Compliance Corner: Announcements

Individuals who were HSA-eligible in 2025 have until the tax filing deadline, April 15, 2026, to make or receive 2025 HSA contributions. The 2025 HSA contribution limit is $4,300 for self-only HDHP coverage and $8,550 for any tier of HDHP coverage other than self-only. Employer HSA contributions, if any, are included in the applicable limit. Those aged 55 and older are permitted an additional catch-up contribution of $1,000. As indicated below, April 15, 2026, is also the deadline for individuals to remove 2025 excess contributions (i.e., contributions exceeding their permitted maximum) from their HSA to avoid potential penalties.  

Under the HSA monthly contribution rule, an individual’s maximum 2025 annual contribution is limited by the number of months they were HSA-eligible during the calendar year. HSA eligibility is determined on the first day of each month. As a reminder, to be HSA-eligible, an individual must be covered by a qualified HDHP, not be eligible to be claimed as a tax dependent of another, and not be covered by Medicare or other impermissible coverage (i.e., coverage providing benefits before the statutory HDHP minimum deductible is met, absent a specific exception).  

There is an exception to the monthly contribution rule known as the full or last month contribution rule. Under the full contribution rule, an individual who was HSA-eligible on December 1, 2025, is permitted to contribute up to the full statutory limit for the year based on their HDHP coverage tier. However, if the individual does not remain HSA-eligible through December of the following year (i.e., December 2026), the amount exceeding their permitted maximum under the monthly contribution rule becomes taxable as income and subject to an additional 10% penalty tax.  

Individuals who contributed more than their allowable HSA contribution amount for 2025 should remove the excess contributions and associated earnings by April 15, 2026. The excess and earnings will be subject to income tax. If an individual fails to remove the excess contribution by the income tax filing deadline, an additional 6% penalty applies for each tax year the excess remains in the account. Accordingly, employees who were not eligible for a contribution or contributed more than their permitted maximum through their employer’s cafeteria plan should notify their employer and work with the HSA custodian to remove the excess contribution. Employees should consult with their tax advisors for specific tax advice and guidance.  

For further information, please review IRS Publication 969, and ask your broker or consultant for a copy of the NFP publication Health Savings Accounts: A Guide for Employers.

The CAA, 2021 requires fully insured and self-insured group health plans to annually report certain information regarding prescription drug and healthcare spending to CMS. Reporting for the 2025 calendar year (termed the “reference year”) is due by June 1, 2026.

As in prior years, the data must be submitted to the Health Insurance Oversight System (HIOS) in files and formats specified by CMS. Detailed information regarding the reporting requirements, including the RxDC reporting instructions, FAQs, and a HIOS portal user guide, is available on the CMS RxDC website.

Employers should work closely with their carriers, TPAs, PBMs, and other vendors, as applicable, to ensure the required information is provided in a timely and accurate manner. In some cases, an employer that sponsors a self-insured plan may need to submit data directly to HIOS. In other situations, the carrier, TPA, or other service provider may agree to submit information on behalf of the plan.

However, the employer will still need to provide certain data (e.g., the average monthly premium paid by employers and employees) and should respond promptly to their service providers’ requests for information. Failure to timely respond to a request may result in the employer being required to submit the RxDC data on their own. Employers should also request written confirmation from their carrier, TPA, or service provider of the timely RxDC reporting submission.

For further information on RxDC reporting, please ask your broker or consultant for a copy of the NFP publication Prescription Drug Data Collection Reporting: A Guide for Employers.

ACA reporting season has arrived, and employers that sponsor group health plans should be prepared to meet their reporting obligations under IRC Sections 6055 and 6066, as applicable. The reporting involves timely filing forms with the IRS and furnishing copies to individuals.

Background

There are two separate ACA reporting obligations under IRC Sections 6055 and 6066.

Employers that sponsored a self-insured plan, including a level-funded plan, during 2025 must comply with Section 6055 reporting in 2026. Self-insured employers with fewer than 50 full-time employees must complete Form 1095-B with such information. Self-insured applicable large employers (ALEs) must complete Section III of Form 1095-C detailing which months the employee (and any applicable spouse and dependents) had coverage under the employer's plan. ALEs are employers, as defined on a controlled group basis, with 50 or more full-time employees, including full-time equivalent employees, in the prior year.

