PPI in the News Compliance Corner - December 8, 2022 Archive
You are here: Home / PPI in the News / Compliance Corner - December 8, 2022 Archive

The IRS released Notice 2022-59, which announces that the adjusted applicable dollar amount for PCOR fees for plan and policy years ending on or after October 1, 2022, and before October 1, 2023, is $3.00. This is a $0.21 increase from the $2.79 amount in effect for plan and policy years ending on or after October 1, 2021, but before October 1, 2022.

PCOR fees are payable by insurers and sponsors of self-insured plans (including sponsors of HRAs). The fee doesn’t apply to excepted benefits such as stand-alone dental and vision plans or most health FSAs. The fee, however, is required of retiree-only plans. The fee is calculated by multiplying the applicable dollar amount for the year by the average number of lives and is reported and paid on IRS Form 720. The PCOR fee is generally due by July 31 of the calendar year following the close of the plan year.

The PCOR fee requirement was reinstated through the Further Consolidated Appropriations Act, 2020 and will be in place until the plan years ending after September 30, 2029.

IRS Notice 2022-59 »

On November 28, 2022, the Department of Health and Human Services (HHS) released a Notice of Proposed Rulemaking for changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR Part 2 (referred to as “Part 2”). The proposed rules are intended to increase coordination among providers in treatment for substance use challenges and increase patient protections from unauthorized record disclosures. Note that Part 2 only applies to SUD treatment records from certain types of federally assisted programs, known as “Part 2 programs.”

Part 2 currently imposes different requirements for protected SUD treatment records than under the HIPAA Privacy Rule. This discrepancy can create barriers to information sharing among healthcare providers and compliance challenges for regulated entities. The CARES Act addressed this by bringing Part 2 protections into greater alignment with the HIPAA Privacy Rule on uses and disclosures for treatment, payment and healthcare operations. Secretary Xavier Becerra described the importance of the changes, noting “[t]his proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”

With some exceptions, Part 2 currently requires SUD treatment providers to obtain written consent for use or disclosure of patient-identifying information and give notice of Part 2 protections (including requiring consent to redisclose) to recipients of Part 2 records. Notably, in the proposed rules under the CARES Act, once prior written consent has been obtained, the records described in the consent may be used or disclosed by a covered entity or business associate for treatment, payment and healthcare operations as permitted under HIPAA regulations, including redisclosure as permitted by HIPAA.

The Proposed Rulemaking changes also include:

• New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule. This includes self-pay patients’ right to restrict disclosures to health plans.
• Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative and legislative proceedings.
• New HHS enforcement authority, including the imposition of civil monetary penalties for violations of Part 2.
• Updated breach notification requirements to HHS and affected patients that follow the HIPAA Breach Notification Rule.
• Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.

The current Part 2 rules remain in effect while HHS completes the rulemaking process. Group health plan sponsors should be aware of the proposed rules and consult with their insurers or service providers regarding implementation of anticipated changes to Part 2 record protections. Public comments on the proposed rules can be submitted through January 31, 2023. We will continue to report on further major developments in Compliance Corner.

Notice of Proposed Rulemaking on Confidentiality of Substance Use Disorder Patient Records »

On December 1, 2022, the Office for Civil Rights (OCR) at the HHS issued a bulletin to remind HIPAA covered entities and business associates (“regulated entities”) of their obligations when using online tracking technologies. The bulletin emphases that regulated entities must disclose PHI only as expressly permitted or required under the HIPAA Privacy Rule.

These online tracking technologies (e.g., cookies), used by third-party tracking technologies like Google Analytics or Meta Pixel, collect and analyze information about how internet users are interacting with a regulated entity’s website or mobile application. HHS indicated in their press release that some regulated entities regularly share electronic protected health information (ePHI) with third-party online tracking technology vendors, and some may be doing so in a way that violates the HIPAA Rules. The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes ePHI. Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of ePHI to tracking technology vendors or any other violations of the HIPAA Rules.

