The compliance work nobody sees until an auditor asks for it.
Testing, dependent audits, privacy documents, leave requests and the fees and notices that come due once a year. Each is small on its own, and each is the kind of thing that goes missing when it has no owner.
A plan that favors the highest paid loses its tax advantage for them.
Pre-tax plans have to pass annual tests showing they do not favor highly compensated or key employees. A failed test is fixable, and there are more ways to fix it when it is found before the plan year ends. Tests are run on your census, packaged into one annual cycle, with guidance on correcting any that fail.
Cafeteria Plans and FSAs
Eligibility, contributions and benefits tests, plus the key employee concentration test, run for the plan that lets employees pay premiums and fund accounts pre-tax. The key employee concentration test is the one a closely held company can fail without doing anything unusual: when owners and officers account for a large share of the pre-tax dollars running through the plan, their premiums alone can tip it. That is why the census needs ownership and compensation data, not just names and elections. For a quick estimate, use our free dependent audit savings calculator.
Dependent Care and HRAs
The dependent care account has its own tests, including the 55% average benefits test, and reimbursement arrangements are tested on their own. The 55% test compares the average benefit of non-highly compensated employees with that of highly compensated ones, so an account used mainly by higher earners can fail even when everyone was offered the same thing. A mid-year run shows whether higher earners’ elections need to be capped before the year closes.
Self-Funded Medical and Group Life
Self-funded and level-funded medical plans are tested under Section 105(h), and group term life above $50,000 has its own rules for key employees. Under Section 105(h), a self-funded plan that favors highly compensated individuals makes some or all of their reimbursements taxable to them, so an executive-only plan or a shorter waiting period for managers is the pattern to check. On group term life, a plan that favors key employees costs them the tax exclusion on the whole benefit, not only the excess.
An ineligible dependent is a claim you pay for someone who is not on the plan.
An audit asks every employee to document the dependents they cover, then reports who is verified, who is not and who never answered.
How It Runs
An announcement from the employer, a letter to each employee with a dedicated help line, up to three reminders and an appeals process, followed by a final report sorting every dependent into verified, ineligible or no response. Spouses can be included or left out.
Timing and Amnesty
Most audits run ahead of open enrollment, often with an amnesty window so employees can remove ineligible dependents before verification starts. Amnesty lets an employee remove a dependent voluntarily, with the employer agreeing not to pursue past claims, which clears the simple cases before documents are requested. Verification then only has to chase the records that are in doubt.
Communications Handled
Employees hear from the audit team directly, so HR is not the one chasing birth certificates and marriage records. Employees send their documents to the audit team rather than to HR, which keeps marriage certificates and tax returns out of personnel files. HR sees the status reports, not the paperwork.
A Report You Can Act On
Results go straight into enrollment, so removals take effect cleanly instead of lingering on the carrier bill. Each ineligible dependent comes with an effective date for removal, and the change goes to the carrier or administrator in the next eligibility update. Employees who never responded are handled under the rule announced at the start, so no one is removed on a judgment call.
A group health plan has privacy duties of its own.
The plan is a covered entity, and an employer that sees plan information needs the documents that say how that information is protected.
Policies and Procedures
A HIPAA privacy policy, the plan amendment and plan sponsor certification that let the employer see plan information, and the safeguards that go with them. The amendment and certification are what allow HR to see plan information for plan administration at all, and they bar its use for hiring, firing or other employment decisions. Without them, an employer that gets claim information from the plan to help an employee has no documented basis for holding it.
Notices and Agreements
The privacy notice employees are owed, and business associate agreements with the vendors who handle plan information. The business associate agreement is what obligates a vendor to protect plan information and report a breach, and it should be signed before the vendor receives any data. The list to check covers the claims administrator, the pharmacy benefit manager, the benefits platform and any other vendor that handles plan information on the plan’s behalf.
Training and Updates
Training for the people who touch plan data, and updates to the documents as the rules change. Training covers who can see plan information, what it can be used for and how to handle an employee who calls HR about a claim. Keep a record of it, because in a complaint or an audit the question is whether the training happened and who attended.
