Employees can lower their own risk with a handful of account habits EBSA recommends.
EBSA publishes online security tips for people who manage health, welfare or retirement accounts online. Here they are, with a way for employers to share them.
Where This Page Fits.
General information, not legal advice. The tips come from the Department of Labor page cited below.
EBSA Cybersecurity Guidance for Health and Welfare Plans
The overview: what the guidance is and how employers can use it.
What EBSA Cybersecurity Guidance Covers
The 2021 release, the 2024 clarification and what it means for health plans.
Hiring a Service Provider
Questions and contract terms for choosing a provider with strong security.
Register, Monitor And Tidy Up.
Register and monitor the account. EBSA says setting up online access lets you protect and manage your account, and that checking it regularly helps you spot unauthorized access. Without a registered account, criminals may be able to impersonate you online.
Keep contact information current, and choose more than one way to be reached, so a provider can contact you about a problem. Close accounts you no longer use, and sign up for account activity alerts.
Passwords And Multi-Factor Authentication.
Use strong, unique passwords. EBSA suggests avoiding common passwords and predictable patterns, aiming for 14 or more characters, never sharing or reusing a password, and using a secure password manager rather than writing them down. It suggests changing a password once a year or after a breach, and notes that the National Institute of Standards and Technology favors longer passwords over frequent forced resets.
Turn on multi-factor authentication. This adds a second verification step, such as a one-time code sent by text or email, so a password alone is not enough to get in.
Phishing, Wi-Fi And Software.
Recognize phishing. EBSA lists warning signs: unexpected messages from services you do not use, spelling errors, links that point somewhere other than they appear to, shortened or unusual web addresses, requests for account numbers or security answers, offers that seem too good to be true, messages built on urgency or fear, and mismatched sender addresses. It says legitimate providers will not ask for account numbers or personal information by email or text.
Avoid free public Wi-Fi at airports, hotels and coffee shops, and use cellphone data or a home network instead. Install reputable antivirus software, keep it current, and apply software updates promptly, with automatic updates turned on where available.
If something goes wrong, EBSA points to the FBI and to the Department of Homeland Security through CISA for official ways to report identity theft and cyber incidents.
Passing The Tips On.
These tips are written for participants, not employers, but an employer can share them with staff at open enrollment or when a new benefits portal launches. A one-page handout that mirrors the headings above is enough. Employees who register early and turn on multi-factor authentication are harder to impersonate, which matters on carrier portals that show claims and coverage details.
Related Rules And Tools.
HIPAA for Employers
The separate federal privacy and security rules that apply to health plan information.
Selecting and Monitoring Health Plan Service Providers
How a fiduciary chooses and reviews the carriers and administrators that run a health plan.
A Compliance Calendar for Your Plan Year
A plan-year view of the dates that matter.
Laws And Sources
DOL, Online Security Tips: EBSA tips for people who manage health, welfare or retirement accounts online.
DOL, Compliance Assistance Release No. 2024-01: The September 6, 2024 release stating that the guidance applies to all types of ERISA plans, including health and welfare plans.
General information, not legal or tax advice.
Quick Answers.
Short replies on this page’s topic, each tied to a fuller guide.
How long should a benefits account password be?
EBSA suggests aiming for 14 or more characters, using a unique password for each account, and not reusing or sharing it.
Do employees need to register for the carrier portal?
EBSA says registering for online access helps you protect and manage your account and spot unauthorized access, and that without registration a criminal may be able to impersonate you online.
Who should an employee contact after a cyber incident?
EBSA points to the FBI and to the Department of Homeland Security through CISA for official reporting resources, and employees should also tell their provider and employer.
The Rest Of This Series.
What EBSA Cybersecurity Guidance Covers
The 2021 release, the 2024 clarification and what it means for health plans.
The Twelve Best Practices Explained
Each practice in plain English, read for a health plan.
Hiring a Service Provider
Questions and contract terms for choosing a provider with strong security.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.