Compliance Matters Newsletter | August 2026

Let our team help you navigate the ever-changing benefits compliance landscape each month. Check out this month’s latest alerts, additional updates, and resources hot off the press:

Employee Benefits Compliance Alerts

This month’s Compliance Matters newsletter provides a comprehensive review of the following topics. To obtain your copy, please use the form below to download.

• Trump Accounts as an Employee Benefit: What Employers Need to Know
• DOL Publishes Proposed Rules for Electronic Document Distribution
• Compliance Considerations for Excepted Benefits
• Litigation Series: Court Dismisses Anthem Challenge to IDR Awards
• State Series: New Jersey Enacts First of Its Kind Employer Medicaid Assessment Law

Additional Updates & Resources

IRS Updates ACA Affordability to Highest Percentage Yet

On July 21, 2026, the Internal Revenue Service (IRS) released Revenue Procedure 2026-26 which increased the Affordable Care Act (ACA) §4980H(b) (the employer mandate) affordability percentage to 10.22%, the highest it has been since ACA’s inception.

The ACA requires that applicable large employers (ALEs) offer minimum value, affordable coverage to full-time employees. Small employers (<50 FTEs) are not required to offer any coverage, and if choosing to do so, do not have to make it affordable. When setting plan contribution rates, employers must consider IRS employer affordability safe harbors, the various elements that play into the determination of the employee contribution, and the penalties associated with failing to offer affordable coverage.

Individuals who are eligible for minimum value, affordable coverage under an employer-sponsored group health plan are not eligible for a premium tax credit (PTC) when purchasing individual health insurance through a public Exchange.

Coverage is “affordable” if the required employee contribution does not exceed a set percentage (10.22% in 2027) of household income. The IRS provides three “safe harbors” employers can use to determine if medical coverage is affordable for ACA §4980H(b) compliance purposes.

For more information on determining affordability using the IRS safe harbors, access our prior alert, Affordability Considerations.

Originally, the required contribution percentage for determining affordability was set at 9.5%. The percentage is adjusted annually. See applicable percentages for 2017-2027 in the table below.

The affordability percentage adjustments apply for “plan years beginning in…,” and therefore an employer with a non-calendar year must apply the percentage for the year in which the plan year begins. For example, an employer with a medical plan year of July – June would use 9.96% for the plan year beginning in July 2026 and 10.22% for the plan year beginning July 2027.

Federal Court Holds that ERISA Preempts Pharmacy Network

In Flowers v. Caremark PCS Health, LLC, the Eighth Circuit United States Court of Appeals affirmed the dismissal of a plan participant’s unjust enrichment class action against Caremark, holding that the Employee Retirement Income Security Act (ERISA) preempts Arkansas’s pharmacy network adequacy requirements.

The plaintiff alleged that Caremark improperly limited coverage of maintenance prescriptions to CVS retail pharmacies or mail order, violating Arkansas’s Mail Order and Network Adequacy provisions. The court found no plausible Mail Order Provision violation because members could obtain prescriptions either through mail delivery or at CVS pharmacies, meaning mail order was not required. As to the Network Adequacy Provision, the court determined that the plaintiff’s claim depended on Arkansas regulations imposing geographic pharmacy access requirements.

The court held that those requirements interfere with nationally uniform ERISA plan administration by forcing pharmacy benefit managers (PBMs) to continually modify pharmacy networks and potentially expand infrastructure based on member locations and changing geographic conditions. Because ERISA preempts these geographic coverage mandates, the underlying state-law requirements were unenforceable, leaving the plaintiff without a viable basis for his unjust enrichment claim and resulting in affirmance of the dismissal.

The ruling is another significant development in ongoing litigation over the extent of ERISA preemption of state PBM laws. Employers sponsoring ERISA-governed health plans, particularly those operating in states with similar pharmacy network adequacy requirements, should closely monitor future legal and regulatory developments in this area.

PCMA Challenges Illinois PBM Law

In June 2026, the Pharmaceutical Care Management Association (PCMA), the national trade group representing pharmacy benefit managers (PBMs), filed a federal lawsuit seeking to block the application of key provisions of Illinois’ Prescription Drug Affordability Act (PDAA) to PBMs. PCMA argues that the law conflicts with the Employee Retirement Income Security Act (ERISA), which governs employer-sponsored health plans, and therefore cannot be enforced against PBMs serving those plans. The Illinois law, which was signed into law in May 2025, bans spread pricing, prohibits “steering” patients to pharmacies owned by PBMs, requires PBMs to remit manufacturer rebates to insurance plans and consumers, and levies a $15 per-enrollee fee on PBMs to fund a grant to support pharmacies in rural communities.

The case is the latest in a series of legal challenges by the PBM industry against state-level reform efforts. Illinois enacted the PDAA in 2025 as part of a broader push to increase oversight of PBMs, particularly the three largest PBMs, which collectively manage the majority of U.S. prescription drug claims. PCMA is asking the court to rule that the law’s reporting and network-design provisions are preempted by ERISA and therefore do not apply to employer-sponsored health plans.

