Compliance Matters Newsletter | March 2026

Let our team help you navigate the ever-changing benefits compliance landscape each month. Check out this month’s latest alerts, additional updates, and resources hot off the press:

Employee Benefits Compliance Alerts

This month’s Compliance Matters newsletter provides a comprehensive review of the following topics. To obtain your copy, please use the form below to download.

• DOL Releases Proposed PBM Fee Disclosure Rules
• Congress Passes Sweeping PBM Reform
• Trump Releases the Great Healthcare Plan
• ESI & FTC Settlement: Considerations for Plan Sponsors
• State Series: State Mandated Disability and Leave Updates

Additional Updates & Resources

Pharmaceutical Recovery Opportunities with EPIC Partner MCAG

In light of the increase in litigation against pharmaceutical manufacturers, EPIC has partnered with Managed Care Advisory Group (MCAG), an experienced class action settlement recovery consulting company, to assist our clients in researching potential opportunities to join class action lawsuits against pharmaceutical drug manufacturers. These class actions commonly develop as a result of anti-competitive practices undertaken by the drug manufacturers, and the intent is to recover funds for employer health plans that overpaid for drugs purchased on behalf of their employees due to artificially inflated and/or stabilized prices. There are typically several active lawsuits and/or class action settlements that fall into the category of “pharmaceutical benefit plan settlements” being litigated at any given time. While the number of these opportunities in any given year varies, there can be several ongoing at the same time.

MCAG researches potential class action opportunities for employers. Then, they help employers complete the necessary paperwork and become a class representative for what will ultimately become a class action settlement. Plan sponsors that act as class representatives can receive more money than they would from participating in a general settlement, but there is also more work because, in those cases, the plan would be suing the defendants directly. MCAG takes on most of that work for the employer. For more information about available opportunities, reach out to your EPIC representative and schedule a call with MCAG.

TrumpRx is Now Operational

On February 5, 2026, President Trump announced the launch of TrumpRx.com, a direct-to-consumer website where consumers can purchase (at the time of launch) 40 prescription drugs at costs lower than previous list prices. There are still many unanswered questions about TrumpRx such as how this will affect employer-sponsored plans. TrumpRx is not insurance and does not work with insurance. It is a direct-to-consumer program that bypasses employer sponsored plans. With the launch, the White House released this Fact Sheet on TrumpRx. For more information on TrumpRx access our prior Compliance Matters Alert released in December 2025.

CMS Releases 2027 Payment Parameters

In a notice released on January 29, 2026, the Centers for Medicare and Medicaid Services (CMS) released updated premium adjustment percentages, and out-of-pocket maximum limits for plans covered by the Affordable Care Act (ACA) for plan years starting in 2027.

For non-grandfathered group health plans starting in 2027, the annual maximum limit on cost-sharing will increase to $12,000 for self-only coverage and $24,000 for other than self-only coverage (the 2026 limits are $10,600 and $21,200) Generally speaking, the annual limit on cost-sharing includes deductibles, coinsurance, copayments, and any other required expenditure that is a qualified medical expense with respect to essential health benefits (EHBs) covered under the plan. Plan sponsors should take note of these changes for any increases to 2027 plans.

Updated HIPAA, MSP and SBC Penalties for Non-Compliance

The Department of Health & Human Services (HHS) announced updated penalty amounts for the Health Insurance Portability and Accountability Act (HIPAA), Medicare Secondary Payer (MSP), and summary of benefits and coverage (SBC) violations.

• For HIPAA privacy and security non-compliance, the updated penalties range from $145 for lack of knowledge to $2,190,294 for willful neglect.
• For non-compliance with MSP rules, including taking into account Medicare eligibility or incenting individuals to waive the employer’s plan in favor of Medicare, the updated penalty is $11,823.
• For failure to timely distribute an SBC, the updated penalty is $1,443.

DOL Releases Updated CHIP Notice

The Department of Labor’s (DOL) Employee Benefits Security Administration (EBSA) recently released the updated model notice that employers may use to provide information on premium assistance eligibility under Medicaid or the Children’s Health Insurance Program (CHIP). The updated notices were released on February 4, 2026, a few days later than normal due to the government shutdown. The updated notice is available in both English and Spanish.

The Children’s Health Insurance Program Reauthorization Act of 2009 (CHIPRA) requires employers who maintain group health plans in states that provide premium assistance under Medicaid or CHIP to annually notify all employees of potential premium assistance opportunities in the state where an employee lives. To assist employers with their disclosure obligations, EBSA developed a model notice for employers to use. The model notice includes contact information for states that provide Medicaid or CHIP premium assistance programs. EBSA customarily releases updated versions of the model notice twice a year – at the end of January and July – to account for recent changes to the contact information related to various state Medicaid or CHIP programs.

Employers may distribute the model notice annually with their health plan Summary Plan Description (SPD) or open enrollment materials, so long as the materials are provided to all employees and are provided in compliance with the DOL’s document distribution rules.

The technical regulations require the notice to be separate from other plan materials so that it is easily distinguishable, and the importance of the notice is clear.

EBSA Announces 2026 Enforcement Priorities

The U.S. Department of Labor’s Employee Benefits Security Administration (EBSA) announced its national enforcement priorities for fiscal year 2026, focusing on issues that pose the greatest risk to plan participants and beneficiaries. Specific to health and welfare benefit plans, investigations will prioritize cybersecurity, access to mental health and substance use disorder benefits, surprise medical billing, and handling of employee contributions. EBSA also signaled a continued commitment to addressing abusive Multiple Employer Welfare Arrangements (MEWAs). US Department of Labor’s Employee Benefits Security Administration updates national enforcement projects for employee benefit plans | U.S. Department of Labor

DOL Announces Delinquent Filer Program for MEWAs

In a notice published in the Federal Register on December 31, 2025, the Department of Labor (DOL) announced that it has expanded the Delinquent Filer Voluntary Compliance Program (DFVCP) to include M-1 reporting for multiple employer welfare arrangements (MEWAs). Plan sponsors administering MEWAs are required to file the M-1 form annually and penalties for failure to file can be significant.

Under the new DFVCP, delinquent MEWA administrators may file a voluntary correction under certain conditions. The administrator must not have already been notified of their delinquency in writing by the DOL. The voluntary correction must be filed online on the DOL website. Using the DFVCP, the penalties for the delinquent M-1 will be $750 per MEWA.

HHS Provides Update HIPAA Model Notice Days Before Deadline

On Friday, February 13, 2026, the Department of Health and Human Services (HHS) published a revised version of its HIPAA Notice of Privacy Practices. This notice includes required updates for substance use disorder information and had a required redistribution deadline of February 16, 2026.

The updated model notice was released in three different formats:

• for federally subsidized drug treatment centers
• for other health care providers
• for health plans

Plan sponsors are not required to redistribute the HHS version of the notice if they already distributed an updated version prior to the February 16, 2026, deadline. For more information on the updated HIPAA model notice and the distribution rules access our prior Alert from February 2026.

Challenge of CA’s PBM Fiduciary Law

A national pharmacy benefit manager (PBM) trade group has filed a federal lawsuit seeking to block California’s new oversight law that would impose fiduciary duties and reporting requirements on PBMs, including those serving self-funded employer health plans. The suit is one of several recent challenges to state-level PBM regulation, with PBMs arguing that the Employee Retirement Income Security Act (ERISA) preempts state laws affecting self-funded plans. California’s law is intended to increase PBM transparency and align PBM conduct with plan sponsors’ interests, particularly around drug pricing. How the court rules on ERISA preemption will be closely watched, as courts in other PBM cases have reached differing conclusions on similar issues.