On September 30, 2026, a federal judge in the Southern District of California ruled in Whitlock v. Provident Life that a supplemental long-term disability benefit — one the employer offered as “voluntary” — was in fact governed by ERISA because of what the employer did in connection with it. For employers and plan sponsors, the case is a useful reminder that labeling a benefit “voluntary” does not, by itself, keep it outside ERISA.

As background, a U.S. Department of Labor “safe harbor” lets certain employee-pay-all insurance programs sit outside ERISA — but only if all four conditions are met: the employer makes no contributions; participation is completely voluntary; the employer does not endorse the program and limits its role to letting the insurer publicize it and to collecting and forwarding premiums; and the employer receives no compensation beyond reasonable reimbursement for administrative costs. Miss even one of these, and the benefit may be treated as an ERISA plan — with all of the plan-document, disclosure, fiduciary, and claims-procedure obligations that come with it. The pivotal concept is “endorsement”: a program is endorsed when, looking at everything the employer did, an objectively reasonable employee would conclude that the employer did more than simply make the coverage available — that it exercised control over the program or made it appear to be part of the company’s own benefits package.

In Whitlock, the employee enrolled in a voluntary “top-up” disability policy offered through her employer, Lockton — itself an insurance brokerage — and underwritten by Provident Life (part of Unum). She later left Lockton, kept the coverage, and paid the premiums herself, but held onto the discounted rate Lockton had negotiated. After being diagnosed with anxiety and depression, she reduced her hours, filed a disability claim, and was denied. She then sued the insurer, Provident.

 The court held that the policy was covered by ERISA, which meant her state-law claims were preempted. The program flunked the safe harbor on two separate grounds. First, endorsement: Lockton had negotiated a roughly 30% premium discount and folded the coverage into its broader employee welfare benefit plan — enough to lead a reasonable employee to view it as an employer-backed benefit. Second, consideration: as the broker on the program, Lockton received commissions in connection with it, which is more than the “reasonable administrative reimbursement” the safe harbor allows. Either failure alone would have been enough to bring the benefit under ERISA.

Notably, the insurer still prevailed. Applying ERISA’s de novo review, the court found the employee had not proven she was disabled under the policy — her limitations tracked situational job stress, and she continued working at her own company. But the ERISA ruling is the part employers should take to heart. Arrangements like these have drawn fresh scrutiny lately, including lawsuits accusing employers and brokers of self-dealing in how voluntary-benefit programs are run, a development that we covered in our January 29, 2026 CRC Update (see bottom of this page). To keep a voluntary program inside the safe harbor, employers should keep their involvement genuinely hands-off: avoid recommending or promoting the coverage, don’t negotiate its terms, don’t accept commissions or other consideration, keep it out of the plan documents and SPD for the company’s own benefits, and state clearly in employee materials that the employer does not sponsor or endorse it.

On September 9, 2026, the U.S. Department of Health and Human Services (HHS) released Version 3.7 of its Security Risk Assessment (SRA) Tool — a free, downloadable application developed by HHS’s Office for Civil Rights (OCR) together with the Office of the National Coordinator for Health IT (ONC). The Tool walks small and mid-sized healthcare providers and their business associates through the HIPAA Security Rule’s risk-analysis requirement: the obligation to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). That requirement sits within the Security Rule’s general standards, which reach not only healthcare providers but also employers that sponsor group health plans.

Version 3.7’s most useful addition is new guidance on when a risk assessment should be refreshed — for example, after a merger or acquisition, a major technology change, or a security incident. This guidance tracks the Security Rule’s own requirement to review and update security documentation periodically and whenever the environment or operations change. The release also includes minor reporting improvements and updated software libraries with security and bug fixes.

A couple of practical points. The Tool is built for small and mid-sized organizations; larger or more complex entities may need a more robust, enterprise-grade solution. And risk analysis is worth getting right — a missing or inadequate risk analysis is one of the most common findings in OCR enforcement actions. Employers and plan sponsors should treat risk analysis as an ongoing obligation, not a one-time exercise, and use the refreshed Tool to re-examine remote-access controls and confirm that every location and system that handles ePHI is accounted for.

