Cybersecurity guidance now reaches health and welfare plans, and it helps to know what it is.
The Department of Labor says its cybersecurity guidance covers all ERISA plans, including health plans. This guide explains what it says, what it is not and how to use it.
Five Topics On One Guidance Set.
General information, not legal advice. Each page cites the Department of Labor page or federal law it relies on.
What EBSA Cybersecurity Guidance Covers
The April 2021 release, the September 6, 2024 clarification and what changed for health plans.
The Twelve Best Practices Explained
Each practice in plain English, and how to read it when your plan runs through a carrier or administrator.
Hiring a Service Provider
The questions and contract terms EBSA suggests for choosing a provider with strong security.
Online Security Tips for Participants
The account habits EBSA recommends, written so employers can pass them on to staff.
Fiduciary Duty and Documentation
How the guidance connects to prudence under ERISA section 404(a), and what a useful file looks like.
Where Things Stand.
The Employee Benefits Security Administration (EBSA), part of the U.S. Department of Labor, announced its first cybersecurity guidance on April 14, 2021. It had three parts: tips for hiring a service provider, program best practices and online security tips for participants. The announcement was framed around retirement accounts, and, according to the Department, service providers for health and welfare plans later told fiduciaries and EBSA investigators that the guidance applied only to retirement plans.
On September 6, 2024, EBSA issued Compliance Assistance Release No. 2024-01. It states that the guidance applies to all types of ERISA plans, including health and welfare plans and all employee pension benefit plans. For an employer with a group health plan, that is the Department of Labor saying the three documents are meant for you too.
This is guidance, not a regulation. The release and pages we reviewed do not say the guidance is a binding rule, and they do not announce a new filing or penalty. What they do is connect the subject to duties that already exist. ERISA section 404(a), 29 U.S.C. 1104(a), asks a fiduciary to act with the care, skill, prudence and diligence of a prudent person familiar with such matters, and the Department describes its service provider tips as a way to help sponsors and fiduciaries meet their ERISA duties to prudently select and monitor providers. How a court or the Department would apply that to a specific plan is a legal question for your counsel.
Translating Retirement Language.
The best practices page says it is written for recordkeepers and other service providers that run plan systems and data, and also for fiduciaries who choose them. In a retirement plan that means the recordkeeper. In a group health plan the closest parallels are the carrier, the third party administrator, the pharmacy benefit manager and the benefits administration platform that holds eligibility and enrollment data. That mapping is our reading, not the Department’s wording, but it is the practical way to use the material.
Employers also hold data themselves: census files, enrollment forms, claim escalations and payroll feeds. The twelve practices are a useful yardstick for your own handling of that information, even though they were written with larger providers in mind.
Separately from EBSA, the Department of Health and Human Services enforces the HIPAA Security Rule, 45 CFR Part 160 and Subparts A and C of Part 164. HHS describes it as applying to covered entities and their business associates and requiring administrative, physical and technical safeguards for electronic protected health information. The 2024 release also points to three HHS publications on healthcare cybersecurity. This guide does not cover HIPAA compliance, and our HIPAA page is the place to start there.
What Employers Can Do This Quarter.
Read the twelve best practices once, then send your carrier and administrator a short written request asking how they meet them and for the date of their most recent independent security audit. Ask about past breaches and cyber insurance, which are both on EBSA’s list of tips.
Check whether your service agreements say how and how fast you will be told about a security incident. EBSA suggests a defined notification timeline, and it urges caution about clauses that limit the provider’s responsibility for security breaches.
Keep the requests, the answers and the date in your plan file, and put a yearly reminder on your compliance calendar. Nothing here is a checklist the Department requires. It is a reasonable record of a careful process, and we are glad to help you build one.
Related Rules And Tools.
Selecting and Monitoring Health Plan Service Providers
How a fiduciary chooses and reviews the carriers and administrators that run a health plan.
HIPAA for Employers
The separate federal privacy and security rules that apply to health plan information.
PBM Fee Disclosure Proposed Rule (ERISA Section 408(b)(2))
A proposed rule on what pharmacy benefit managers would have to disclose to plan fiduciaries.
A Compliance Calendar for Your Plan Year
A plan-year view of the dates that matter.
Laws And Sources
DOL, Compliance Assistance Release No. 2024-01: The September 6, 2024 release stating that the guidance applies to all types of ERISA plans, including health and welfare plans.
DOL News Release, April 14, 2021: EBSA announcement of its first cybersecurity guidance (Release No. 21-358-NAT).
DOL, Cybersecurity Program Best Practices: EBSA page listing the twelve best practices and who they are written for.
DOL, Tips for Hiring a Service Provider with Strong Cybersecurity Practices: EBSA tips for sponsors and fiduciaries, including the suggested contract provisions.
DOL, Online Security Tips: EBSA tips for people who manage health, welfare or retirement accounts online.
ERISA section 404(a), 29 U.S.C. 1104: The fiduciary duties of loyalty and prudence.
HHS, The HIPAA Security Rule: HHS summary of the Security Rule for electronic protected health information.
45 CFR Part 164, Subpart C: The Security Standards for the Protection of Electronic Protected Health Information.
General information, not legal or tax advice.
Quick Answers.
Brief answers to what employers ask about EBSA cybersecurity guidance, each linked to the fuller page.
Does EBSA cybersecurity guidance apply to health plans?
Yes, according to the Department of Labor. Compliance Assistance Release No. 2024-01, issued September 6, 2024, says the guidance applies to all types of ERISA plans, including health and welfare plans.
Is the guidance a regulation employers must follow?
The Department of Labor materials we reviewed do not describe it as a regulation or say it creates new requirements. It is guidance tied to existing ERISA fiduciary duties, including prudence under section 404(a). Your counsel can tell you how it applies to your plan.
What are the twelve cybersecurity best practices?
They are EBSA’s list of program elements for service providers, covering a formal program, risk assessments, third-party audits, access controls, encryption, training, incident response and more. Our guide explains each one in plain English.
What should we ask a carrier or administrator about cybersecurity?
EBSA suggests asking for their security standards and audit results, their track record and any past breaches, whether they carry cyber insurance, and whether the contract covers audits, confidentiality and breach notification.
What should employees do to protect benefit accounts online?
EBSA recommends registering the account, using long unique passwords, turning on multi-factor authentication, keeping contact details current and watching for phishing. Our page lists the full set.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.