Compliance Monthly Update
January 2025
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
Federal Compliance Update
DOL issues 2025 adjusted penalty amounts for group health plan violations.
On January 10, the DOL published the 2025 annual adjustments to civil monetary penalties for a wide range of benefit-related violations. The adjustments are effective for penalties assessed after January 15, 2025. Here are the highlights:
- Form 5500 maximum penalty for failing to file increases from $2,670 to $2,739 per day the filing is late.
- Summary of Benefits and Coverage (SBC) maximum penalty for failing to provide the SBC increases from $1,406 to $1,443 per failure.
- Multiple Employer Welfare Arrangement (MEWA) annual report (Form M-1) filing failures increases from $1,942 to $1,992 per day.
- Children’s Health Insurance Program (CHIP) notice penalty for failing to provide the notice increases from $141 to $145 per day.
U.S. Supreme Court will review ACA preventive services mandate.
On January 10, the U.S. Supreme Court agreed to review a lawsuit (the Braidwood case) challenging the ACA requirement that non-grandfathered health plans must cover certain preventive services without cost-sharing.
- As a reminder, the ACA requires health plans to cover preventive services with no cost-sharing for participants, and the ACA empowers three agencies—the U.S Preventive Services Task Force (PSTF), the Health Resources and Services Administration (HRSA), and the Advisory Committee on Immunization Practices (ACIP)—to determine what kinds of preventive care fall within each category of mandatory coverage by issuing guidelines or recommendations.
- In March of 2023, a district court ruled in the Braidwood case that the ACA requirement to provide preventive services as recommended by the PSTF is unconstitutional and issued a nationwide injunction that prohibited the federal government from enforcing the ACA preventive care mandate. However, that district court ruling was stayed pending the outcome of the appeal.
- In June of 2024, the Fifth Circuit affirmed that the PSTF’s members had not been validly appointed under the Constitution because they were not nominated by the President and confirmed by the Senate. The court explained that this appointment process is necessary due to the level of power exercised by the PSTF in making recommendations on preventive services required to be covered under the ACA. Under this ruling, HHS is enjoined from enforcing PSTF recommendations, but only as to the Braidwood plaintiffs. The court reversed the trial court’s decision to vacate all agency actions taken to enforce the preventive services mandates and to universally block the agencies from enforcing the mandates with a nationwide injunction. The court withheld judgment and remanded the case back to the trial court to determine if the members of HRSA and ACIP were also unconstitutionally appointed. So, although the Fifth Circuit ruled that some aspects of the ACA preventive service requirements are unconstitutional, those requirements still apply to group health plans nationwide (except for the plaintiffs who brought this lawsuit). Therefore, the preventive services requirement remained intact for the time being.
- Then the DOJ, under the Biden administration, asked the Supreme Court to review the Fifth Circuit holding that the appointment of the PSTF is unconstitutional. And on January 10, 2025, the Supreme Court agreed to hear the case.
- We will be keeping an eye on this case and will give updates on any developments and the impact on the ACA preventive services mandate.
Gag clause FAQ guidance released.
On January 14, the DOL, HHS, and IRS issued FAQs with clarifying guidance about the gag clause prohibition and attestation requirement. As a reminder, group health plans and insurers are prohibited from entering into agreements with providers, provider networks, or entities offering provider network access that contain any contractual term directly or indirectly restricting the plan or insurer from disclosing specified data and information, such as cost or quality of care data (a “gag clause”). Plans and insurers are required to annually attest (by December 31 each year) to their compliance by submitting the gag clause prohibition compliance attestation (GCPCA). Plan sponsors should ensure that the GCPCA obligation is met each year. Remember that self-insured health plans may enter into an agreement with a service provider to submit the attestation, but the legal requirement remains with the plan, so follow-up and verification are important. Highlights of the FAQ guidance include:
- Downstream agreements. The FAQs clarify that a plan’s or insurer’s agreement with a TPA (or other service provider) to provide network access is considered to indirectly restrict the plan or insurer in a manner that violates the gag clause prohibition if the TPA (or service provider) has a separate agreement with an entity (i.e., a downstream agreement) to provide or administer the plan’s or insurer’s network that restricts the plan or insurer from providing, electronically accessing, or sharing relevant information or data with participants, plan sponsors, providers, or business associates. The agencies advise plans and insurers to include in their direct service agreements provisions that prohibit a TPA or other service provider from entering into a downstream agreement that restricts the plan or insurer from sharing relevant information or data.
