Choosing a carrier or administrator now includes asking how well they protect your plan data.
EBSA offers tips for hiring a service provider with strong cybersecurity practices. This page turns them into questions and contract terms for a group health plan.
Where This Page Fits.
General information, not legal advice. The tips come from the Department of Labor page cited below.
EBSA Cybersecurity Guidance for Health and Welfare Plans
The overview: what the guidance is and how employers can use it.
The Twelve Best Practices Explained
Each practice in plain English, read for a health plan.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
Six Things EBSA Suggests.
EBSA says the tips are for employers and other sponsors of health, welfare, 401(k) and pension plans that rely on service providers to keep records and participant data confidential and accounts secure. They apply to plan sponsors of all types and sizes of ERISA plans, and they are meant to help sponsors and fiduciaries meet their ERISA duties to prudently select and monitor providers.
Review security standards and audits. Ask for the provider’s information security standards, practices, policies and audit results, and compare them with what other financial and health institutions use. EBSA prefers a provider that follows a recognized standard and has an independent third party validate it.
Verify the claims. Ask how the provider validates its practices and which standards it has met, and include a contract right to review audit results that show compliance.
Check the record. Look at public information about security incidents, litigation and legal proceedings tied to the provider’s services, and ask whether it has had breaches, what happened and how it responded.
Confirm insurance. Find out whether the provider carries insurance covering cyber and identity theft losses, from both internal threats and external ones such as a third party taking over a participant’s account.
Build protections into the contract. Require ongoing compliance with security standards, and be wary of clauses that limit the provider’s responsibility for security breaches.
Five Provisions To Consider.
EBSA lists provisions a sponsor may consider asking for. Information security reporting means an annual third-party audit of compliance with the provider’s own security policies and procedures. Clear use and sharing terms means a duty of confidentiality, no use or disclosure without written permission and a strong standard of care against unauthorized access, loss or misuse.
Breach notification means a defined timeline for telling you about incidents, plus the provider’s cooperation in investigating and addressing causes. Compliance with records retention, destruction, privacy and information security laws means obligations to meet applicable federal, state and local rules on participants’ personal information.
Insurance may include professional liability and errors and omissions coverage, cyber liability and privacy breach coverage, and fidelity bond or blanket crime coverage. EBSA says to understand the terms and limits and confirm the policy covers cyber incidents involving the plan.
Where This Fits In A Health Plan Search.
For a group health plan, the parties to ask are the carrier or third party administrator, the pharmacy benefit manager and the enrollment platform. Put the security questions into the same request for proposal or renewal questionnaire that covers pricing and network, so the answers arrive together and can be compared.
Our page on selecting and monitoring health plan service providers covers the broader duty to choose and review them. The pharmacy benefit manager disclosure proposal is a separate subject that touches the same fiduciary relationship.
Limits Of The Tips.
They are suggestions, not a required checklist, and the pages we reviewed do not say otherwise. A provider’s answers are only as good as the evidence behind them, so ask for the audit date and scope, not just a yes. If a negotiation yields no change to a limitation of liability clause, note it in your file and ask your counsel what it means for your plan.
Related Rules And Tools.
Selecting and Monitoring Health Plan Service Providers
How a fiduciary chooses and reviews the carriers and administrators that run a health plan.
PBM Fee Disclosure Proposed Rule (ERISA Section 408(b)(2))
A proposed rule on what pharmacy benefit managers would have to disclose to plan fiduciaries.
HIPAA for Employers
The separate federal privacy and security rules that apply to health plan information.
A Compliance Calendar for Your Plan Year
A plan-year view of the dates that matter.
Laws And Sources
DOL, Tips for Hiring a Service Provider with Strong Cybersecurity Practices: EBSA tips for sponsors and fiduciaries, including the suggested contract provisions.
DOL, Compliance Assistance Release No. 2024-01: The September 6, 2024 release stating that the guidance applies to all types of ERISA plans, including health and welfare plans.
ERISA section 404(a), 29 U.S.C. 1104: The fiduciary duties of loyalty and prudence.
General information, not legal or tax advice.
Quick Answers.
Short replies on this page’s topic, each tied to a fuller guide.
What should we ask a health plan vendor about cybersecurity?
EBSA suggests asking for security standards, policies and audit results, how the provider validates its practices, its history of incidents and breaches, and its insurance coverage.
What contract terms does EBSA suggest for security?
It lists information security reporting, clear confidentiality and data use terms, breach notification with a timeline, compliance with privacy and security laws, and insurance, and it warns about clauses that limit the provider’s responsibility for breaches.
Do the hiring tips apply to small employers?
EBSA says the tips apply to plan sponsors of all types and sizes of ERISA plans.
The Rest Of This Series.
What EBSA Cybersecurity Guidance Covers
The 2021 release, the 2024 clarification and what it means for health plans.
The Twelve Best Practices Explained
Each practice in plain English, read for a health plan.
Online Security Tips for Participants
Account habits employees can adopt today.
Fiduciary Duty and Documentation
How prudence under section 404(a) connects to a written file.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.