On September 8, 2026, the U.S. Department of Labor’s Employee Benefits Security Administration (EBSA) issued Field Assistance Bulletin (FAB) 2026-03, announcing a narrower, more targeted approach to enforcing the “nonquantitative treatment limitation” (NQTL) rules under the Mental Health Parity and Addiction Equity Act (MHPAEA), as amended by the Consolidated Appropriations Act, 2021 (CAA). NQTLs are the non-dollar limits a plan puts on care — things like prior authorization, step therapy, medical-necessity criteria and provider-network standards. Under the CAA, a plan that applies these limits to mental health or substance use disorder (MH/SUD) benefits must prepare and document a comparative analysis showing that the processes, strategies, evidentiary standards, and other factors it uses — both as written and in actual operation — are comparable to, and applied no more stringently than, those it uses for medical and surgical benefits.

FAB 2026-03 builds on the Departments’ May 15, 2025 statement that they would not enforce the provisions of the 2024 MHPAEA final rule that are new relative to the 2013 rule, pending resolution of ongoing litigation (plus 18 months). The important point for plan sponsors is what did not change: the underlying MHPAEA and CAA obligations remain fully in effect — including the duty to produce an NQTL comparative analysis within 10 days of a regulator’s request.

The bulletin directs EBSA to concentrate its NQTL enforcement on three priority areas: (1) separate treatment limitations, including blanket exclusions of MH/SUD treatments where comparable medical/surgical treatments are covered; (2) medical-necessity standards and utilization-management practices, such as prior authorization and concurrent and retrospective review; and (3) network-adequacy standards, with a focus on how providers are admitted to the network and how they are reimbursed.

Alongside the bulletin, EBSA released a companion enforcement guidance tool that flags common compliance “red flags.” These include excluding applied behavior analysis (ABA) therapy or medications for addiction treatment, imposing broad prior-authorization requirements on MH/SUD but few on medical/surgical benefits, and paying MH/SUD providers at lower rates. They also include written terms that don’t match how the plan is actually administered, longer prior-authorization turnaround for MH/SUD, and data pointing to thin MH/SUD networks. Finally, the tool offers monitoring best practices, provides questions fiduciaries should ask their service providers, and gives examples of corrective action. The practical takeaway: review both your plan design and your day-to-day administration against these priority areas, and make sure your NQTL comparative analyses are current and ready to provide on request.

On June 18, 2026, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with a group health plan (the Plan) to resolve an OCR investigation that commenced in 2022 after the Plan discovered that an unauthorized actor accessed the company’s network, deployed ransomware, and compromised its systems. This incident potentially affected the private health information (PHI) of 10,023 individuals, including health plan members’ names, addresses, zip codes, phone numbers, email addresses and social security numbers. OCR determined that the Plan had potentially violated provisions of the HIPAA Privacy and Security Rules, including failing to conduct an accurate and thorough risk analysis to determine potential risks and vulnerabilities to ePHI prior to the breach. In addition, the Plan failed to implement reasonable and appropriate policies and procedures to comply with HIPAA prior to the breach. Under the settlement terms, the Plan paid $450,000 and agreed to a two-year corrective action plan monitored by OCR. To mitigate or prevent HIPAA liability from cyber-threats, employers should ensure that their group health plans have comprehensive HIPAA policies and procedures in place, including a risk analysis.

On April 14, 2026, the U.S. Department of Labor Employee Benefits Security Administration (EBSA) announced a shift in their enforcement philosophy. EBSA announced in their Field Assistance Bulletin (FAB) that they will place a greater emphasis on compliance assistance, formal rulemaking, and amicus participation, rather than “regulation by enforcement.” According to the FAB, EBSA will focus its investigations on cybersecurity, benefit distributions, mental health parity and substance use disorder coverage, retirement asset management, No Suprises Act enforcement and fiduciary prudence. Further, greater emphasis will be placed on systemic risks as opposed to smaller plan-level issues.