The collected information through tracking technologies from websites or mobile apps might include an individual’s medical record number, home or email address, or dates of appointments, as well as an individual’s IP address or geographic location, medical device IDs or any unique identifying code. The bulletin clarifies that all such individually identifiable health information collected on a regulated entity’s website or mobile app is protected health information (PHI), even if the individual does not have an existing relationship with the regulated entity and even if the individually identifiable health information, such as IP address or geographic location, does not include specific treatment or billing information like dates and types of healthcare services.

The HIPAA Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper or oral. PHI is information, including demographic data that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. HIPAA covered entities include health plans, clearinghouses and certain healthcare providers.

Though the bulletin addresses many issues that apply to providers and insurance companies, employers should conduct routine risk assessments and review their HIPAA obligations with their advisers and outside counsel when developing a comprehensive strategy for adhering to HIPAA’s privacy, security and breach response requirements incorporating this latest bulletin on online tracking technologies.

HHS OCR Bulletin »
HHS Press Release »

On November 7, 2022, the IRS announced the expansion of one of their programs for approving retirement plans. As a result, §403(b) retirement plans, which are used by certain public schools, churches and charities, are now permitted to use the same individually designed retirement plan determination letter program that is currently used by qualified retirement plans, such as §401(k) plans. Revenue Procedure 2022-40 explains this expansion and other program changes.

Under the determination letter process, a plan sponsor can submit an application requesting the IRS to review and approve the form of its retirement plan document. If the IRS approves the plan's form, it will issue a favorable determination letter. Although a letter is not required, most sponsors of individually designed plans will request one to have written assurance that the plan’s provisions do not violate the Code. Additionally, a favorable determination letter also enables the plan sponsor to self-correct plan mistakes, including significant ones, that may later arise.

Previously, the determination letter process was not available to §403(b) individually designed plans. However, beginning June 1, 2023, §403(b) retirement plan sponsors may submit initial determination letter applications for individually designed retirement plans based on the last digit of the sponsor's Employer Identification Number. (The submission schedule is outlined in Section 12 of Revenue Procedure 2022-40.) Additionally, beginning June 1, 2023, §403(b) retirement plan sponsors may also request a determination letter upon plan termination using the Form 5310, Application for Determination for Terminating Plan.

Revenue Procedure 2022-40 includes other important changes to the procedures, which affect qualified plan and 403(b) submissions. For example, a determination letter issued to an adopter of a pre-approved retirement plan because of filing a Form 5307, Application for Determination for Adopters of Modified Volume Submitter Plans, will no longer be considered in determining whether a plan sponsor is eligible to submit that plan for a determination letter for an initial plan determination on a Form 5300, Application for Determination for Employee Benefit Plan. Furthermore, the IRS generally will consider in its review qualification requirements and section 403(b) requirements that are in effect, or that have been included on a Required Amendments List, on or before the last day of the second calendar year preceding the year in which the determination letter application is submitted, subject to any specified modifications on the annual Employee Plans revenue procedure for submitting determination letter applications.

The IRS indicated that additional guidance will be released soon that will reflect further changes to the procedural requirements, such as phasing-in mandatory e-submission of determination letter requests. Forms 5300 and 5310 will also be updated to reflect these changes.

Retirement plan sponsors, particularly those sponsoring individually designed 403(b) plans, should be aware of the updates to the determination letter process.

Revenue Procedure 2022-40 »

On November 21, 2022, the IRS issued Notice 2022-62, which is the 2022 Required Amendments List (RA List) for qualified retirement plans. The yearly RA Lists provide changes in retirement plan qualification requirements that could result in disqualifying provisions and require a remedial amendment. A disqualifying provision is a required provision that isn’t listed in the plan document, a provision in the document that doesn’t comply with the qualification requirements or a provision that the IRS defines as such.