- Business associate agreements (BAAs). An agreement that prevents or limits the plan or insurer from sharing information with a business associate (consistent with applicable HIPAA privacy rules) also violates the gag clause prohibition.
- Examples of gag clauses. Examples of restrictions on access to de-identified claims data that are prohibited by the gag clause prohibition include:
- Limiting access to a statistically significant or the “minimum necessary” number of de-identified claims.
- Limiting the scope of access to the data to specific, narrow purposes (such as limiting access to the context of an audit).
- Unreasonably limiting the frequency of claims reviews (e.g., no more than once per year).
- Limiting the number and types of de-identified claims that a plan or issuer may access.
- Restricting the data elements of a de-identified claim that a plan or issuer may access.
- Providing access to de-identified claims data only on the TPA’s or service provider’s physical premises.
- Reporting on noncompliant contract provisions. If a plan or insurer has an agreement that violates the gag clause prohibition but has been unable to remove the noncompliant provision, the plan or insurer must identify the provision in the gag clause attestation. The FAQs advise that the GCPCA submission webform (Step 3, Additional Information) may be used for this purpose.
Agencies withdraw OTC contraceptives proposed regulations.
On January 15, the DOL, HHS, and IRS withdrew proposed regulations titled “Enhancing Coverage of Preventive Services Under the Affordable Care Act.” The proposed regulations (that were discussed in our October 2024 compliance update) would have expanded access to coverage of recommended preventive services without cost sharing and would have required plans and insurers to cover certain recommended OTC contraceptive items without a prescription and without cost-sharing. (Under current rules, the requirement to cover OTC contraception only applies if the individual has a prescription.) In addition, plans and insurers would have been required to include certain disclosures pertaining to coverage and cost-sharing for recommended OTC items in their internet-based self-service tools. And if using reasonable medical management techniques for preventive health services, plans and insurers would have been required to provide an exceptions process that allowed individuals to receive coverage according to the recommendations of their attending providers, even if not generally covered by the plan. The agencies have now withdrawn the proposed regulations citing the need to focus on other matters and the desire to utilize up-to-date facts and information for future proposals. Note that seven states—California, Colorado, Maryland, New Jersey, New Mexico, New York, and Washington—already have laws requiring state-regulated fully insured plans to cover certain OTC contraceptives without a prescription and without cost sharing.
Women’s preventive services guidelines updated.
As a reminder, non-grandfathered group health plans and insurers must cover without cost-sharing certain preventive services specified by the Health Resources and Services Administration (HRSA), the United State Preventive Services Task Force (PSTF), and the CDC’s Advisory Committee on Immunization Practices (ACIP). Recommendations and guidelines are updated periodically, and on December 30, the HRSA issued updated women’s preventive services guidelines (a full list of the updated guidelines are also listed at the HRSA website). The updated guidelines (that must be covered without cost-sharing for plan years beginning on or after December 20, 2025) include the following updated and new preventive services:
- Screening and Counseling for Intimate Partner and Domestic Violence. Annual screening for adolescent and adult women and, if needed, intervention services such as counseling, education, harm reduction strategies, and appropriate supportive services.
- Breast Cancer Screening for Women of Average Risk. Annual or biennial mammography screening beginning no earlier than age 40 and no later than age 50 and continuing through at least age 74; additional imaging if necessary to complete the screening process or address findings—including, if indicated, magnetic resonance imaging (MRI), ultrasound, and pathology evaluation.
