Compliance Matters Newsletter | September 2025

Let our team help you navigate the ever-changing benefits compliance landscape each month. Check out this month’s latest alerts, additional updates, and resources hot off the press:

Employee Benefits Compliance Alerts

This month’s Compliance Matters newsletter provides a comprehensive review of the following topics. To obtain your copy, please use the form below to download.

• Compliance Considerations for Mid-Year Plan Termination
• Medicare Part D Notice Disclosure Requirements
• Employee Benefits Litigation Series: Employer Sued for Allegedly Offering Financially Dominated Plan
• 2025 State Regulation Series: Illinois Law Requires Coverage for Qualifying Parents
• 2025 State Regulation Series: Northern District of California Sutter Health Class Action Settlement

Additional Updates & Resources

DOL Releases Updated CHIP Notice

The Department of Labor’s (DOL) Employee Benefits Security Administration (EBSA) recently released an updated model notice that employers may use to provide information on premium assistance eligibility under Medicaid or the Children’s Health Insurance Program (CHIP). The updated notice is available in both English and Spanish.

The Children’s Health Insurance Program Reauthorization Act of 2009 (CHIPRA) requires employers who maintain group health plans in states that provide premium assistance under Medicaid or CHIP to annually notify all employees of potential premium assistance opportunities in the state where an employee lives. To assist employers with their disclosure obligations, EBSA developed a model notice for employers to use. The model notice includes contact information for states that provide Medicaid or CHIP premium assistance programs. EBSA customarily releases updated versions of the model notice twice a year – at the end of January and July – to account for recent changes to the contact information related to various state Medicaid or CHIP programs.

Employers may distribute the model notice annually with their health plan Summary Plan Description (SPD) or open enrollment materials, so long as the materials are provided to all employees and are provided in compliance with the DOL’s document distribution rules. The technical regulations require the notice to be separate from other plan materials so that it is easily distinguishable, and the importance of the notice is clear.

Reminder! Summary Annual Reports for Calendar Year Plans Due Soon

Group health plans with at least 100 plan participants at the beginning of a plan year are required to furnish a Summary Annual Report (SAR) to each health plan participant. The SAR is a summary of the information reported in the Form 5500, which is due annually at the end of the seventh month after the end of a plan year, which is July 31 for calendar year plans. The SAR must be furnished within nine months following the end of the plan year. Plans with a calendar plan year that filed Form 5500 for the 2024 plan year by July 31, 2025, must furnish the SAR by September 30, 2025. Plans that filed a Form 5500 extension will have additional time to provide the SAR. For calendar year plans that filed a Form 5500 extension in 2025 for the 2024 plan year, the SAR deadline will be December 15, 2025.

Non-Enforcement of STLDI Violations Announced

On August 7, 2025, the Department of Labor (DOL), the Department of Health and Human Services (HHS), and the Treasury Department, collectively referred to as “the Departments,” released a statement regarding short-term, limited-duration insurance (STLDI). The statement says that, consistent with Executive Order (EO) 14219, titled “Ensuring Lawful Governance and Implementing the President’s ‘Department of Government Efficiency’ Deregulatory Initiative,” the Departments will review and consider amendment of the final rules for “Short-Term, Limited-Duration Insurance and Independent, Noncoordinated Excepted Benefits Coverage” released in April 2024. For more information on the final rules access our prior Alert from May 2024.

The Departments state that until future rulemaking is issued and applicable, they do not intend to prioritize enforcement actions for violations related to the 2024 final rules and encourage States to adopt a similar approach to enforcement.

OCR Releases Updated HIPAA Privacy FAQs

On July 30, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), issued an updated set of frequently asked questions (FAQs) about the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. OCR is the agency that enforces HIPAA. The HIPAA Privacy Rule establishes national standards to protect individually identifiable health information, sets limits and conditions on the uses and disclosures of protected health information (PHI), and gives individuals certain rights, including the right to timely access to health records and the right to obtain a copy of their health records.

The updated HIPAA FAQs address how covered health care providers are permitted to disclose PHI to value-based care arrangements for treatment purposes, and what health information is included in a designated record set and thus subject to the individual’s right to access such information

New and Updated FAQs:

• New. Does the HIPAA Privacy Rule permit a covered health care provider to disclose protected health information to value-based care arrangements, such as accountable care organizations, for treatment purposes without the individual’s authorization?
• Updated. What personal health information do individuals have a right under HIPAA to access from their health care providers and health plans?