Effective June 1, 2026, the City of Chicago adopted amended paid leave, paid sick leave, and safe leave ordinance (“New Rules”) which clarify previous paid leave and paid sick leave policies. Among other issues, the New Rules clarify that non-exempt employees will accrue leave on all hours worked including overtime, whereas exempt employees accrue hours based on a maximum of 40 hours worked per week. The New Rules also provide additional guidance on permitted leave for childcare, which includes taking leave when a child’s place of care unexpectedly closes. The New Rules also clarify that the aforementioned “place of care” can include informal babysitting arrangements, and care by family members or friends in addition to formal arrangements such as schools or daycare. The New Rules further clarify that if an employer has a formal PTO policy in place that includes the ability to accrue time off, allows for the carrying over of hours, and permits use of the PTO hours for all permitted uses under the Chicago Ordinances, the employer does not need to maintain the separate policies. Last, the New Rules allow employers to take disciplinary action, which can include termination of employment, against employees who abuse paid sick leave.

On June 2, 2026, The U.S. Department of Health and Human Services (“HHS”) published a notice (“Notice”) in the Federal Register informing covered entities that a federal court vacated certain provisions of the 2024 final regulation under Section 1557 of the Affordable Care Act (“2024 Final Rule”). As background, in May of 2024, HHS published the 2024 Final Rule, clarifying that the definition of discrimination based on sex includes discrimination based on gender identity. Shortly after the 2024 Final Rule took effect, a federal district court enjoined the gender identity provisions of the Final Rule, preventing them from taking effect. Later, the same federal district court formally vacated the provisions of the 2024 Final Rule that expanded Title IX’s definition of sex discrimination to include gender-identity discrimination. The Notice confirms that HHS and CMS will not enforce the vacated provisions that expanded Title IX’s definition of sex discrimination to include gender identity discrimination. All other provisions of the 2024 Final Rule remain in effect.

On June 4, 2026, the U.S. Office of Personnel Management, Treasury, Department of Labor, and the Department of Health and Human Services (“Agencies”) issued a final regulation (45 CFR Part 149) (“Final Rule”) updating certain parts of the Federal Independent Dispute Resolution (“IDR”) Operations of the No Surprises Act. Effective June 11, this Final Rule updates the fee required to engage the IDR process from $115 to $15 per party per dispute. In order to utilize the IDR process, all health plans and issuers must register with the new IDR Registry to ensure that medical providers can identify payers. The Final Rule also ensures that the IDR negotiation process is handled through the IDR portal, using standardized forms with responses due within 15 business days. IDR entities must determine whether their dispute is IDR eligible within five business days, and payment determinations must be made within 30 business days. While the reduced fee already went into effect on June 11, 2026, most of the other provisions will go into effect August 3, 2026.

On June 17, 2026, the U.S. Department of Labor (“DOL”) issued Technical Release 2026-02 (the “Guidance”) addressing whether Trump Accounts and related employer contribution programs are subject to ERISA. Trump Accounts, created by the One Big Beautiful Bill Act, are special savings accounts for eligible children under age 18. The DOL concluded that Trump Accounts and most employer-sponsored Trump Account Contribution Programs generally are not ERISA pension plans. The guidance further explains circumstances under which ERISA could apply to such programs, and outlines conditions under which employers may facilitate contributions without creating an ERISA-covered arrangement

Effective July 20, 2026, the U.S. Centers for Medicare & Medicaid Services (CMS) finalized rules allowing certain plans without traditional provider networks (“non-network plans”) to qualify as ACA qualified health plans (QHPs) if they satisfy applicable provider access and certification requirements. Additionally, the final rules implement reporting requirements that apply from the 2028 plan year onward. Employers utilizing Individual Coverage HRAs (ICHRAs) should monitor whether these new Exchange offerings affect plan availability, pricing, or enrollment patterns.

Effective January 1, 2027, the American Medical Association (AMA) will replace the traditional global maternity billing codes with a more detailed coding structure that separately reports antepartum care, labor management, delivery services, and postpartum care. The changes are intended to better reflect modern obstetrical care, including telehealth, remote monitoring and team-based care arrangements. While employers do not need to make plan design changes, the transition could create claims administration challenges and increase employee questions regarding maternity claim processing.