- Patient Navigation Services for Breast and Cervical Cancer Screening. Individualized navigation services including, but not limited to, person-centered assessment and planning, health care access and health systems navigation, referrals to appropriate support services (e.g., language translation, transportation, and social services), and patient education.
IRS guidance on tax treatment of state paid family and medical leave contributions and benefits.
On January 15, the IRS released Revenue Ruling 2025-4 that provides guidance on the income and employment tax treatment of contributions and benefits paid in certain situations under state paid family and medical leave (PFML) programs, as well as the related reporting requirements. Currently, thirteen states and the District of Columbia have adopted mandatory PFML programs and more states
are considering them. The guidance explains multiple tax treatment scenarios for contributions to and benefits paid in certain situations under these programs, and the related reporting requirements.
- Contributions to PFML programs:
- Employer contributions. Contributions made by employers to a state PFML program are generally excluded from an employee’s gross income and are not subject to FICA, FUTA, or federal income tax withholding.
- Employee contributions. Contributions made by employees are treated as after-tax contributions. If the employer provides an employee’s required contribution for the employee, the amount is treated as additional compensation to the employee and is subject to FICA, FUTA, and income tax withholding.
- Benefits paid under PFML programs. Benefits that replace wages during an employee’s leave are considered wages for employment tax purposes. They are subject to FICA, FUTA, and income tax withholding unless the payment qualifies for exclusion under accident or health plan rules (e.g., payments for medical reasons under IRC Section 105). So, the tax implications of such benefits can differ depending upon whether the payment is for family leave or medical leave.
- The revenue ruling (on pages 29 and 30) provides helpful summary tables on the tax consequences of contributions to PFML programs and benefits paid by PFML programs.
- The revenue ruling is effective for payments made on or after January 1, 2025. However, the IRS is providing transition relief from certain withholding, payment, and information reporting requirements for state paid medical leave benefits paid during the 2025 calendar year. This means that 2025 will be regarded as a transition period in terms of enforcement to give states and employers time to comply with these new rules.
- Employers should discuss this guidance with their tax advisors and payroll vendors to ensure proper withholding and reporting.
Mental Health Parity Report to Congress.
On January 17, the DOL, HHS, and IRS jointly released their 2024 Mental Health Parity and Addiction Equity Act (MHPAEA) Report to Congress. The report outlines the regulatory agencies’ efforts to promote and enforce compliance with the MHPAEA rules, including the nonquantitative treatment limitation (NQTL) comparative analysis requirement, with the policy goal to ensure plan participants do not face greater barriers to accessing mental health and substance use disorder benefits as compared to medical and surgical benefits. Also released with the Report to Congress is a MHPAEA enforcement fact sheet that highlights enforcement data and significant results from investigations closed in fiscal year 2023. Here are the highlights of the report and fact sheet:
- Enforcement Priorities. Six priority areas were identified that continue to comprise the “vast majority” of NQTLs subject to review: (1) prior authorization requirements for inpatient services; (2) concurrent care review for outpatient services; (3) standards for provider admission to participate in a network, including reimbursement rates; (4) out-of-network reimbursement rates and methods for determining usual, customary, and reasonable charges; (5) impermissible exclusions of key treatments for mental health conditions and substance use disorders; and (6) adequacy standards for mental health and substance use disorder provider networks. In this reporting period, the regulatory agencies deepened their focus on two areas: (a) NQTLs relating to network adequacy and composition and (b) impermissible exclusions of key treatments such as ABA therapy for autism spectrum disorder, medication-assisted treatment for opioid use disorder, and nutritional counseling for eating disorders.
