New Changes to Health Plan Compliance in 2025

As 2025 begins, we wanted to highlight several important changes that will impact employer-sponsored group health plans:

Paperwork Burden Protection and Employer Reporting Improvement Acts Ease Administrative Burdens for ACA Reporting

On December 23, 2024, the Paperwork Burden Protection Act and the Employer Reporting Improvement Act  (the Acts) became law. The Acts modify the reporting and enforcement requirements under the Affordable Care Act (the ACA), including the requirement for furnishing Forms 1095-C (for applicable large employers sponsoring self-funded health plans) or 1095-B (for insurance companies who offer fully insured health coverage) to full-time employees and other covered employees and providing new relief for reporting and enforcement in general.  The Acts are effective for calendar year 2024 forms filed in 2025.

Under the Acts:

• An employer will no longer be required to automatically distribute individual Forms 1095-C or 1095-B to employees or covered individuals if the employer provides a “clear, conspicuous and accessible notice” that the form will be provided upon request.
• If requested, the form must be provided to the employee or covered individual by the later of (i) January 31 of the year following the calendar year for which the form is requested, or (ii) 30 days after the request. For calendar year 2024, the January 31 deadline is extended to March 3, 2025.
• The form can be provided electronically if the individual requesting the form consents to receive it electronically.
• The deadline for large employers to respond to an Internal Revenue Service (IRS) Employer Shared Responsibility Payment (ESRP) letter is extended from 30 to 90 days effective for assessments proposed in taxable years beginning in 2025.
• A six-year statute of limitations was established for ESRP assessments relating to Forms 1095-C due after December 31, 2024 (i.e., for 2024 Forms 1094/1095 filed in 2025). Previously, the IRS’s position was that no statute of limitations applied for employer mandate penalties.

Please note that although the forms are no longer required to be automatically distributed to individuals, they must still be filed with the IRS. For 2025, the deadline to electronically file Forms 1094/1095 with the IRS is March 31, 2025, to avoid penalties for failure to file (currently up to $330 per late/incorrect form). In addition, this federal relief does not extend to distribution requirements in states with individual health insurance mandates. We anticipate that the IRS will issue guidance on compliance with the Acts in the coming weeks and will provide additional analysis at that time.

Telehealth Safe Harbor for High-Deductible Health Plans Ended December 31, 2024

The American Relief Act, 2025 (ARA), which funds the federal government until March 14, 2025, was signed into law at the end of 2024. The ARA did NOT extend the popular telehealth safe harbor for high-deductible health plans (HDHPs). The telehealth safe harbor was originally part of the CARES Act that amended the Health Savings Account (HSA) rules to permit HDHPs with HSAs to provide participants with free or low-cost coverage for telehealth services prior to meeting the plan deductible. The telehealth safe harbor has been extended twice since the CARES Act, with the last extension ending December 31, 2024.

For plan years beginning on or after January 1, 2025, HDHPs will no longer be able to provide free or low-cost telemedicine services to participants who have not met the plan deductible. Plan sponsors should work with their insurer or third-party administrator to ensure that their HDHP plan design complies with current HSA eligibility rules and that any required plan design changes are communicated to participants in a timely manner.

Fiduciary Certification under MHPAEA Due January 1, 2025 (For Calendar Year Plans)

As part of the Mental Health Parity and Addiction Equity Act (MHPAEA) Final Rule released in 2024, one or more of an ERISA plan’s fiduciaries must certify that they have “engaged in a prudent process to select one or more qualified service providers” to prepare the Non-Quantitative Treatment Limitations (NQTL) comparative analysis. The Final Rule, which is discussed in more detail here, walked back the requirement in the proposed rule that plan fiduciaries certify compliance with the NQTL comparative analysis requirements. Instead, the Final Rule requires fiduciaries to certify that they have engaged in a prudent process, including the selection and monitoring of any vendor who helped the NQTL comparative analysis. The effective date for the fiduciary certification requirement is January 1, 2025, for calendar year plans, or the first day of the plan year beginning on or after January 1, 2025, for non-calendar year plans.

HIPAA Policies and Procedures and Business Associate Updates to Comply with Final HIPAA Rule

In April 2024, the Office for Civil Rights at the U.S. Department of Health and Human Services (HHS) amended the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the Final HIPAA Rule). The Final HIPAA Rule limits the use and disclosure of Protected Health Information (as defined by HIPAA) related to lawful reproductive health care and requires a written attestation for certain uses or disclosures. HIPAA-covered entities and business associates were required to comply with the Final HIPAA Rule by December 23, 2024 (with the exception of the required changes to the HIPAA Privacy Notice which will not be effective until February 16, 2026). HIPAA-covered health plans should ensure that their HIPAA policies and procedures manuals are updated. They should also review their business associate agreements and request necessary revisions to comply with the Final HIPAA Rule.

There continue to be legal challenges to the Final HIPAA Rule. On December 22, 2024, the U.S. District Court for the Northern District of Texas issued a preliminary injunction in favor of the plaintiffs who were challenging enforcement of the Final HIPAA Rule in the case of Purl vs. HHS. We will continue to provide updates on legal challenges to the Final HIPAA Rule; however, at the time of this alert, it continues to be in effect for group health plans not subject to the injunction.

Proposed Regulations Modifying the HIPAA Security Rule

HHS released a proposed rule on December 27, 2024, that would modify the HIPAA Security Rule to strengthen cybersecurity protections for electronic protected health information. HHS has indicated that comments are due on the proposed rule by March 7, 2025.

WINSTON TAKEAWAY

For assistance in complying with these new group health plan requirements, please contact a member of the Winston & Strawn Employee Benefits and Executive Compensation Practice Group or your Winston relationship attorney.

Paralegal Kristine Lofquist also contributed to this blog post.