A release framed around retirement plans was widened in 2024 to cover health and welfare plans.
EBSA issued cybersecurity guidance in April 2021 and clarified on September 6, 2024 that it covers all ERISA plans. This page walks through the timeline and what changed.
Where This Page Fits.
General information, not legal advice. Check the cited Department of Labor pages before you act.
EBSA Cybersecurity Guidance for Health and Welfare Plans
The overview: what the guidance is and how employers can use it.
The Twelve Best Practices Explained
Each practice in plain English, read for a health plan.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
What EBSA Said, And When.
On April 14, 2021, the Employee Benefits Security Administration issued News Release No. 21-358-NAT announcing what it described as its first cybersecurity guidance. It had three parts: tips for hiring a service provider with strong cybersecurity practices, cybersecurity program best practices, and online security tips. The audience named in the release was plan sponsors, fiduciaries, record keepers and participants in ERISA plans, and the examples leaned toward retirement accounts.
According to the Department, service providers then told plan fiduciaries and EBSA investigators that the guidance applied only to retirement plans. In 2022 the ERISA Advisory Council recommended that EBSA clarify that it also covers health benefit plans.
On September 6, 2024, EBSA issued Compliance Assistance Release No. 2024-01. It says the guidance applies to all types of ERISA plans, including health and welfare plans and all employee pension benefit plans. It lists three updated resources, which are the hiring tips, the best practices and the online security tips.
What Changed For Health Plans.
Nothing in the release creates a deadline, a form or a filing. What changed is the Department’s stated position about scope. A carrier, administrator or other vendor that once said the cybersecurity pages were a retirement plan topic now has the Department’s own statement to the contrary.
The release also points to three Department of Health and Human Services publications that it says may help health plans and their service providers: Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients, and two technical volumes, one for small healthcare organizations and one for medium and large ones. We have not reviewed those documents for this page, so read them directly if they matter to your plan.
Confirming The Guidance Fits Your Plan.
ERISA defines an employee welfare benefit plan to include a plan, fund or program an employer maintains to provide medical or hospital care, among other benefits. That definition appears in ERISA section 3(1), 29 U.S.C. 1002(1). Most employer group health plans fit it, but whether yours is an ERISA plan is a question for your counsel.
Then list the outside parties that hold plan data: the carrier, any third party administrator, the pharmacy benefit manager, the enrollment platform and the payroll vendor. That list is the starting point for the questions on our service provider page.
Common Misreadings.
Treating the guidance as a new law. The Department’s pages do not say it is one.
Assuming the Health and Human Services materials replace it. The release lists them as additional resources, not substitutes.
Relying on a vendor’s statement that it does not apply. The September 2024 release says it does apply to health and welfare plans.
Related Rules And Tools.
Selecting and Monitoring Health Plan Service Providers
How a fiduciary chooses and reviews the carriers and administrators that run a health plan.
HIPAA for Employers
The separate federal privacy and security rules that apply to health plan information.
A Compliance Calendar for Your Plan Year
A plan-year view of the dates that matter.
Laws And Sources
DOL, Compliance Assistance Release No. 2024-01: The September 6, 2024 release stating that the guidance applies to all types of ERISA plans, including health and welfare plans.
DOL News Release, April 14, 2021: EBSA announcement of its first cybersecurity guidance (Release No. 21-358-NAT).
ERISA section 3, 29 U.S.C. 1002: Definitions of an employee welfare benefit plan in paragraph (1) and of a fiduciary in paragraph (21)(A).
General information, not legal or tax advice.
Quick Answers.
Short replies on this page’s topic, each tied to a fuller guide.
When did EBSA say its cybersecurity guidance covers health plans?
On September 6, 2024, in Compliance Assistance Release No. 2024-01. The original guidance was issued April 14, 2021.
Why did EBSA clarify the scope?
The release says service providers told fiduciaries and investigators that the guidance applied only to retirement plans, and that the ERISA Advisory Council recommended a clarification in 2022.
Did the 2024 release add new requirements?
The release does not state any new requirement, deadline or penalty. It confirms the scope of guidance that already existed.
The Rest Of This Series.
The Twelve Best Practices Explained
Each practice in plain English, read for a health plan.
Hiring a Service Provider
Questions and contract terms for choosing a provider with strong security.
Online Security Tips for Participants
Account habits employees can adopt today.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.