AMA Announcement

Beginning July 1, 2027, Virginia will begin implementing a statewide paid sick leave law. Employees will accrue one hour of paid sick leave for every 30 hours worked, up to 40 hours annually. The law applies to employers with 50 or more employees beginning July 1, 2027; employers with 25 or more employees beginning January 1, 2028; and employers with one or more employees beginning January 1, 2029. Leave may be used for an employee’s or family member’s health needs and for certain domestic violence, sexual assault, or stalking-related purposes. Employers need not pay out unused leave on termination, but previously accrued leave generally must be reinstated if the employee is rehired within 12 months. Employers that violate the law may face administrative penalties and civil actions.

NJFLA eligibility and employer coverage thresholds are reduced under Assembly Bill 3451. Beginning July 17, 2026, employers with 15 or more employees must provide job-protected leave to employees with at least 3 months and 250 hours of service.  This is a change from the prior requirement for employers with 30 or more employees to provide leave that was not job protected to employees who had worked for 12 months and 1,000 hours. The updated NJFLA also clarifies that employees cannot use paid sick leave to supplement NJ Temporary Disability Insurance (TDI) or NJFLA benefits. However, employees retain the right to choose how to sequence and coordinate available leave (e.g., whether to use accrued paid leave before or after statutory benefits). Additional state guidance is expected in July 2026 according to the NJFLA website.

On May 14, 2026, the U.S. Supreme Court paused a Fifth Circuit Ruling in the case Louisiana v. FDA, that sought to restrict access to mifepristone by reinstating a prior Food and Drug Administration (FDA) rule that required patients to travel to a health center to obtain the medication, rather than through the mail via telehealth or pharmacy. The case challenges FDA rules currently in place that permit remote access to the medication, which has been approved since 2000 for use in medication abortions and early miscarriage care. The Court did not rule on the merits but allowed access to remain unchanged while the litigation proceeds.

On May 13, 2026, the U.S. Departments of Treasury, Labor and Health and Human Services published a proposed regulation (Proposed Rule) which would allow certain fertility services, including in vitro fertilization (IVF), to qualify as limited excepted benefits if offered separately or not integral to a group health plan. The Proposed Rule would also require written notice of the availability of coverage and impose an individual lifetime benefit cap of $120,000 (indexed for inflation). If finalized, the rule would apply to plan years beginning on or after January 1, 2027.

IRS Revenue Procedure 2026-22 sets 2027 ACA Employer Mandate penalties. Applicable Large Employers (ALEs) that fail to offer minimum essential coverage to at least 95% of full-time employees and their dependent children may face penalties of $3,780 per employee (up from $3,340) should at least one full-time employee receive a premium tax credit on an Exchange. Further, employers failing to offer affordable, minimum value coverage may face penalties of $5,670 per affected employee (up from $5,010) for each employee who receives a premium tax credit on an Exchange.

The IRS recently issued updated FAQs (FS-2026-10) on Section 127 educational assistance programs to address recent changes to the law implemented by the One Big Beautiful Bill Act (OBBA) (see our E-Alert here) and to supersede earlier FAQs. Employers are now required to disclose program availability and applicable terms to employees. The guidance confirms student loan repayment benefits are permanently excludable from income and introduces future inflation adjustments to the $5,250 exclusion limit beginning after 2026. It also clarifies eligibility for loans incurred prior to employment and updates IRS Publication 5993 to include a new model plan document for such programs.

On March 27, 2026, the U.S. Court of Appeals for the First Circuit upheld dismissal of a lawsuit alleging ACA Section 1557 discrimination for excluding GLP-1s and other weight-loss drugs from the health plan’s formulary. While the Court acknowledged that the plaintiff had properly alleged an individual disability, it concluded that the plan’s exclusion applied equally to all participants and was not a proxy for disability discrimination.

The deadline for filing the 2025 annual reporting form (ARF) for the San Francisco Health Care Security Ordinance (HCSO) is May 1, 2026. The HCSO requires, among other items, that covered employers report on their total healthcare expenditures for employees for each quarter in 2025. As background, employers with at least one employee within the city of San Francisco who works more than 8 hours per week for more than 90 days are required to spend a certain amount (called an expenditure) on healthcare for their covered employees. These funds can be used for employer-sponsored medical, dental or vision insurance, paid to the city, or contributed toward programs that reduce employee out-of-pocket healthcare costs.

