(b)(2) disclosure from covered service providers to retirement plans, and — added by the Consolidated Appropriations Act — a parallel compensation disclosure from brokers and consultants to group health plans where compensation is expected to reach a threshold.
  • The fiduciary must receive the disclosure, evaluate whether the arrangement is reasonable, and document the evaluation. Litigation over health plan fees, following the pattern established for retirement plans, has begun.
  • Benchmark fees periodically and run a request for proposal on a defined cycle.
  • Review the contracts: services, fees, indemnities, data ownership and portability, security obligations, breach notification, and termination and transition assistance.
  • Monitor the providers, which is a continuing fiduciary duty rather than a one-time selection.

Stage 5 — Filings and participant disclosures

  • Form 5500 for plans with 100 or more participants at the beginning of the plan year, due seven months after plan year end with a two-and-a-half-month extension, and a Summary Annual Report to participants. Small unfunded, fully insured welfare plans are generally exempt.
  • Independent qualified public accountant audit for large plans, subject to the exemptions.
  • Participant notices with their own timing: summary of benefits and coverage; the CHIP notice; the Women's Health and Cancer Rights Act notice; the Medicare Part D creditable coverage notice; the wellness program notices; and, for retirement plans, safe harbor notices, automatic enrollment notices, blackout notices, and benefit statements.
  • Build one calendar with every deadline, an owner, and a delivery record.

Stage 6 — COBRA

  • Applies to employers with 20 or more employees on more than half of typical business days in the prior year; state mini-COBRA covers smaller employers.
  • Qualifying events and periods: termination or reduction of hours, 18 months; death, divorce, Medicare entitlement, or loss of dependent status, 36 months; with an 11-month disability extension and a second qualifying event extension.
  • Four notices: the general notice within 90 days of coverage; the employer's notice to the administrator within 30 days; the election notice within 14 days of that notice (44 days where the employer is the administrator); and notices of unavailability and of early termination.
  • Election period 60 days; first payment 45 days; 30-day grace thereafter; premiums up to 102% (150% during the disability extension).
  • Each qualified beneficiary has an independent election right, which notices addressed only to the employee do not satisfy.
  • Proof of mailing by a method reasonably calculated to reach the beneficiary is the defense; actual receipt is not required.
  • Outsourcing does not transfer liability. The plan administrator remains responsible, and the defense depends on the employer's own records.

Resources

Stage 7 — The ACA employer mandate and reporting

  • Applicable large employer status determined annually: 50 or more full-time and full-time-equivalent employees in the prior calendar year, with controlled group aggregation.
  • Offer minimum essential coverage providing minimum value and that is affordable to at least 95% of full-time employees and their dependent children, or face an assessment under IRC § 4980H.
  • Affordability measured against an indexed percentage of household income, with the W-2, rate of pay, and federal poverty line safe harbors.
  • Measurement methods — monthly or look-back measurement with stability and administrative periods — chosen and applied consistently, and documented.
  • Reporting on Forms 1094-C and 1095-C, furnished to employees and filed with the IRS, with penalties for late or incorrect returns and a separate assessment process for mandate liability.
  • Respond to Letter 226-J promptly and completely; most proposed assessments are reduced or eliminated by a correct response about coverage offers actually made.

Stage 8 — HIPAA

  • Portability: special enrollment rights on loss of other coverage, marriage, birth, adoption, and Medicaid or CHIP events — generally within 30 days, and 60 days for the Medicaid and CHIP events. Nondiscrimination based on health factors, and wellness program rules distinguishing participatory from health-contingent programs with the required alternative standard.
  • Privacy and security apply to the plan, not merely the carrier or administrator: a notice of privacy practices, a designated privacy official, workforce training, minimum necessary standards, business associate agreements with every vendor touching protected health information, a security risk analysis, and administrative separation between the plan and the employer's HR functions.
  • Breach notification to individuals, to the Secretary, and in some cases to the media, on defined timelines.
  • Self-insured plans bear these obligations directly. Fully insured plans with only summary information have reduced obligations, but the exception is narrow and frequently assumed to be broader than it is.