The RA List applies to both §401(a) and §403(b) plans and is divided into two parts: Part A and Part B. Part A lists changes in qualification requirements that will generally require affected plans to be amended. Part B lists changes that would likely not require amendments to most plans but might require an amendment because of an unusual plan provision in a particular plan.

Unlike prior years, there are no Part A or Part B changes this year. The remedial amendment deadline for disqualifying provisions resulting from items on the 2022 RA List is December 31, 2024 (or later, for certain governmental plans). Therefore, plan sponsors should determine whether amendments are necessary for their retirement plan and work with service providers to adopt any such amendment.

Notice 2022-62 »

On November 21, 2022, the Employee Benefits Security Administration (EBSA) of the DOL proposed changes to the Voluntary Fiduciary Correction Program (VFCP). The VFCP has been around since the early 2000s and allows plan sponsors to apply to the DOL to correct enumerated violations of ERISA. This allows the plan sponsor to avoid further enforcement by the DOL on the corrected issues. The proposed rule introduces a new self-correction feature and clarifies, expands and simplifies existing transactions.

The self-correction feature will allow plan officials to correct late participant contributions or loan repayments to the plan if lost earnings are no greater than $1,000 and they are remitted no later than 180 days from the date of the initial withholding. Self-correcting employers would be able to rely on the DOL’s online calculator to calculate lost earnings. Self-correction would be an option if the employer is not currently under investigation by the DOL. The employer would simply complete an online form to notify the DOL of their self-correction (versus an application that would’ve had to have been approved by the DOL under the existing VFCP), and the DOL would reply with an email acknowledging receipt.

Other minor changes to the VFCP are also proposed, including:

• Changing the sections on delinquent contributions and loans to reflect the existence of the self-correction program.
• Eliminating the requirement that an independent fiduciary validate the process used to determine the fair market interest rate determination for loans that are $10,000 or less.
• Allowing a cash settlement if an asset belonging to the plan has been sold and a plan official provides a statement that the sale was upon the advice of an independent fiduciary and not in anticipation of VFCP relief.
• Expanding the sale and leaseback of real property transactions to allow correction of leases to affiliates of the plan sponsor.
• Amending the definition of “principal amount” as it pertains to illiquid assets that are sold to parties in interest.
• Modifying the definition of “under investigation” to include a review by an EBSA benefits advisor.
• Changing a couple of the eligibility requirements, including deeming a plan sponsor ineligible when they are aware of criminal activity involving the corrected transactions.
• Making other miscellaneous modifications.

In addition to proposing the changes to the VFCP, the DOL also amended Prohibited Transaction Exemption (PTE) 2002-51. Specifically, the PTE was updated to allow for excise tax relief for transactions that are self-corrected under the new VFCP self-correction option. The exemption would apply if the employer received the DOL’s email acknowledging the self-correction. The DOL is also seeking to amend the PTE to allow employers to take advantage of the VFCP multiple times within a three-year period (which wasn’t allowed in the previous rules).

The DOL is accepting comments on the amended and restated VFCP program and the corresponding amendments to PTE 2002-51 until January 20, 2023. Employers should familiarize themselves with these changes if they need to avail themselves of the VFCP.

VFCP Proposed Rule »
PTE 2002-51 »

On December 1, 2022, the DOL published a final rule entitled “Prudence and Loyalty in Selecting Plan Investments and Exercising Shareholder Rights.” The final rule clarifies that retirement plan fiduciaries may consider environmental, social and governance (ESG) factors when making investment decisions and exercising shareholder voting rights.

ERISA’s exclusive benefit rule requires a plan fiduciary to exercise duties, including the selection of plan investments, solely in the interest of participants and beneficiaries. Accordingly, the fiduciary must consider relevant risk-return factors when evaluating plan investments and courses of action. However, it has been unclear whether and to what extent the inclusion of ESG factors in an investment analysis is consistent with ERISA’s requirements. The Trump Administration released a rule in 2020 (the 2020 rule) that was viewed as limiting consideration of ESG factors in plan investment decisions. In 2021, the Biden Administration issued a non-enforcement policy with respect to the 2020 rule and proposed a new rule to address fiduciary obligations with respect to the investment selection and proxy voting processes. Please see our prior article on the proposed rule. The final rule adopts many of the provisions set forth in the proposed rule.