The fees, notices and leave requests with a clock attached.
PCORI Fee
Self-funded plans, including level-funded plans and most HRAs, pay a small per-covered-life fee with Form 720, due 31 July of the year after the plan year ends. We can help you calculate it and file. The fee is charged on average covered lives, which includes dependents, and the IRS allows several counting methods that can produce different totals. An HRA counts only the employee, which is why its fee is small and easy to forget.
Medicare Part D Notices
Every Medicare-eligible person on the plan gets a creditable coverage notice before 15 October, whatever the employer’s size, and the plan reports its status to CMS within 60 days of the plan year starting. Whether the drug coverage is creditable has to be determined for each plan year, not carried forward from the last one. The notice also goes to Medicare-eligible spouses, dependents and COBRA participants, which is why it usually rides with the open enrollment packet to everyone.
Family and Medical Leave
Leave requests taken by phone or online, eligibility checked against the service and hours rules, intermittent leave tracked, and every communication recorded, with reports HR can see at any time. The service and hours tests sit alongside a worksite test: at least 50 employees within 75 miles. Where leave overlaps disability or workers’ comp, the record shows whether they run concurrently, which decides how long the job is protected.
What employers ask about compliance administration.
We are fully insured. Do we still need testing?
If employees pay premiums pre-tax through a cafeteria plan, yes. The tests apply to the cafeteria plan whether the medical plan is insured or self-funded. What being fully insured removes is the separate Section 105(h) test on the medical plan itself, so for premiums the cafeteria plan tests are the ones left to run. An HRA or health FSA beside the insured plan is self-funded and is still tested on its own. The census is the same every year, which keeps the work small once set up.
How often should we audit dependents?
Many employers run a full audit once, then verify new dependents as they are added. Ongoing verification means asking for documents at hire and at every mid-year addition, a much lighter process than a full audit. A repeat full audit makes sense after an acquisition, a carrier change or a stretch with no verification at all.
Does HIPAA apply if we never see claims?
The plan still has duties, but a fully insured plan whose sponsor receives no protected health information has far fewer of them. The trade is real: to stay in that lighter position, HR should not receive claim details from the plan, and helping an employee with a problem needs that employee’s written authorization. Employers who do help with claims routinely, or who run a self-funded or level-funded plan, need the full set of policies, the amendment and the certification.
Who pays the PCORI fee on a fully insured plan?
The carrier. The employer pays it for self-funded plans, and for most HRAs even when the medical plan is insured. An HRA paired with an insured medical plan is a separate self-insured arrangement, so the employer files Form 720 for it even though the carrier pays on the medical plan. The HRA fee is due on the same July date.
Does a small employer owe the Part D notice?
Yes. There is no size exemption. Every employer that offers prescription drug coverage owes the notice to Medicare-eligible individuals, including spouses and retirees on the plan. The CMS disclosure is owed as well, on the same timing regardless of size, and it is easiest to file right after the creditable coverage determination is made.
What happens if a test fails?
Usually the highly compensated employees’ pre-tax contributions are reduced or become taxable for the year. Finding it before the year ends leaves more ways to fix it. A mid-year test is the practical safeguard: if the preliminary result fails, higher earners’ elections can be capped for the rest of the year instead of taxed afterward. The cause, whether plan design or who is participating, then gets fixed for the next plan year.
Where the Rules Come From.
The laws and rules named on this page link to the statute or regulation they come from. This is general information, not legal or tax advice, and rules change, so check the current text.
COBRA Continuation Coverage (29 U.S.C. 1161)
Requires many group health plans to offer temporary continuation coverage after a qualifying event.
HIPAA Privacy Rule (45 CFR Part 164)
Federal privacy and security standards for protected health information held by health plans.
Family and Medical Leave Act (29 U.S.C. Chapter 28)
Job-protected leave and group health coverage continuation for eligible employees.
Cafeteria Plans (26 U.S.C. 125)
The tax code section that lets employees pay certain benefit premiums before tax.
Creditable Prescription Coverage (42 CFR 423.56)
Defines creditable coverage for Medicare Part D disclosure and notice rules.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents, two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →