On July 23, the Department of Labor (DOL) published proposed regulations that would significantly expand when ERISA-covered group health plans may furnish required disclosures electronically. The proposal would permit plans to use a “notice-and-access” approach similar to the framework available to retirement plans since 2020. For most participants and beneficiaries, electronic delivery would no longer depend on affirmative consent or on whether the individual is “wired at work,” provided the plan satisfies the conditions of the new safe harbor.

As with the 2020 retirement plan rules, the proposal does not impose new disclosure obligations and does not preclude plans from using their current disclosure processes. Rather, the proposed regulations establish an additional method for satisfying existing ERISA disclosure requirements electronically. Plan administrators would remain free to furnish disclosures on paper or to continue relying on the existing 2002 electronic disclosure safe harbor. 

The proposed regulations have received a positive response from employers and industry groups and are projected to save plans approximately $400 million per year. In other words, we anticipate that these proposed regulations will (in some form) ultimately be approved.

Evolution of the DOL’s Electronic Disclosure Rules

The proposed regulations build upon two earlier DOL electronic disclosure safe harbors.

In 2002, the Department adopted an electronic disclosure safe harbor applicable to all ERISA employee benefit plans. Under that safe harbor, electronic delivery is permitted for participants who have effective access to the employer’s electronic information system as an integral part of their job responsibilities (employees who are “wired at work”) or for participants and beneficiaries who affirmatively consent to electronic delivery after receiving prescribed disclosures describing the scope of the consent, hardware and software requirements, withdrawal rights, and the availability of paper copies. 

In 2020, the Department adopted a second electronic disclosure safe harbor applicable only to retirement plans. The 2020 regulations established a notice-and-access framework under which: (i) the employer, plan sponsor, or administrator obtains an electronic address from the individual or assigns an employment-related electronic address; (ii) the administrator furnishes an initial paper notice explaining that covered documents will be provided electronically, identifying the electronic address that will be used, and describing the individual’s rights to request paper copies or opt out of electronic delivery; and (iii) covered disclosures may thereafter be posted on a website, with participants receiving a Notice of Internet Availability (NOIA) directing them to the document.

The 2020 regulations also contain detailed requirements governing electronic addresses, website accessibility, document retention, the content and timing of NOIAs, treatment of invalid electronic addresses and terminated employees, and participants’ continuing rights to receive paper copies or opt out of electronic delivery. 

The 2020 safe harbor, however, applied only to retirement plans. Group health plans generally have continued to rely on the 2002 rules. The Department’s new proposal would extend a modified notice-and-access framework to ERISA-covered group health plans while retaining the 2002 safe harbor as an available alternative. 

How the Proposed Safe Harbor Works

Like the 2020 pension regulations, the proposal is built around a notice-and-access model. Rather than furnishing lengthy disclosure documents directly, the plan administrator generally would:

• post the required disclosure on a website or other internet location that satisfies the proposal’s accessibility and confidentiality requirements; 
• furnish a Notice of Internet Availability (NOIA) to the participant’s electronic address; and 
• maintain the document online for the period required by the regulations. 

The NOIA itself is delivered electronically. It may be sent to the covered individual’s email address or, if the individual is capable of receiving text messages, to the individual’s smartphone number. The NOIA must include a prominent statement that important plan information is available, identify or briefly describe the document, provide a website address or hyperlink that gives ready access to the document, explain the participant’s right to request a paper copy free of charge and to opt out of electronic delivery, and provide contact information for the plan administrator. Except for limited situations involving combined annual notices, a separate NOIA generally must accompany each covered document. 

Which Individuals May Receive Electronic Disclosures?

One of the proposal’s principal changes included in the 2020 regulations—and repeated in the new proposed regulations–concerns how a plan determines whether it may rely on electronic delivery. Under the 2002 safe harbor, eligibility for electronic disclosure often depended upon whether an employee’s duties required effective access to the employer’s electronic information system or whether the individual had affirmatively consented to electronic delivery.

The proposed regulations instead focus on whether the plan administrator has a valid electronic address for the individual. A “covered individual” generally includes any participant, beneficiary, or other person entitled to receive ERISA disclosures who has provided an electronic address to the employer, plan sponsor, or administrator. The electronic address may consist of an email address or a smartphone number capable of receiving text messages. In addition, an employer-assigned email address provided for employment purposes satisfies the requirement. Adult dependent beneficiaries who are at least age 18 may receive disclosures using their own electronic addresses. 

