In general, when maintaining group health plan records, an employer must consider ERISA, HIPAA and ACA guidelines.
ERISA
The recommendation is to maintain ERISA related documents for eight years. Based upon DOL rulings and statute, records required to be maintained under ERISA include vouchers, worksheets, receipts, and applicable resolutions, claims records, plan documents, summary plan descriptions, copies of filed Form 5500s and Schedules, accountants' reports, enrollment materials, requests for reimbursement for health FSA plans, lists of covered employees, and records of payroll deductions. The ERISA retention period for group health plans is six years and is measured from the date of filing a Form 5500. Because Form 5500 is often filed many months after the end of the plan year, the six year retention period is actually closer to seven years when measured from the end of a plan year. When adding in the possibility of a filing extension, many group health plans use eight years as a rule of thumb for ERISA document retention.
Many items may be able to be kept electronically rather than in paper form. According to DOL regulations, records may be maintained electronically if the electronic recordkeeping system meets certain requirements:
- The system must have reasonable controls to ensure the integrity, accuracy, authenticity and reliability of the records — and should not allow the modification of documents.
- The system must maintain the records in a reasonable order. (It should have some type of filing system so the records could be retrieved or inspected as necessary.)
- The system must maintain the records in a safe manner and should be backed up properly.
- The system needs to be able to print a readily legible paper copy of the documents.
HIPAA
With regard to HIPAA, covered entities and business associates must retain documentation for the privacy rule for six years from the date the documentation is created or the date it was last in effect, whichever is later. The documentation under the privacy rule includes any action, activity or designation that the privacy rule requires to be documented. Group health plan brokers and employers of fully-insured plans are generally considered to be business associates.
If the documents include protected health information (PHI), HIPAA requires that the information be safeguarded. Any PHI should be kept in files separate from the personnel or files with expanded staff access. Only those who need the information to perform the duties of their job should be granted access.
ACA
The PCOR fee is considered an excise tax under the Internal Revenue Code. As such, the Form 720 instructions indicates that tax returns, records, and supporting documentation must be maintained for at least four years from the date the tax became due, the date the claim was filed, or the date the tax was paid, whichever was later. However, with respect to the documents and records substantiating the enrollment count that was reported, those records must be maintained for at least 10 years. The IRS generally accepts electronic records. However, they retain the right to examine any books, papers or records which may be relevant to a filing.
With regard to the employer mandate, this isn’t specifically addressed in the regulations or instructions, but it appears that the same IRS rule that applies to the PCOR filing may also apply here. In other words, records regarding enrollment and offers related to the medical plan must generally be kept for four years, and the IRS retains the right to examine books, papers or records relevant to the filing.
Storage and retention of SPDs, enrollment information, claims information and so on would likely fall under ERISA and HIPAA’s requirements to maintain claims records and PHI (and to properly safeguard if documents include PHI). Therefore, the most conservative time frame would be to retain group health plan records for at least eight years measured from the date of filing Form 5500. In other words, an employer would need to retain past documents for at least eight years based upon the date of filing Form 5500. Additionally, retention of PCOR fee filings and employer mandate forms and records likely falls under the IRS’s requirements to maintain records for at least four years, but records substantiating those filings should be kept for at least 10 years.