On March 2, 2026, the U.S. Department of Labor (DOL) announced that it would be extending the public comment period for its proposed rule, Improving Transparency Into Pharmacy Benefit Manager Fee Disclosure, from March 31 to April 15. This proposed rule, published on January 30, 2025, would add new disclosure obligations for pharmacy benefit managers (PBMs), PBM consultants and other advisors providing PBM-related services to self-insured group health plans (see our eAlert here). The DOL press release states that extending the comment period will allow stakeholders the opportunity to address aligning the proposed rule with the PBM requirements set out in the Consolidated Appropriations Act of 2026. 

On March 10, 2026, in the case of DaVita Inc. v. Marietta Memorial Hospital Employee Benefit Plan, et. al., a federal district court for the Southern District of Ohio held that an employer-sponsored, self-insured health plan’s decision to classify all dialysis providers as “out-of-network,” resulting in lower reimbursement, did not constitute disparate treatment based on a health factor, and thus, did not violate HIPAA’s nondiscrimination rules. Although the Supreme Court had already rejected DaVita’s Medicare Secondary Payer claim, the trial court separately considered whether the policy unlawfully discriminated against participants with end-stage renal disease (ESRD). The court concluded that the plan design of keeping dialysis providers out-of-network was, on its face, neutral and that the evidence did not show the employer adopted the dialysis carve‑out with discriminatory intent, but rather as a permissible cost‑containment measure. As a result, the remaining claims made under HIPAA, as well as the claims made under ERISA, were dismissed, reinforcing plan sponsors’ ability to structure benefits for legitimate business reasons when properly documented.

On March 19, 2026, in State of Oregon et. al. v. Kennedy et. al., a federal judge of the United States District Court for the District of Oregon indicated that he would partially grant an order to invalidate a December 2025 declaration issued by the Secretary of the Department of Health and Human Services (HHS), Robert F. Kennedy Jr. Widely known as “the Kennedy Declaration,” it called into question the medical validity and safety of gender affirming care for children and adolescents and threatened to bar hospitals and providers who provide gender affirming care to minors from participating in Medicare, Medicaid and other federal healthcare programs. The judge agreed with the arguments set forth by the plaintiff states and determined that the declaration, which established standards of medical care that superseded existing standards, was unlawful because it exceeded HHS’s statutory authority. Further, he affirmed that the Kennedy Declaration amounted to a substantive modification to the law which could only be adopted following notice-and-comment rulemaking, which had not occurred. A formal written opinion from the Court is expected in the coming weeks. HHS will likely appeal the decision.

On March 20, 2026, in Greene et. al. v. Progressive Corp., a federal judge for the U.S. District Court for the Northern District of Ohio dismissed a tobacco cessation and COVID vaccine premium surcharge lawsuit for its failure to state a claim. The lawsuit was brought by current and former employees of Progressive Corp. (Progressive) who had paid a tobacco and/or COVID vaccine premium surcharge to maintain coverage under Progressive’s Health, Life and Disability Plan (the “Plan”). They alleged that the Plan’s tobacco and COVID vaccine wellness programs violated ERISA’s antidiscrimination provisions because the company did not retroactively reimburse surcharges for employees who met an alternative standard mid-year, thus failing to provide the “full reward,” and because the plan documents failed to adequately disclose the availability of a reasonable alternative standard for the removal of the surcharge. The Plaintiffs also alleged a fiduciary breach claim, alleging that Progressive mishandled plan assets by improperly retaining the surcharge amounts. The Court dismissed the complaint, holding that 1) Progressive was not required to retroactively reimburse the surcharge; 2) Progressive’s notice of their reasonable alternative standard was compliant with applicable requirements; and 3) fiduciary standards did not apply to the challenged conduct, which involved implementing non-discretionary plan terms.  There has recently been an uptick in the number of similar lawsuits challenging the imposition of premium surcharges on tobacco users. While Courts have been split on this issue, the Ohio court’s decision, along with other recent decisions, may suggest a shift in favor of employers and plan sponsors.

