Compliance in Motion – July 2026

Download the PDF version here!

Listen to the audio version here!

Get a quick video preview here! 

2027 HSA, HDHP, DPC, and EBHRA Limits Announced

In Revenue Procedure 2026-24, the IRS announced cost-of-living adjustments for Health Savings Accounts (HSAs), High-Deductible Health Plans (HDHPs), and the limits for Direct Primary Care (DPCs) service arrangements to be HSA-compatible for 2027. This annual indexing also includes updated figures for Excepted Benefit Health Reimbursement Arrangements (EBHRAs).

• The maximum monthly DPC aggregate fees remain unchanged from 2026 ($150 per month single, $300 family).
• The minimum HDHP deductibles increase by $50 for single coverage (to $1,750) and by $100 for family coverage (to $3,500). If there is an embedded per-person deductible in a tier covering dependents, that embedded deductible must be at least $3,500 for plan years starting in 2027.
• The 2027 calendar year HSA contributions limits are $4,500 single, $9,000 family.
• EBHRAs are once again increasing $50, making the 2027 limit $2,250.

Applies To: Employers sponsoring an HDHP/ HSA, DPC or EBHRA.

Go Deeper:

See a table of the indexed limits in our May Alert, 2027 HSA, HDHP, Excepted Benefit HRA and DPCSA Limits Announced. 

Another Employer Pays $450K for HIPAA Violations

On the heels of a large employer assessed $245,000 in April for not complying with HIPAA’s privacy and security requirements, another large employer faces a $450,000 settlement in June for the same violations. In both cases:

• The employer failed to complete a risk analysis, develop policies and procedures, or monitor systems involving Protected Health Information (PHI);
• The employer’s network server had PHI from the plan (which should not be the case unless encrypted and truly needed); and
• A ransomware attack led to unauthorized access to the unsecure PHI, resulting in a reportable breach resulting in an investigation showing the plan sponsor failed to comply with HIPAA.

Employers subject to HIPAA’s privacy and security requirements are strongly encouraged to partner with a HIPAA specialist to ensure they are in compliance. Deidentified data should be enough; in most cases, to operate and oversee the plan. In the rare case PHI is needed, it should be encrypted in a system that is actively monitored for threats and then permanently destroyed from the employer’s system when the tasks needing the PHI are completed.

Applies To: Employers sponsoring a level-funded or self-funded group health plan to include medical, dental, vision, Health Reimbursement Arrangement (HRA), health Flexible Spending Account (FSA), and employers with access to claims analytics data feeds for their fully insured plan.

Go Deeper:

If you are subject to HIPAA privacy and security and want to learn more about how to comply, review our primer HIPAA Privacy and Security Basics.

Trump Account Contributions Can Start July 4, Still Awaiting Guidance

Guidance on Trump Accounts continues to emerge, clarifying some issues while leaving others unresolved. As background, the One, Big, Beautiful Bill Act (OBBBA), signed into law in July of 2025, created a new type of youth IRA called a “Trump Account” for children not yet age 18 on the last day of the calendar year. Newly created Internal Revenue Code (IRC) section 530A subjects these youth IRAs to a host of special rules during their growth period, after which the account essentially is treated as a traditional IRA beginning January 1 of the year in which the child turns 18.

Importantly for employers, the same law also added IRC §128, which permits up to $2,500 per employee (not per dependent) per year in tax‑favored Trump Account contributions, which can be funded by the employer and/or by the employee via §125 salary reduction. Because each Trump Account has a $5,000 annual contribution limit during the growth period, no more than $2,500 of that $5,000 can be from §128 and related contributions (both the $2,500 and $5,000 figures will index).

Although IRS Notice 2025-68 (issued December 2, 2025), proposed regulations published March 9, 2026, Technical Release 2026-02 released June 17, 2026, and the draft 2026 Form W-2 provide some additional clarity, many aspects of the §128 employer-contribution rules remain unaddressed. Trump Account contributions may begin as early as July 4, 2026, but most employers are likely to wait for further guidance before implementing their program.

Applies To:

• Any employer that wants to offer a §128 Trump Account Contribution Program (TACP) to employees starting July 4, 2026 or later.
• Employers considering a §125 cafeteria plan amendment to allow employees to make pre-tax contributions toward Trump accounts for their dependent children under the employer’s TACP.

Go Deeper:

To read the rules known to date, review our guide, Trump Accounts Employer Guidance as of June 2026.

Wait to File and Pay PCORI Until IRS Form 720 is Updated

Employers with a self-funded group medical/Rx plan or certain Health Reimbursement Arrangements (HRAs) with a plan year that ended in calendar year 2025 need to file and pay a Patient Centered Outcomes Research Institute (PCORI) fee on IRS Form 720 by July 31, 2026. However, filing and payment cannot occur until the second quarter IRS Form 720 is released with updated figures of $3.47 in Line 133(c) and $3.84 in Line 133(d).

Applies To: Employers with a self-funded group medical/Rx plan or certain HRAs with a plan year that ended in calendar year 2025.

Go Deeper:

See our walkthrough on filing and paying in our Content Library document, PCORI Fee Form 720 Completion and Submission.