Accordingly, unlike the 2002 safe harbor, the proposal generally does not require the administrator to determine whether an employee regularly uses the employer’s electronic systems as part of the employee’s job responsibilities or wait for the employee to provide an email address. Instead, the proposal generally permits the administrator to rely on electronic delivery when it possesses a valid electronic address through which the individual can receive the NOIA, without separately determining whether the individual regularly uses the employer’s electronic systems or has internet access as part of the individual’s job.

However, administrators remain responsible for monitoring whether electronic communications are successfully delivered. If a NOIA is returned as undeliverable or the administrator otherwise becomes aware that an electronic address is invalid, the administrator generally must take reasonable steps to obtain a valid replacement electronic address or resume furnishing required disclosures on paper until a valid electronic address becomes available.

The proposal applies broadly to documents that an ERISA group health plan administrator is required to furnish under Title I of ERISA, including both documents furnished automatically and documents furnished only upon participant request. 

Depending on the legal source of the particular disclosure requirement, covered documents may include SPDs, SMMs, SARs, COBRA notices, certain health-plan notices required under ERISA and related federal health-benefit provisions, and documents that ERISA requires to be furnished upon request. The inclusion of documents furnished upon request represents another expansion beyond the 2020 pension safe harbor. 

Although the proposal closely tracks the 2020 retirement-plan safe harbor, several provisions were modified to reflect the unique characteristics of group health plans.

Key Differences from the Pension Safe Harbor

Although modeled after the 2020 pension regulations, the proposal differs in several important respects.

No direct email delivery. Unlike the pension safe harbor, the proposal does not permit administrators simply to email required disclosures directly to participants. Instead, the proposal relies exclusively on the notice-and-access model. The Department declined to authorize direct email delivery because at least some health-plan disclosures may contain PHI or other sensitive personal information, and a single safe harbor permitting direct transmission of all covered documents could create privacy concerns.

Documents furnished upon request are included. Unlike the pension safe harbor, the proposal applies to documents that ERISA requires administrators to furnish only after a participant requests them. 

Separate treatment of adult dependent beneficiaries. Adult dependent children may receive required disclosures using their own electronic addresses, recognizing that they often manage their own health care decisions. 

Participant Protections Remain Central

Consistent with the Department’s earlier electronic disclosure regulations, participant protections remain a central feature of the proposal. Participants retain the right to request paper copies of any covered document free of charge, opt out of electronic delivery entirely, receive NOIAs written in a manner calculated to be understood by the average participant, and access documents through searchable, printable electronic formats on websites designed to protect confidentiality. 

The proposal also permits administrators to furnish combined annual NOIAs during annual enrollment, reducing the number of separate electronic communications participants receive while preserving timely access to required disclosures. 

Administrative Impact

According to the Department’s Regulatory Impact Analysis, the proposal would reduce printing and mailing expenses by approximately $400 million annually, representing nearly a 70 percent reduction in disclosure-related administrative costs. The Office of Management and Budget has designated the proposal as an economically significant rulemaking. 

Issues to Watch

Several aspects of the proposal warrant particular attention during the comment period.

First, the Department’s decision not to permit direct email delivery marks one of the proposal’s most significant departures from the pension safe harbor. Commenters may urge the Department to permit direct email delivery for categories of disclosures that ordinarily do not contain protected health information.

Second, although the proposal recognizes the need to protect health information, it provides only limited discussion regarding the interaction between ERISA’s electronic disclosure requirements and HIPAA’s privacy and security rules. Additional guidance in this area may prove beneficial.

Finally, insurers, third-party administrators, and benefits technology vendors will need to evaluate whether their existing platforms satisfy the proposal’s notice, website, retention, confidentiality, and failed-delivery requirements. Plan sponsors should anticipate coordinating implementation responsibilities with their service providers before relying on the new safe harbor.

Conclusion

The proposal would give group health plans a considerably broader electronic-disclosure option without eliminating paper delivery or the 2002 safe harbor. It also reflects a different approach to determining when electronic delivery is appropriate: rather than requiring proof that an employee is “wired at work” or has affirmatively consented, the proposal generally permits reliance on a valid electronic address, subject to initial notice, failed-delivery, paper-copy, and opt-out protections.

For many employers, implementation therefore should turn on maintaining accurate electronic addresses, furnishing the required notices, monitoring unsuccessful deliveries, and coordinating website and privacy requirements with insurers and administrators. The proposal offers potentially significant administrative savings while preserving participant protections. If finalized substantially as proposed, it should become the preferred electronic-disclosure method for many large employer-sponsored group health plans.