Additionally, ALEs must comply with IRC Section 6056 reporting by completing and filing Form 1095-C for full-time employees. The form should include details regarding whether the employee was offered minimum value, affordable coverage during 2025.

The forms must be filed with the IRS by March 31, 2026.

Requirements for Furnishing Forms

As noted above, the forms must not only be filed with the IRS but also furnished to individuals. The forms can be delivered to individuals by mail, hand delivery, or electronic delivery (the latter if proper consent is provided in accordance with IRS instructions) by March 2, 2026. However, as explained below, an alternative method is available for furnishing the forms.

Under the alternative method, by March 2, 2026, the employer must post a clear and conspicuous notice on a website (accessible to individuals who may request a form) of the document's availability and the necessary contact information (email address, physical address, and phone number) to request it. Any such request must be fulfilled within 30 days or by January 31, if later. The notice must remain on the website through October 15 of the year following the calendar year.

Additionally, note that state individual mandates in CA, DC, MA, NJ, and RI generally require employers to distribute Form 1095-C/B to employees residing in those states by separate annual deadlines and thus cannot distribute forms only upon request.

Electronic IRS Filing Requirement

Finally, as a reminder, employers that file 10 or more returns of any type (i.e., counting Form 1094-B/1095-B, 1094-C/1095-C, W-2, and 1099 together) to the IRS in a calendar year must do so electronically, absent a hardship waiver. For those employers still able to file by paper, the filing deadline is February 28, 2026.

For further information on the reporting requirements, please refer to IRS Form 1095-B, IRS Form 1095-C, IRS Form 1095-B Instructions, IRS Form 1095-C Instructions, and ask your broker or consultant for a copy of the NFP publication ACA: Employer Mandate Reporting Requirements.

Fully insured and self-insured plans (including level-funded plans) of all sizes, including church and governmental plans, must annually disclose to CMS whether their plan’s prescription drug coverage is creditable. Generally, “creditable coverage” refers to prescription drug coverage that is expected to pay (based on the actuarial value) on average at least as much for such coverage as Medicare Part D coverage.

The disclosure must be made to CMS within 60 days of the start of the policy or contract year. Accordingly, for calendar year prescription drug policies, the Medicare Part D disclosure is due to CMS by March 1, 2026.

For additional information about the disclosure to CMS, please ask your broker or consultant for a copy of the NFP publication Medicare Part D Creditability Disclosures: A Guide for Employers. The publication includes links to the CMS website and instructions for accessing the disclosure form.

Recent changes to the HIPAA Privacy Rule require covered entities, including group health plans, to update their Notice of Privacy Practices (NPP) by February 16, 2026. Generally, the changes are designed to align HIPAA and a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 CFR Part 2 (referred to as Part 2). The Part 2 final regulations provide heightened confidentiality protections for sensitive SUD treatment information. We discussed these updates in our prior article on the substance use disorder records final rule.

Important Update: On February 13, 2026, HHS provided updated ⁠Model Notices of Privacy Practices, including a model for group health plans that references the treatment of Part 2-protected records. Employers that sponsor self-insured group help plans may want to consider using the model notice and should work with their legal counsel or HIPAA vendor to tailor their HIPAA NPP and policies and procedures to their specific circumstances.

As background, a Part 2 program is a federally assisted program that primarily serves to provide diagnosis, treatment, or referral for treatment of an SUD. Although group health plans are not Part 2 programs, plans and their vendors can receive Part 2-protected records through claims appeals, medical management and care coordination processes, and behavioral health programs, among other situations. The Part 2-protected information received may be subject to specific restrictions regarding its further use and disclosure.

Self-insured group health plans must maintain and distribute an NPP that explains how the plan may use and disclose protected health information (PHI), participant rights, and the plan’s responsibilities. (For fully insured plans, the NPP obligation is normally fulfilled by the carrier.) As part of aligning the Part 2 final rule with HIPAA, HHS changed the NPP requirements to ensure that participants and beneficiaries receive clear and accurate notice regarding how SUD information may be used, disclosed, and protected.