- Future Guidance. The regulatory agencies indicate that future guidance will address the type, form, and manner of collection and evaluation of required NQTL-related data. This guidance will include a list of examples of data that are relevant across the majority of NQTLs as well as additional relevant data for NQTLs related to network composition. Also planned is an updated MHPAEA Self-Compliance Tool to assist plans and insurers as they work to comply with the 2024 regulations. In addition, the agencies announced that they will provide a sample comparative analysis with written explanation and supporting documents that demonstrate how a fictional plan applied factors and standards in the design of an NQTL, consistent with the requirements of the regulations. The sample analysis will evaluate multiple aspects of how the NQTL is designed and applied and examine whether the NQTL complies with MHPAEA.
Reminder that MHPAEA NQTL comparative analysis fiduciary certification now required for plan years beginning in 2025.
Under the MHPAEA final regulations that were released last year (and discussed in our September 2024 Compliance Monthly Update), plans subject to ERISA must have the plan fiduciaries certify that they have engaged in prudent process to select one or more qualified service providers to perform and document the non-quantitative treatment limitation (NQTL) comparative analysis and that the fiduciaries have satisfied their duty to monitor those service providers. The effective date for the fiduciary certification requirement is January 1, 2025, for calendar year plans, or the first day of the plan year beginning on or after January 1, 2025, for non-calendar year plans. Note the signed certification is something that the employer would keep as part of its internal group health plan records along with the comparative analysis, so both can be provided if the DOL does a MHP audit of the plan.
Reporting instructions released for 2024 RxDC reporting due June 1, 2025.
On January 17, CMS released updated instructions and template data forms for group health plans and insurers to report prescription drug and health care spending data, as required by the Consolidated Appropriations Act, 2021 (CAA). The updated Prescription Drug Data Collection (RxDC) Reporting Instructions are for the 2024 reference year reporting that is due June 1, 2025. There are no changes to the instructions or templates other than revising the reference year from 2023 to 2024. The instructions provide step-by-step guidance for submitting data through the RxDC module in the Health Insurance Oversight System (HIOS). See the CMS RxDC webpage for more information and for the updated instructions/forms. Employers should (a) reach out to their carriers, TPAs, or PBMs (as applicable) to confirm that they will submit the RxDC reports for their group health plan(s), (b) make sure their written agreements with these third parties have been updated to reflect this reporting responsibility, (c) be on the lookout for communications and data requests from these third parties and respond in a timely manner so they can submit data on behalf of the group health plan, and (d) monitor and document their carrier’s, TPA’s, or PBM’s compliance. Employers who miss the carrier/TPA/PBM deadlines (as well as employers whose carrier/TPA/PBM will not complete the filing for them) will need to register and upload files in the HIOS system. Employers who need to file using HIOS will want to make sure they are carefully review and follow the reporting instructions.
2025 federal poverty levels released—and the impact on affordability determinations.
2025 poverty guidelines were released on January 17 and set the federal poverty line (FPL) at $15,650 (up from $15,060 in 2024) for a person living in the lower-48 states. The updated FPL is $17,990 for Hawaii and $19,550 for Alaska. Applicable large employer (ALEs) that utilize the FPL affordability safe harbor may use the FPL that is in effect within six months before the start of the plan year. So, January 1, 2025, plan years are still required to use the 2024 FPL because the new 2025 guidelines were not released prior to the beginning of the plan year. However, non-calendar plan years starting in 2025 can use the 2025 guidelines to increase the FPL safe harbor amount due to the increased 2025 guidelines. For example:
- 2025 calendar-year plans. The maximum affordable employee-only contribution for the lowest-cost plan based on the FPL safe harbor = $113.20 = (9.02% x $15,060 FPL for 2024) / 12.
- 2025 non-calendar-year plans. The maximum affordable employee-only contribution for the lowest-cost plan based on the FPL safe harbor = $117.64 = (9.02% x $15,650 FPL for 2025) / 12.
IRS Publication 969 (HSAs) released.