The lawsuit targets two major components of the Illinois law: expanded transparency requirements and restrictions on PBM pharmacy-network practices. The PDAA requires PBMs to disclose detailed information on drug pricing, rebates, pharmacy payments, and client contracts, while also prohibiting network designs that could steer patients toward pharmacies owned by PBMs. PCMA contends that these provisions would impose significant administrative burdens, expose confidential business information, and limit PBMs’ ability to manage costs and direct patients to lower-cost or higher-quality pharmacies.

For more information on the Illinois PBM law, access our prior Compliance Matters Alert from July 2025.

HIPAA Security Rule Update Delayed Until 2027

The U.S. Department of Health and Human Services (HHS) has delayed final action on its proposed overhaul of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule to July 2027 according to information posted on the Office of Management and Budget (OMB) website.

The proposed rules were released in December 2024 and formally issued in January 2025 and represent the most significant update to the Security Rule in more than a decade. The rules are intended to strengthen cybersecurity protections for electronic protected health information (ePHI) in response to escalating cyberattacks and ransomware threats. For more information on the proposed rules access our prior Alert released in February 2025.

If finalized as proposed, the rule would impose more prescriptive security requirements on covered entities and business associates, including mandatory encryption, multifactor authentication, network segmentation, annual penetration testing, enhanced risk analysis procedures, documented and regularly tested incident response plans, and greater oversight of vendor security controls. The proposal generated nearly 5,000 public comments and significant opposition from healthcare industry groups, which cited concerns about implementation costs and compliance timelines. While the Security Rule update has been delayed, HHS is continuing work on separate HIPAA Privacy Rule changes, currently expected in August, that would expand patient access to health information, improve care coordination, and reduce certain administrative burdens for covered entities.

Handling Employee Contributions During Unpaid Leaves of Absence

When a leave of absence is unpaid or not being paid through payroll (e.g. short-term disability (STD) or worker’s compensation), it is advisable to have a process for obtaining the employee contribution and to communicate that process accordingly.

An employer can generally offer the following options to an employee to collect employee contributions while the employee is on leave:

• Pre-pay on a pre-tax basis (this cannot be the sole option);
• Pay during the leave on an after-tax basis; or
• Catch-up contributions on a pre-tax basis upon return from leave.

In practice, pre-payment is often not feasible because employers may not have enough notice before the leave begins. As a result, some employers require employees to make payments while on leave to avoid collection issues later, particularly if the employee is on an extended leave of absence or ultimately does not return to work. Other employers allow employees to catch up on missed contributions upon return from leave, which may allow those contributions to be made on a pre-tax basis.

If the employer determines a policy and communicates it, and the employee fails to make the employee contribution in accordance with the employer’s policy, the employer may terminate coverage, in some cases even retrospectively subject to any carrier restrictions.

The Federal Family Medical Leave Act (FMLA) requires that coverage cannot be canceled for nonpayment of premium unless two conditions are met:

1. The employee must be allowed a 30-day grace period from the date the premium is due;
2. No later than 15 days before the employer intends to cancel the coverage for nonpayment.

If coverage is cancelled for nonpayment of premiums during FMLA leave, the coverage must be available for reinstatement when the employee returns to work. While the Consolidated Omnibus Budget Reconciliation Act (COBRA) is generally not available following termination of coverage due to nonpayment, if the employee does not return to work at the end of the FMLA leave, the employee must be offered COBRA due to reduction in hours, even if the coverage was cancelled for nonpayment of premium.

For non-FMLA leave, employers have more flexibility with payment policies. The employer should still clearly communicate payment expectations, including method, due dates, and any grace periods or notifications that will be made available, but the employer is not specifically required to provide a grace period or notification prior to termination of coverage. That being the case, many employers may choose to follow whatever payment procedures are put in place for FMLA-protected leave for consistency and ease of administration.

California Managed Care Organization Tax

As part of California’s state budget, Senate Bill 125 (SB125) Medi-Cal: managed care organization provider tax, was passed on June 29, 2026. SB125 proposes changes to California’s existing managed care organization (MCO) tax in order to comply with H.R. 1 and the final rule issued by the Centers for Medicare & Medicaid Services (CMS) in February 2026. The proposed changes must be approved by CMS. SB125 will not take effect until January 1, 2027, or the date approval is received by CMS.

It is the intent of the legislature to generate sufficient funds for the Medi-Cal Stability Fund which is used to pay California’s share of managed care rates and other Medi-Cal costs, and to minimize the need for any new reductions to the Medi-Cal program.

If approved, the MCO tax would be $8.85 per member per month enrolled in large group (100+) fully insured HMO plans. Some carriers are already including this cost in their 2027 rates and announcing adjustments for mid-year renewals that would also take effect in January. Small group plan rates will be updated as usual per the Department of Managed Health Care regulations.