As a result, plans are required to revise their NPP, regardless of whether they normally receive Part 2-protected records. Among other items, the updated notice should explain that additional legal protections may apply to certain SUD records, the participant’s rights, and the plan’s legal duties.

Accordingly, employers should work with their legal counsel and vendors to determine where Part-2 protected information may be disclosed. Counsel can then assist with carefully tailoring the NPP to incorporate the protections for SUD information under the Part 2 final rule within the HIPAA framework. The updated NPP should be distributed to participants and new enrollees. Employers should also review their HIPAA policies and procedures and training materials to ensure these materials also appropriately address the handling of SUD information.

NFP will monitor for any new HHS guidance to assist employers with the NPP revisions and will provide updates in Compliance Corner.

The ACA requires large employers that sponsor fully insured or self-insured (including level-funded) group health plans to report information to the IRS annually, via Form W-2, the cost of health coverage provided to employees during the prior calendar year. The reporting is intended for informational purposes.

The coverage must be reported on a calendar-year basis, regardless of the ERISA plan year or policy year. Specifically, employers must file copies of their annual Forms W-2 with the Social Security Administration by January 31 and provide applicable copies to their employees by the same deadline.

Currently, this ACA requirement applies to employers that filed 250 or more Forms W-2 in the prior calendar year. Employer aggregation rules do not apply for this purpose. In other words, the number of Forms W-2 is calculated separately without consideration of controlled groups. Self-insured plans that are not subject to COBRA (including church plans), multi-employer plans, and Indian tribal governments are exempt from the Form W-2 reporting requirement.

For further information, please ask your broker or consultant for a copy of the NFP publication ACA: Form W-2 Cost of Coverage Reporting Requirement.

To close out the year, the Benefits Compliance team will recap benefits-related legislative, regulatory, and judicial highlights from 2025. They will also look forward to 2026 and any potential guidance that may be on the horizon.

Note: The speakers will answer as many questions as possible during the webinar. If your question isn’t answered, reach out to your advisor for further assistance.

Date/Time: December 17, 2025
3:00 - 4:00 p.m. ET

Register Now

This program is pending approval for 1.0 (general) recertification credit hours toward PHR, SPHR and GPHR recertification through the HR Certification Institute. For more information about certification or recertification, visit the HR Certification Institute website at hrci.org.

Note: Those listening to a recorded webinar will not be eligible for credit.

The deadline for 2025 CAA gag clause attestations is just around the corner. Employers should act now to ensure their group health plan contracts are compliant and that attestations are timely submitted.

To review, the CAA prohibits group health plans and insurers from directly or indirectly entering contracts offering access to provider networks that contain certain types of “gag clauses.” In the healthcare context, gag clauses are contract terms that restrict information, including provider network rates and deidentified claims data, that plans or insurers can make available to another party, such as a business associate. An example is a provision in a TPA contract that prohibits the plan’s access to network rates because the TPA considers the information to be proprietary.

The CAA also requires plans and insurers to annually attest to compliance with the gag clause prohibition via a CMS webform. The next attestation of compliance is due by December 31, 2025, attesting to compliance for contracts entered since the plan’s most recent prior attestation.

With a fully insured plan, an insurer can agree to submit the required attestation on behalf of the plan. A self-insured plan, including a level-funded plan, may satisfy the attestation requirement by entering into a written agreement under which the plan’s service provider(s), such as a TPA, submits the attestation for the plan. However, the plan remains responsible for compliance.

Accordingly, employers should coordinate the submission of their annual attestation(s) with each carrier or plan service provider to ensure it is timely submitted.

For further information on the gag clause prohibition and attestation requirements, please review the available resources on the designated CMS Gag Clause Prohibition Compliance Attestation website and ask your broker or consultant for a copy of the NFP publication Gag Clause Prohibition and Attestation: A Guide for Employers.

The deadline for 2025 CAA gag clause attestations is just around the corner. Employers should act now to ensure their group health plan contracts are compliant and attestations are timely submitted.

To review, the CAA prohibits group health plans and insurers from directly or indirectly entering into contracts offering access to provider networks that contain certain types of “gag clauses.” In the healthcare context, gag clauses are contract terms that restrict information, including provider network rates and deidentified claims data, that plans or insurers can make available to another party, such as a business associate. An example is a provision in a TPA contract that prohibits the plan's access to network rates because the TPA considers the information to be proprietary.