Practical Impact to Employers:

Employers should keep proof of filing and paying the correct fee on the correct form for four years. There is no IRS portal to see past filings, and the IRS has sent enforcement letters against employers with respect to PCORI fees and filings, so it is crucial to not file until the updated form is ready.

DOL has yet to Finalize the PMB Proposed Rule for Plan Years On/After July 1, 2026

The Department of Labor (DOL) proposed a PBM rule in late January 2026 to start applying for plan years beginning on or after July 1, 2026. However, just a few days later, the Consolidated Appropriations Act, 2026 (CAA-26) became law with its own PBM reforms including some similarities along with additional requirements that would mostly take effect much later. That left many wondering whether the proposed rule would get finalized, scaled back, or withdrawn. To date, no updates have been released, so it seems unlikely those proposed rules will take effect with plan years starting as soon as this summer.

Below is a quick recap to compare and contrast the proposed rule and CAA-26 PBM reforms (note, similarities are italicized, but they are not identical):

• The proposed rule is intended to arm self-funded ERISA plan fiduciaries with:
  • PBM transparent and non-transparent compensation details before entering into a contract each year,
  • A semi-annual report to explain PBM compensation overages of 5% or more, and
  • Legally protected audit and data access rights.
• The CAA-26 made PBMs and PBM consultants immediately subject to providing ERISA 408(b)(2) transparent and non-transparent compensation details before entering into a contract each year for all employers subject to ERISA (large and small, insured and self-funded)
• Then, for plan years starting 30 months after the law passed, the CAA-26 also requires:
  • Detailed semi-annual reporting for all large employer health plans (ERISA and non-ERISA, fully insured and self-funded),
  • Annual participant notices for all plans nationwide, and
  • 100% pass-through of non-transparent PBM and PBM consultant compensation (such as rebates) for all employers subject to ERISA (large and small, insured and self-funded), with legally protected audit and data access rights.

Applies To:

• Self-insured (including level-funded) ERISA group health plans of any size that include prescription drug coverage.
• The proposed rule would not apply to governmental or church plans exempt from ERISA, nor to fully insured ERISA plans (for now).

Go Deeper:

Read our recap of the proposed rule from January 29, 2026: Proposed Rule to Require Pharmacy Benefit Manager (PBM) Compensation Disclosures.

Practical Impact to Employers:

Under CAA-26, before signing the contract each year, employers with self-funded ERISA plans should be given §408(b)(2) compensation disclosures at this time explaining what the PBM and PBM consultant are expecting to receive in transparent and non-transparent compensation.

The other proposals, still in limbo, were for a semi-annual report and audit/access rights, two areas which the CAA-26 does not perfectly overlap, but does eventually provide some similarities for a couple of years from now.

BCBS Settlement Checks are in the Mail

After multiple delays, employers and other plan sponsors are at last beginning to receive settlement checks from the Blue Cross Blue Shield (BCBS) antitrust class action settlement. These payments are made exclusively to employers who are in the settlement class and who filed a valid claim by the November 5, 2021 deadline. Because individual employees who filed their own valid claim are now also receiving their own payments directly from the settlement fund, many employers are asking a natural follow-up question: can the employer keep the entire settlement payment, or does some portion belong to plan participants?

Although the BCBS settlement website’s FAQ 39 suggests that employers may retain the full amount, that advice reflects only the terms of the settlement itself and does not appear to account for ERISA requirements. Unless the employer has special plan language reserving the right to keep the entire settlement amount, or the contribution split with employees meets ERISA rules that would allow the employer to keep the entire settlement, then employers are cautioned not to keep the whole amount without first consulting with their legal counsel. If the employer determines some of the money should be shared back with participants, following the rules for allocating and distributing Medical Loss Ratio (MLR) rebates is likely the ideal way to address allocating funds. Note, employers must distribute any funds going to participants within 90 days to avoid establishing a trust to hold the funds.

Applies To: Employers and other plan sponsors who receive a BCBS antitrust settlement check.

Go Deeper:

For guidance on how much of a settlement check an employer may retain versus how much must be returned to plan participants, please refer to our MLR and Other Rebates Calculator. Although the tool’s principal purpose is for MLR rebates, the same principles and allocation rules apply to settlement checks.

DOL is Leaving Certain 2025 Penalty Amounts Unchanged for 2026

The Department of Labor (DOL) announced that due to the government shutdown last fall that prevented reporting Consumer Price Index (CPI-U) inflation data in October 2025, the 2026 annual adjustments to certain penalties applicable to group health plan benefits will not occur this year.

Therefore, the 2025 amounts for untimely filings of Forms 5500 and M-1, failure to provide a Summary of Benefits and Coverage (SBC), Notice of Creditable Coverage, CHIP and GINA notices are brought forward without change for penalties assessed after January 15, 2026 for violations occurring after November 2, 2015.

Applies To:

• All employers with a fully insured, level-funded or self-funded group medical plan or an ICHRA.
• All employers with ERISA health or welfare plans subject to the jurisdiction of the DOL.

Go Deeper:

Following are the DOL penalties applicable to health benefit plans:

Employers sponsoring group benefits need to be aware of potential penalties for various failures, and make necessary changes to avoid such penalties.

DOL Announcement for 2026

Since the announcement simply noted “no updates” without repeating the indexing tables from 2025, see the Federal Civil Penalties Inflation Adjustment Act Annual Adjustments for 2025.