First, the final rule upholds the principle that ERISA duties of prudence and loyalty require plan fiduciaries to focus on relevant risk-return factors and not sacrifice investment returns or take on additional investment risk to achieve objectives unrelated to the provision of benefits under the plan. However, the economic effects of climate change and other ESG considerations (e.g., board composition and workforce practices) can be considered if material to the risk-return analysis.

Second, the final rule changes the “tie-breaker” standard, which allows plan fiduciaries to consider collateral benefits (i.e., benefits other than investment returns, such as ESG considerations) when making investment selections under certain circumstances. Under the 2020 rule, competing investments must be “indistinguishable” before fiduciaries can consider collateral factors as tiebreakers. The final rule replaces those provisions with a standard that instead requires the fiduciary to prudently conclude that competing investments or investment courses of action equally serve the financial interests of the plan over the appropriate time horizon. In such cases, the fiduciary is not prohibited from selecting an investment or investment course of action based on collateral benefits. The final rule also removes the special documentation requirement that previously applied to the tiebreaker provision.

Third, the final rule removes the 2020 rule’s special requirements for the selection of a Qualified Default Investment Alternative (QDIA). Under the final rule, the same investment standards apply to QDIAs that apply to other plan investments.

Fourth, the final rule clarifies that fiduciaries do not violate their duty of loyalty solely because they consider participants' non-financial preferences when determining the available investment options for participant-directed plans. Such consideration may further plan purposes by increasing participant deferral rates and retirement savings.

Finally, the final rule retains the core concept that when a plan's assets include shares of stock, the fiduciary duty to manage plan assets includes the management of shareholder rights related to those shares, such as the right to vote proxies. However, the final rule removes 2020 rule language indicating fiduciary obligations do not require the voting of every proxy or the exercise of every shareholder right. The final rule also removes two proxy voting safe harbors that were viewed as encouraging abstention from voting. Additionally, the final rule eliminates specific record maintenance and monitoring obligations related to proxy voting activities required under the 2020 rule. (The final rule instead emphasizes that proxy voting and other exercises of shareholder rights should not be viewed differently from other fiduciary activities.)

Retirement plan sponsors should be aware of the final rule and may want to consult with their plan investment advisors for further information. The final rule is effective January 1, 2023.

Final Rule: Prudence and Loyalty in Selecting Plan Investments and Exercising Shareholder Rights »

Because the failure to file Forms 5500 would be a compliance failure, it would be best to consult with legal counsel to determine a path forward. One option that counsel could suggest would be to utilize the DOL’s Delinquent Filer Voluntary Correction Program (DFVCP) to file delinquent filings.

The DFVCP gives delinquent plan administrators an opportunity to avoid higher civil penalty assessments if they satisfy the program’s requirements and voluntarily pay a reduced penalty amount. The program is only an option if the DOL or IRS has not already contacted the employer concerning the delinquent filings.

Participating in the DFVCP is a two-part process. First, the employer would electronically file a complete Form 5500 with EFAST2 for each year for which relief is requested. The employer would then electronically submit the filing information and payment to the DFVCP using the DFVCP calculator and webpage.

The basic penalty under the program is $10 per day for delinquent filings. However, the DFVCP allows for a “per plan” cap, which is designed to encourage reporting compliance of employers who have failed to file a Form 5500 for one plan for multiple years. Under the per plan cap, the penalty for small plans is limited to $1,500, and the penalty for large plans is limited to $4,000.

For more information, see the following DOL resources:

DFVCP FAQs »
DFVCP Penalty Calculator, Online Payment Instructions, Examples and Manual Calculations »