The IRS released Publication 969 (Health Savings Accounts and Other Tax-Favored Health Plans) for use in preparing 2024 tax returns. This publication is a good source of information and guidance on HSAs and health FSAs—including contribution limits, eligibility criteria, tax treatment of withdrawals, and provides examples to help understand how HSAs and FSAs work and interact.
Johnson & Johnson fiduciary lawsuit dismissed.
On January 24, the district court dismissed an ERISA fiduciary lawsuit against Johnson & Johnson (J&J) that alleged the plan fiduciaries had mismanaged its self-funded health plan’s prescription drug benefits in its selection of the PBM and by overpaying for specialty generic drugs offered on the plan’s formulary (we discussed this lawsuit when it was filed last year in our February 2024 compliance update). The court has now dismissed the case for a lack of standing finding that the plaintiff’s allegations that she paid too much in premiums, copays, and coinsurance and that her wages were adversely impacted by prescription drug costs were speculative at best and that her allegations regarding higher out-of-pocket costs for prescription drugs were not redressable. This means that the fiduciary claims were dismissed by the court based on procedural issues—the judge did not rule that J&J, as the plan fiduciary, breached (or didn’t breach) its fiduciary obligations to the plan in the administration of its prescription drug program. Note that a nearly identical case against Wells Fargo is still pending (that we discussed in our August 2024 compliance update), and that we are continuing to monitor. Regardless of the outcomes of these cases, plan sponsors should make sure to continue engaging in prudent fiduciary decision-making processes for designing their benefit plans and in their selection of PBMs and other vendors. ERISA does not require plan fiduciaries to select the lowest cost vendors, rather they should make a prudent decision taking in the various factors in the vendor selection process to ensure the plans are designed and administered in participants best interests. Having good documentation and a process in place for making prudent group health plan decisions will generally be the most effective shield against potential lawsuits.
Trump Administration Executive Orders and Memoranda: Impact on Group Health Plans.
President Trump has issued several executive orders and memoranda that may eventually affect group health plans. Note that executive orders serve as directives to federal agencies, instructing them to develop regulations and guidance but do not immediately change existing law. Similarly, presidential memoranda provide policy direction to agencies. While future regulatory changes and new rulemaking are expected to align with these directives, plan sponsors should not begin to implement any changes until additional agency guidance is published with an explanation of any required action.
- Memorandum: Regulatory Freeze Pending Review. Consistent with prior administrations, President Trump has issued a memorandum ordering a regulatory freeze directing federal executive departments and agencies not to propose or issue regulations (including by submitting them for publication in the Federal Register), and to withdraw regulations that have been submitted but not published, until they have been reviewed and approved by a department or agency head appointed by President Trump. Departments and agencies are further directed to consider postponing for at least 60 days the effective date of regulations that have been published in the Federal Register but have not yet taken effect, for the purpose of reviewing questions of fact, law, or policy.
- Executive Order on Rescinding Prior Executive Action including Fixed-Indemnity plans. This order revokes several previous executive orders and actions, including the requirement for employers offering hospital or other fixed-indemnity insurance plans to include a notice in enrollment materials stating that such benefits are considered excepted benefits and are not subject to ACA requirements. The original notice requirement was implemented to increase transparency, prevent confusion and ensure that individuals understood that fixed-indemnity plans are not comprehensive health coverage and do not provide the same protections as full ACA-compliant plans. As discussed last month, a Texas court had already vacated the original notice requirement. While no immediate action is required, plan sponsors may now remove the notice from enrollment materials if they choose, though some employers may still find it useful to enhance employee clarity and understanding.
- Executive Order on Sex-Based Definitions in Federal Policy. This order directs federal agencies to define “sex” based on biological classification as male or female, excluding gender identity. Agencies must enforce sex-based rights and protections accordingly, revoke conflicting guidance, and restrict federal funding for gender identity-related initiatives. This may impact nondiscrimination rules under ACA Section 1557 (which prohibits discrimination on the basis of race, color, national origin, sex, age, or disability for certain health programs and activities), and it will likely impact protections for “gender-affirming” care.
- Executive Order on Medical Interventions for Minors. This order prohibits federal funding and support for medical interventions related to gender transition in minors. It directs HHS to withdraw conflicting guidance and enforce existing laws restricting such treatments. Also, the Department of Defense must remove these procedures from TRICARE coverage. The order is expected to affect ACA Section 1557 nondiscrimination requirements and ACA essential health benefits.
State/Local Compliance Update
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
California
San Francisco Health Care Security Ordinance (HCSO): updated notice and self-funded plan top-off reminder.
San Francisco has released an updated HCSO notice for the 2025 calendar year. The notice outlines the required health care spending rates and must be displayed in all workplaces with covered employees. As a reminder, the HCSO applies to covered employers, regardless of whether they have a fully insured or self-funded plan, and they must spend a minimum amount on health care benefits for covered employees. For self-funded plans, if the health care spending did not meet the required expenditures in 2024, an additional payment (known as a “top-off”) must be made by February 28, 2025. See the San Francisco HCSO website for more information.
Updated San Francisco paid parental leave ordinance poster.
As background, the Paid Parental Leave Ordinance (PPLO) is a San Francisco law that applies to employers with 20 or more employees worldwide. Under the PPLO, employers must provide supplemental compensation to employees bonding with a child in addition to any compensation they receive from California Paid Family Leave (PFL). San Francisco has released an updated PPLO poster that must be placed at each job site or workplace in a location where employees can read it easily. This is the first time the poster has been updated since 2020 in order to reflect changes with California’s PFL program. See the San Francisco PPLO website for more information.
5500 extension for employers impacted by California wildfires.
The IRS announced tax relief for businesses and individuals in California impacted by the wildfires that began on January 7. Currently, individuals that reside or have a business in Los Angeles County qualify, and the same relief will be available to any other counties added later to the disaster area. These taxpayers will have until October 15, 2025, to file various federal business and individual tax returns and make tax payments, and this relief extends to Form 5500 filing requirements. So, Forms 5500 that were required to be filed on or after January 7, 2025, and before October 15, 2025, are postponed to October 15, 2025. The Form 5500 instructions provide directions on how to utilize this type of disaster relief and avoid potential late filing penalties. Note that:
- This relief does not apply to W-2 or Forms 1094 or 1095 filing deadlines.
- PCORI fee filings use Form 720, and this relief does apply to Form 720, but the relief does not apply to the PCORI fee payment itself. So, employer sponsoring self-funded plans (insurers pay the fee for fully insured plans) will still be required to pay the PCORI fee by July 31, 2025.
Massachusetts
Massachusetts enacts PBM legislation.
On January 9, Governor Healey signed PBM legislation titled “An Act Relative to Pharmaceutical Access, Costs and Transparency.” The new law introduces a multifaceted approach that aims to reduce prescription drug costs, enhance data transparency, and impose stronger oversight of PBMs and pharmaceutical manufacturers. Highlights of the law include:
- Mandates that certain health plans offer limited or no cost-sharing for specific generic and brand-name drugs for chronic illnesses, such as diabetes or asthma.
- Establishes a licensing regime for PBMs and requires all PBMs to obtain a license from the Division of Insurance. This oversight will enable the state to monitor PBM activities, ensure financial stability, and regulate the growing PBM market.
- Requires PBMs to disclose to its health plan clients any activity, policy, practice contract, or arrangement that directly or indirectly presents any conflict of interest in regard to the PBM’s relationship with, or obligations to, its client.
- Prohibits certain payments from PBMs to consultants and brokers whose services were obtained by a health benefit sponsor to work on the pharmacy benefit bidding or contracting process if the payment constitutes a conflict of interest.
- Requires PBMs and pharmaceutical manufacturers to submit detailed cost and pricing data to the Center for Health Information and Analysis (CHIA), including information on rebates, administrative fees, patient cost-share, and formulary decisions.