Resources

Stage 9 — Parity, transparency, and surprise billing

  • Mental health parity requires parity in financial requirements and treatment limitations, and — added by the Consolidated Appropriations Act — a documented comparative analysis of every nonquantitative treatment limitation, available to regulators on request. Enforcement has been active and the submitted analyses have frequently been found inadequate.
  • Transparency in coverage: machine-readable files of in-network rates and out-of-network allowed amounts, and an internet-based price comparison tool.
  • The gag clause prohibition attestation, filed annually, certifying that the plan's contracts do not restrict access to cost and quality data.
  • The No Surprises Act: balance billing protections for emergency services and certain non-emergency services at in-network facilities, the independent dispute resolution process, continuity of care, and provider directory accuracy requirements.
  • These obligations fall on the plan. A self-insured employer cannot assume its third-party administrator handles them without a contractual commitment and verification.

Stage 10 — Cafeteria plans and account-based arrangements

  • A written § 125 plan document is required; a plan operating without one loses pre-tax treatment for everyone.
  • Elections are irrevocable absent a permitted change in status, and the permitted events must be in the document.
  • Nondiscrimination testing — eligibility, benefits, contributions, and the key employee concentration test — run annually and documented.
  • Health FSAs: the indexed contribution limit, the use-or-lose rule with either a grace period or a carryover but not both, and the COBRA interaction for a plan with a positive balance.
  • HRAs: integration requirements, and the individual coverage and excepted benefit variants with their own notice and substantiation rules.
  • HSAs: high-deductible health plan requirements, contribution limits, comparability or § 125 nondiscrimination rules depending on the funding route, and the prohibition on other disqualifying coverage.
  • Dependent care assistance under § 129 with its own limit and testing.

Stage 11 — Retirement plan operation

  • Follow the plan document. The most common failures are operational: an incorrect definition of compensation, a missed eligibility or entry date, a failure to implement a deferral election, an automatic enrollment not run, or a loan or hardship distribution outside the plan's terms.
  • Deposit deferrals timely — as soon as they can reasonably be segregated, with the small-plan safe harbor.
  • Run the annual tests: ADP and ACP unless a safe harbor design applies, top-heavy, coverage, and the § 415 limits.
  • Investment process: an investment policy statement, periodic review of performance and fees, documented decisions, and attention to ERISA § 404(c) and qualified default investment alternative requirements.
  • Notices and statements on their schedules, and beneficiary designations maintained.
  • Restate the document on the required cycle, and adopt required amendments on time.

Resources

Stage 12 — Audits, corrections, and transactions

  • Correction programs exist because these failures are common: the IRS Employee Plans Compliance Resolution System for qualification failures, with self-correction available for many operational errors and a voluntary correction submission for others; and the Department of Labor's Voluntary Fiduciary Correction Program and Delinquent Filer Voluntary Compliance Program.
  • Self-report the COBRA excise tax on Form 8928 where a failure occurred, because the failure to self-report is itself a diligence problem.
  • On a DOL or IRS examination: engage counsel, produce completely and on time, prepare witnesses, and disclose and correct rather than defending the indefensible.
  • In an acquisition: determine which plan carries COBRA obligations for M&A qualified beneficiaries — the seller's plan if it continues to maintain a group health plan, the buyer's if it does not and the buyer continues the business — and address it expressly in the purchase agreement. Also diligence controlled group status, ACA measurement history, plan document currency, testing results, and any uncorrected operational failure.
  • Run an internal audit annually: pull five terminated employees and trace the COBRA process end to end; confirm plan documents and SPDs exist and were distributed; confirm the fee evaluation was performed and documented; and confirm every filing was made.

Master resource index

Articles

Guides

Checklists

Related toolkits

External and primary sources

This toolkit is educational and not legal advice. Benefits requirements are detailed and regulatory, indexed figures change annually, and state continuation and insurance mandates vary. Consult qualified employee benefits counsel before adopting, amending, or terminating a plan.