2026 Health Care Security Ordinance Expenditures Announced

In August 2023, the San Francisco Office of Labor Standards Enforcement (OLSE) updated the health care expenditure (HCE) rates used to determine the health care security ordinance (HCSO) expenditure requirement for 2026. As of January 1, 2026, the required HCE amount to satisfy the HCSO expenditure requirement for large businesses (those with 100 or greater workers) will be $4.11 per payable hour on behalf of all covered employees, an increase from the 2025 rate of $3.85 per employee per hour. For medium-sized businesses (those with 20 to 99 workers), the HCE will be $2.74 per payable hour on behalf of all covered employees, an increase from the 2025 rate of $2.56 per employee per hour. Employers with less than 20 employees are exempt from the HCSO expenditure requirement. The 2026 exemption threshold for managerial, supervisorial, or confidential workers will be $128,861 annually (or $61.95 hourly).

For more information on the HCSO, access our prior alerts from April 2025 and February 2025.

Updates to 2026 San Francisco HCAO

In August, the San Francisco Office of Labor Standards Enforcement (OLSE) released updated minimum standards for the Health Care Accountability Ordinance, effective January 1, 2026. The San Francisco HCAO applies to most City contractors and tenants (including those at the San Francisco International Airport and the Port of San Francisco). It requires employers to offer a compliant health plan to their covered employees, to make payments to the City for use by the Department of Public Health, or, under limited circumstances, to make payments directly to their covered employees. Employers who choose to comply with the HCAO by offering a compliant health plan must meet all of the HCAO Minimum Standards. The minimum standards can be found on the OLSE website.

There are no changes to the requirements of the Healthy Airport Ordinance (HAO) for 2026. Questions about complying with the Health Care Accountability Ordinance (HCAO) can be directed to 415-554-7903 or . For more information about the HCAO, please visit the HCAO web page.

Arkansas PBM Law on Hold

On July 28, 2025, Brian Miller, federal judge for the United States District Court for the Eastern District of Arkansas Central Division (“the Court”), temporarily blocked an Arkansas law set to go into effect January 1, 2026 that would have prohibited pharmacy benefit managers (PBMs) from owning pharmacies in the state. For more information access our prior Alerts from June 2025 and July 2025.

Arkansas HB 1150, also known as Act 624, prohibits the Arkansas State Pharmacy Board (ASPB) from issuing new licenses to and requires the ASPB to revoke or decline to renew any licenses issued to retail, mail order or specialty pharmacies that are owned (directly or indirectly) by a PBM. In response to the law, PBMs such as CVS Caremark and Express Scripts, and the Pharmaceutical Care Management Association (PCMA) filed lawsuits alleging that the law, amongst other things, violates:

• the Commerce Clause
• the Supremacy Clause because the law is preempted by:
  • TRICARE (which provides health insurance plans to uniformed service members),
  • the Employee Retirement Income Security Act (ERISA)
  • Medicare
• the Equal Protection Clause.

Judge Miller granted the order, stating that the Plaintiffs would likely prevail on the merits of their Commerce Clause argument, stating:

“Act 624 appears to overtly discriminate against plaintiffs as out of state companies and the state has failed to show that it has no other means to advance its interests. This is true because section one of Act 624 specifically states that its purpose is to eliminate plaintiffs’ “business tactics that have driven locally-operated pharmacies out of business.”

EPIC is continuing to monitor developments with this lawsuit and legislation and will continue to provide updates as they become available.

Monthly FAQ: Can an HSA-eligible individual roll over funds from an individual retirement account (IRA) to a health savings account (HSA)?

Yes. An HSA-eligible individual may make a once-in-a-lifetime, irrevocable, tax-free, direct trustee-to-trustee transfer of a qualified HSA funding distribution from a traditional IRA or Roth IRA into an HSA.

The funding distribution must be made from an IRA to an HSA by the individual for whom the IRA is maintained. The amounts transferred are not included in an individual’s gross income. Qualified HSA funding distributions are counted as contributions applied to the Internal Revenue Service (IRS) HSA contribution limit and catch-up contribution limit for the taxable year in which they are contributed to the HSA and relate to the taxable year in which the distribution is actually made.