The CAA also requires plans and insurers to annually attest to compliance with the gag clause prohibition via a CMS web form. The next attestation of compliance is due by December 31, 2025, attesting to compliance for contracts entered since the most recent attestation.

With a fully insured plan, an insurer can agree to submit the required attestation on behalf of the plan. A self-insured plan, including a level-funded plan, may satisfy the attestation requirement by entering into a written agreement under which the plan's service provider(s), such as a TPA, submits the attestation for the plan; however, the plan remains responsible for compliance.

Accordingly, employers should coordinate the submission of their annual attestation(s) with each carrier or plan service provider to ensure it is timely submitted. For this year's attestation, some carriers and service providers are providing early employer response deadlines (e.g., October 31, 2025) if the employer wishes for the service provider to submit the attestation on their behalf. Since response deadlines vary by each service provider, employers should contact their carrier or TPA for specific information to ensure they respond timely.

For further information on the gag clause prohibition and attestation requirements, please review the available resources on the designated CMS Gag Clause Prohibition Compliance Attestation website and ask your broker or consultant for a copy of the NFP publication Gag Clause Prohibition and Attestation: A Guide for Employers.

The ACA requires insurers to submit an annual report to HHS to account for plan costs. If the insurer does not meet the medical loss ratio (MLR) standards, this means that too large a portion of the premiums charged in the previous year went towards the insurer’s administration, marketing, and profit instead of going toward paying plan claims and quality improvement initiatives. In such cases, the insurer must provide rebates to policyholders. For 2025, insurers must distribute rebates to employer plan sponsors between August 1, 2025, and September 30, 2025.

Employers that sponsor fully insured plans and receive a rebate should keep in mind that there are strict guidelines as to how the rebate may be used or distributed. Employers should review their plan document for direction. Generally, absent any specific direction in the plan documents, any portion of the rebate that is considered an ERISA plan asset (e.g., the portion attributable to participant contributions) must be returned to participants in some form (e.g., premium reduction, cash refund, or benefit enhancement) within 90 days of receipt. In such case, the employer, as plan administrator, has a fiduciary obligation to ensure ERISA plan assets are used exclusively for the benefit of plan participants and beneficiaries. Special rules apply for the treatment of rebates issued to non-ERISA plans, such as those sponsored by state or local governments or churches.

For further information, please ask your broker or consultant for a copy of the NFP publication MLR Rebates: A Guide for Employers.

Employers of all sizes that sponsor prescription drug plans (whether fully insured or self-insured) are required to annually inform Medicare-eligible individuals whether the plan’s coverage is “creditable” or “non-creditable.” Medicare Part D-eligible individuals include active, disabled, COBRA, and retired individuals (employees or former employees and dependents) eligible to participate in the employer’s plan(s). Coverage is creditable when it pays, on average, at least as much as Medicare’s standard Part D prescription drug coverage.

The Medicare Part D notice of creditable coverage must be distributed by October 14, 2025 (prior to the October 15 start of the Medicare annual enrollment period). CMS provides Model Notice Letters in English and Spanish for this purpose. The notices are intended to help Part D eligible individuals compare the employer’s coverage options with a Part D plan and make informed decisions about whether to enroll in a Medicare Part D plan. Timely receipt of the notice can help these individuals avoid paying higher premiums (also known as late enrollment penalties) for Medicare Part D coverage. These penalties may apply if an individual fails to maintain creditable coverage for a continuous period of 63 or more days after the end of their initial enrollment period.

Enhancements made to Medicare Part D as part of the Inflation Reduction Act have increased the actuarial value of the Part D standard plan (thus raising the creditability bar). Although it is expected that most prescription drug plans will maintain creditable coverage status, employers should work with their carriers, TPAs, and actuaries, as applicable, to determine if their prescription drug coverage is creditable. There is no requirement that an employer offer creditable coverage, but they must determine the creditable status of each of their plans and timely notify Medicare Part D eligible individuals.

For further information on the creditable coverage disclosure requirements and changes to Part D under the Inflation Reduction Act, please ask your broker or consultant for a copy of the NFP publication Medicare Part D Creditability Disclosures: A Guide for Employers.