Side Affects Episode 165 | Compliance in Minutes - June

Speaker A: Hello everyone. I'm Hayden Parsons, the marketing producer at McGowan Brabender, bringing you the June 2026 edition of Compliance in Minutes. When employees hear the words employee benefits, they might think of healthcare, PIRCs, wellness programs, PTO. The list goes on. But when HR professionals hear the words employee benefits, they're likely thinking about cost management, compensation, open enrollment, and most importantly, compliance. Compliance is the cornerstone of today's insurance landscape and for good reason. As your broker, MB is committed to delivering timely compliance updates, empowering our clients to operate efficiently, overcome challenges, and remain aligned with the ever evolving laws and regulations. With that in mind, let's dive into your June 2026 compliance updates. First up, A significant HIPAA enforcement action is serving as an important reminder for employers sponsoring self funded health plans. In April, the Department of Health and Human Services announced a $245,000 settlement with a self funded employer health plan following a ransomware attack that exposed the protected health information of more than 9,300 individuals. According to regulators, the plan lacked a comprehensive HIPAA risk analysis and did not have an effective risk management process in place to identify and address vulnerabilities before the breach occurred. The incident exposed sensitive information, including names, addresses, Social Security numbers, claims information and benefit enrollment data. While most HIPAA enforcement actions involve healthcare providers or hospitals, this case is notable because it directly involved an employer sponsored health plan. The key takeaway for employers is that HIPAA compliance is not something that can be delegated entirely to a third party administrator or vendor. Even when outside partners are involved, the health plan itself remains responsible for meeting HIPAA privacy and security rule requirements. Regulators also emphasized another important concept, the M minimum necessary standard. In many cases, employers may not need access to identifiable health information at all. DE identified reporting is often sufficient for plan oversight and strategy purposes. For organizations sponsoring self funded or level funded plans, now is a good time to review risk analysis, security policies, business associate agreements and internal access controls to ensure they remain up to date. Staying on the topic of HIPAA uh, additional changes may be on the horizon. Federal regulators are expected to finalize updates to the HIPAA security rule, which would represent the most significant changes to these requirements in more than a decade. While the final rule has not yet been released, so several proposed requirements are worth watching. These include mandatory multi factor authentication, encryption of electronic protected health information, enhanced vulnerability scanning, stronger audit controls, annual compliance reviews, and detailed inventories of technology assets that store or transmit protected health information. Another notable proposal would eliminate the distinction between required and addressable security safeguards, meaning organizations would have less flexibility in determining how certain security standards are implemented. Although the timeline remains uncertain, employers with access to protected health information should begin evaluating their cybersecurity posture now. Many of the proposed requirements align with current cybersecurity best practices, so preparing early could make future compliance efforts significantly easier. Next, a quick reminder about an annual compliance deadline that applies to many self funded health plans, employer sponsoring self funded medical plans, level funded plans, health reimbursement arrangements, and individual coverage HRAs may be required to file and pay patient centered uh, Outcomes Research Institute or PCORI fees by July 31st. The fee is reported using the second quarter IRS Form 720 and is calculated based on the average number of covered lives during the applicable plan year. For plan years ending before October 1, 2025, the fee is $3.47 per covered life. For plan years ending between October 1 and December 31, 2025, the fee increases to $3.84 per covered life. Most employers work with their third party administrator to determine the appropriate covered life count, but the responsibility for filing and payment ultimately remains with the employer. Fully insured plans are generally exempt because the insurance carrier pays the fee directly. If you sponsor a self funded arrangement, now is a good time to confirm who is handling the calculation and ensure the filing process is on track before the July deadline. Finally, a recent court decision highlights the continued scrutiny surrounding mental health parity compliance. Uh a federal court recently denied a motion to dismiss a lawsuit involving coverage requirements for residential treatment centers. The lawsuit alleges that the health plan imposed stricter requirements on residential mental health treatment than it did on comparable medical and surgical services. Specifically, the court noted that the plan appeared to require around the clock nursing care for residential treatment centers, while similar requirements were not consistently applied to comparable skilled nursing facilities. Because of the difference, the court concluded that the plaintiffs had raised a plausible mental health parity claim, allowing the case to move forward. This case serves as another reminder that parity compliance extends beyond simply covering mental health services. Employers and plan fiduciaries must also ensure that treatment limitations, authorization requirements, network standards, and reimbursement practices are applied consistently across both mental health and medical benefits. Notably, the lawsuit names both the carrier and the employer, reinforcing the reality that plan sponsors can face fiduciary exposure when parity requirements are not met. As enforcement activity in litigation continues to increase, employers should work closely with carriers, Team TPAs, and advisors to understand how mental health benefits are administered and documented. That's a wrap for our June 2026 compliance admittance. Thanks for tuning in and don't forget to subscribe for monthly updates on compliance, employee benefits and health plan.