General Compliance Guide
Employer Compliance
Beyond ACA and ERISA, employer health plans carry a broad set of ongoing compliance obligations — COBRA, FMLA, PCORI fees, annual notices, HIPAA, and DOL audit readiness. Most employers are behind on at least one.
What It Is
Employer health plan compliance extends well beyond the ACA employer mandate and ERISA plan documentation. Employers that sponsor group health plans — whether self-funded or fully insured — carry a continuous set of obligations under federal law, including COBRA continuation coverage, FMLA benefit continuation, PCORI fee payments, HIPAA privacy and security requirements, and a growing list of annual participant notices.
These obligations don't disappear when you outsource administration to a TPA or broker. The plan sponsor — the employer — retains legal responsibility for compliance. Missed deadlines, undistributed notices, and unfiled forms are the most common findings in DOL audits of employer health plans.
A compliance calendar, current plan documentation, and a clear allocation of administrative responsibilities between the employer, TPA, and broker are the foundation of a defensible compliance posture. This guide covers the key obligations and the most common places employers fall short.
How It Works
Core Obligations
COBRA Administration
Employers with 20+ employees must offer continuation coverage to qualified beneficiaries who lose coverage due to a qualifying event. Notices must be sent within strict deadlines — failure triggers excise tax penalties of $100 per day per qualified beneficiary.
FMLA & Benefit Continuation
Covered employers (50+ employees) must maintain group health coverage during FMLA leave. Employees on leave retain the same plan terms as active employees. Coordination with state leave laws adds complexity for multi-state employers.
PCORI Fees
Self-funded plan sponsors pay an annual PCORI fee via IRS Form 720, due July 31 each year. The fee is calculated on average covered lives and adjusted annually. Failure to file and pay triggers IRS penalties.
Annual Notice Requirements
Employers must distribute a suite of annual notices to health plan participants — including CHIP/Medicaid, Women's Health and Cancer Rights Act, Medicare Part D creditable coverage, and the Summary of Benefits and Coverage (SBC).
HIPAA Privacy & Security
Self-funded plan sponsors that handle protected health information (PHI) must comply with HIPAA Privacy and Security Rules. This includes maintaining a privacy notice, training workforce members, and executing business associate agreements with TPAs and vendors.
DOL Audit Readiness
The DOL's Employee Benefits Security Administration (EBSA) audits employer health plans. Plans should maintain current plan documents, SPDs, Form 5500 filings, claims records, and evidence of fiduciary process to respond to an audit without disruption.
Why It Matters
For Employers
"COBRA notice failures are one of the most common DOL audit findings — and one of the most avoidable. The penalty is $100 per day per qualified beneficiary, with no cap for willful violations."
"The annual notice burden for employer health plans has grown significantly. Missing even one required notice can trigger participant complaints, DOL inquiries, and litigation exposure."
"DOL EBSA audits of health plans have increased. Plans without current documentation, executed BAAs, and evidence of fiduciary process are the most vulnerable."
Common Pitfalls
Mistakes to Avoid
- 1
Missing COBRA election notice deadlines — the plan administrator has 14 days from learning of a qualifying event to send the election notice; the employer has 30 days to notify the administrator.
- 2
Failing to distribute the Medicare Part D creditable coverage notice to all Medicare-eligible participants by October 15 each year.
- 3
Not executing Business Associate Agreements (BAAs) with TPAs, PBMs, and other vendors who handle PHI on behalf of the plan.
- 4
Overlooking state mini-COBRA laws for employees not covered by federal COBRA (employers with fewer than 20 employees in states with mini-COBRA requirements).
- 5
Failing to file IRS Form 720 and pay the PCORI fee by July 31 — a commonly missed obligation for self-funded plan sponsors.
- 6
Not updating the Summary of Benefits and Coverage (SBC) when plan terms change mid-year — the SBC must be reissued within 60 days of a material modification.
FAQ
Frequently Asked Questions
Employer Compliance Downloads
Need a compliance review?
Corry Hull helps employers identify compliance gaps and build a defensible compliance posture — before the DOL comes knocking.