On March 9, 2026, the U.S. District Court for the Southern District of New York issued a ruling in Stern v. JP Morgan Chase & Co. (“Stern”) that allows JP Morgan (“JPM”) employees to proceed with core portions of their ERISA lawsuit. The suit alleges that their employer mismanaged prescription-drug costs under the company’s self-insured health plan.

In her decision, the judge dismissed claims that JPM breached fiduciary duties of loyalty and prudence, stating that relationships and decisions for JPM as a bank do not inherently become fiduciary acts exclusively because JPM is also the plan sponsor, and that those allegations were challenges to plan design rather than fiduciary conduct. However, the judge allowed the employees’ prohibited transaction claims to proceed, keeping the litigation alive. These claims allege that JPM had engaged in an unlawful prohibited transaction with CVS Caremark by paying its unreasonably high fees.

While this is not a final decision on the merits of the claims against JPM, the decision underscores increasing scrutiny on employer oversight of PBMs and comes as similar ERISA lawsuits are brought against large employers and plan sponsors across the country.

By February 16, 2026, all HIPAA covered entities must update their HIPAA Notice of Privacy Practices (NPPs) pertaining to the confidentiality of substance use disorder (SUD) treatment records in accordance with the February 16, 2024 final regulation under 42 CFR Part 2 (the “Final Rule”). While the U.S. District Court for the Northern District of Texas vacated (invalidated) the Final Rule’s provisions pertaining to increased privacy protections for the confidentiality and disclosure of PHI related to reproductive healthcare (see our eAlert here), the ruling did not vacate requirements pertaining to SUD treatment records. The ruling also does not prohibit covered entities from retaining language in their NPPs providing increased protections for reproductive healthcare records if they so choose. Employers and plan sponsors should consult with their trusted advisors to ensure that all required updates to the NPPs are completed by the February 16, 2026 deadline. This should include making a determination as to whether to retain language in the NPPs regarding reproductive healthcare.

On January 15, 2026, President Trump announced the Great Healthcare Plan, a broad healthcare initiative that promises to lower drug prices and insurance premiums, hold large insurance companies accountable, and maximize price transparency. The Plan proposes to lower drug prices by codifying the administration’s Most-Favored-Nation deals and making more drugs available over the counter. It calls for sending subsidy payments directly to eligible Americans to allow them to purchase insurance of their choice, funding a cost-sharing reduction program, and ending kickbacks to lower insurance premiums. It aims to hold insurance companies accountable by requiring them to publish rate and coverage comparisons, costs of overhead vs. claim payments, claim denial rates, and wait times. Finally, the Plan calls for maximum transparency and seeks to require any provider or insurer who accepts Medicare or Medicaid to post their pricing and fees to avoid surprise billing. It will now be up to Congress to pass this framework into law.

On December 23, 2025, a series of lawsuits were filed in U.S district courts in Illinois and New York against several national employers and their benefits brokers, including United Airlines, Laboratory Corp. of America Holdings, Gallagher Benefit Services Inc., Mercer Health and Benefits Administration LLC, Lockton Companies LLC, and Willis Towers Watson US LLC. The lawsuits allege that the employers and their brokers are plan fiduciaries and that they breached their fiduciary duties by failing to negotiate prices and ensure prudent processes by monitoring broker commissions and loss ratios for voluntary benefits, such as accident and critical illness insurance, causing the plaintiffs to pay higher premiums for these benefits. Further, the suits allege that the plan sponsors engaged in self-dealing with their benefit brokers which resulted in higher premiums. While these voluntary benefits are not traditionally subject to ERISA, as they fall under the “voluntary plan safe harbor” (an ERISA exemption), the suits argue that certain actions by the employer removed these benefits from the safe harbor protection, and thus, subjected them to ERISA. Specifically, the suits allege many actions taken by the plan sponsors constitute “endorsing the plan,” as defined under ERISA, but argue that the action that cements these voluntary plans as subject to ERISA is the inclusion of these benefits on their Form 5500s.

Copies of these Complaints:
Brewer v. CHS/Community Health Systems, Inc.
Braham v. Laboratory Corp of America Holdings
Fellows v. Universal Services of America, LP
Pimm v. United Airlines, Inc.
Article in PSCA: New Wave of ERISA Litigation Targets Voluntary Benefits