Compliance Matters Newsletter | June 2026

Let our team help you navigate the ever-changing benefits compliance landscape each month. Check out this month’s latest alerts, additional updates, and resources hot off the press:

Employee Benefits Compliance Alerts

This month’s Compliance Matters newsletter provides a comprehensive review of the following topics. To obtain your copy, please use the form below to download.

• Compliance Considerations for Reference Based Pricing and NSA
• IRS Updates FAQs on Employer Educational Assistance Programs
• Departments Release Proposed Rules for Excepted Fertility Benefits
• Medicare Part D Creditable Coverage Updates
• Owner’s Benefits – Eligibility & Taxation
• State Series: Tennessee FAIR Rx Act is Reshaping the Industry

Additional Updates & Resources

Reminder! PCORI Due July 31

Employers who sponsored self-funded medical plans that ended sometime during 2025 are required to report and pay the Affordable Care Act (ACA) Patient-Centered Outcomes Research Institute (PCORI) fees no later than July 31, 2026. Fully insured plan sponsors can rely on their carriers to submit the fee on their behalf, but fully insured plan sponsors that sponsor a self-funded plan component, such as a health reimbursement arrangement (HRA), will need to file and pay for the self-funded component plan.

Payment amounts due in 2026 will differ based on the employer’s plan year. The Internal Revenue Service (IRS) provides a chart showing applicable fee amounts depending on the plan’s year-end date. The fees due in July 2026 are as follows:

• $3.47 per covered life for plan years ending after September 30, 2024, and before October 1, 2025
• $3.84 per covered life for plan years ending after September 30, 2025, and before October 1, 2026

Self-funded plans may use one of three methods to determine the average covered lives used for reporting and paying the PCORI fee: (i) the actual count method; (ii) the snapshot method; or (iii) the Form 5500 method. There are special counting rules that apply to employers offering multiple self-funded plans or an HRA integrated with a fully insured plan. The PCORI fee count and payment are submitted using the IRS Form 720.

IRS Updates Employer Mandate Penalties

Internal Revenue Service (IRS) Revenue Procedure 2026-22 updates the inflation-adjusted penalty amounts used to calculate employer shared responsibility payments (ESRPs) under the Affordable Care Act’s employer mandate provisions. For 2027, the IRS increased the annual penalty amounts to $3,780 ($3,340 in 2026) and $5,670 ($5,010 in 2026), based on healthcare premium growth data published by the Department of Health and Human Services. The adjustment is calculated using the “premium adjustment percentage,” which compares projected 2026 private health insurance premiums to 2013 baseline premiums.

Reminder! Form 5500 Due July 31 for Calendar Year Plans

Employee health and welfare plan administrators with at least 100 participants must file an Internal Revenue Service (IRS) Form 5500 each year by the last day of the seventh month after the end of the plan year, which means plan sponsors with calendar year plans must file annually by July 31.

Plan sponsors may file an automatic extension, which delays the annual filing deadline for calendar year plans to October 15. For a list of Form 5500 frequently asked questions (FAQs) see our prior alert from July 2024.

BCBS Settlement Payments are Starting

The $2.67 billion Blue Cross Blue Shield (BCBS) Class Action Settlement includes funds for both individuals and employer groups. Payments began rolling out to valid claimants in May 2026. The exact distribution timeline depends on individual claim numbers and batches.

For payout distribution, the settlement is divided into two separate funds based on the type of employer coverage:

• Individuals and Fully Insured Groups: A $1.78 billion fund is allocated for individuals, fully insured employer groups, and their employees.
• Self-Funded Groups: A $120 million fund is specifically allocated for self-funded accounts and their employees.

The funds are distributed independently, meaning the size of one fund does not impact the payout of the other; exact payment dates vary. A claimant can verify the progress of their payment directly on the official Blue Cross Blue Shield Settlement portal or review additional timeline details in the Blue Cross Blue Shield Settlement FAQs.

Payouts vary widely depending on factors like the length of coverage and total premiums paid. While average estimates were originally projected around $300, actual payouts reflect individual premium sizes, ranging from under $1,000 to substantially larger amounts for those who paid high premiums. To receive a payout, you had to be covered by an eligible BCBS plan between February 2008 and October 2020 and have filed a claim by the November 2021 deadline. New claims are no longer accepted. For more information, access our prior Alerts released in May 2021 and December 2023.

If a claimant would like to look up their specific claim status or check if their payment has been processed, they can visit the official Blue Cross Blue Shield Settlement site and log in with their Claim Number or Unique ID.

EBSA Enforcement Priorities Updated

The Department of Labor’s Employee Benefits Security Administration (EBSA) issued Field Assistance Bulletin 2026-01 in April to redefine its enforcement priorities and reduce what it views as “regulation by enforcement.” The guidance emphasizes focusing investigations on the most egregious misconduct and loyalty breaches, such as self-dealing or misuse of plan assets, rather than second-guessing fiduciaries’ good-faith prudence decisions. It also requires greater oversight by senior agency leadership for significant enforcement actions and aims to make investigations more timely, transparent, and consistent. The bulletin reflects a major philosophical shift in EBSA’s relationship with plan sponsors, fiduciaries, and service providers, particularly in areas like employee stock ownership plan (ESOP) valuations and missing participant investigations. The long-term impact will depend on how consistently the new principles are implemented across regional offices.

HIPAA Enforcement Action

Federal regulators recently penalized a self-funded employer health plan following a ransomware attack that exposed sensitive personal and health-related information. The enforcement action resulted in a $245,000 payment to the government along with a two-year corrective action plan requiring ongoing oversight and remediation efforts. The central issue was the plan’s failure to conduct a thorough and documented risk analysis, which is a foundational requirement under the Health Insurance Portability and Accountability Act’s (HIPAA) Security Rule.

Regulators emphasized that organizations must identify where protected health information (PHI) is stored, assess vulnerabilities, and maintain clear documentation of their security evaluations. Lapses in these areas, particularly failing to analyze risks to electronic PHI, continue to be a common basis for enforcement actions, reinforcing the need for strong cybersecurity, formal risk analysis processes, and ongoing data governance practices.