PPI in the News Compliance Corner - March 16, 2023 Archive
You are here: Home / PPI in the News / Compliance Corner - March 16, 2023 Archive

On March 9, 2023, the IRS released Revenue Procedure 2023-17, which provides, in part, indexing adjustments for penalties under the employer mandate. As a reminder, the ACA requires applicable large employers (ALEs) – those with 50 or more full-time and full-time equivalent employees (FTEs) – to offer affordable minimum value coverage to substantially all FTEs and their dependents or risk a penalty.

For plan years beginning after December 31, 2023, the annual penalties are as follows:

• Penalty A (failure to offer coverage to substantially all FTEs) – $2,970 per FT employee.
• Penalty B (failure to offer affordable coverage that meets minimum value standards) – $4,460 per FT employee receiving a premium tax credit.

Although generally expressed as an annual amount, as listed above, both penalties are calculated and assessed on a monthly basis.

Revenue Procedure 2023-17 »

On February 23, 2023, in Hayes v. Prudential Insurance Company of America, the US Court of Appeals for the Fourth Circuit found that courts cannot extend plan deadlines for converting group life insurance coverage to individual coverage, even where extraordinary circumstances prevented an individual from meeting the deadline. The court’s conclusion was grounded in ERISA’s cornerstone principle to adhere to the plan terms.

The plaintiff in this case, Kathy Hayes, sued Prudential Insurance Company of America (Prudential) following Prudential’s denial of life insurance benefits due to lapsed coverage for her late husband, Anthony Hayes. Mr. Hayes worked as an environmental engineer for DSM North America, Inc. (DSM) and was insured under a group life plan with Prudential. In May 2015, Mr. Hayes had to stop working due to late-stage liver disease. He was unable to return to work, and when his employment was terminated in November 2015, his employer-provided group life insurance coverage also ended. The terms of the group plan allowed converting employer-provided coverage to an individual policy. To do so, terminating group participants were required to apply for individual conversion and pay the first premium by the later of 31 days after employer-provided coverage ended or 15 days after receiving written notice of the conversion privilege. Mr. Hayes’ employer provided written notice of the conversion privilege in December 2015. Unfortunately, Mr. Hayes did not contact Prudential about converting his life insurance coverage until 26 days after the conversion deadline. During this time, Mr. Hayes was incapacitated due to late-stage liver disease. He passed away six months later, in June 2016.

Prudential’s denial explained that even if Mr. Hayes was incapacitated weeks prior to his conversion deadline, Prudential was required to decide claims in strict adherence to the plan terms, which did not allow for an extension of the conversion period. Ms. Hayes sued Prudential, asking the court to apply the doctrine of equitable tolling in order to allow an exception to the conversion deadline in light of her husband’s incapacitation and award her benefits.

In reviewing Ms. Hayes’ arguments, the Fourth Circuit acknowledged that courts have previously allowed equitable tolling of statutes of limitations (i.e., extending the deadline to file a lawsuit) where a plaintiff has been prevented from timely filing a lawsuit due to extraordinary circumstances. However, the Fourth Circuit found that because the plan’s life insurance conversion deadline is not tied to the plan’s statute of limitations, it should not be modified by equitable tolling, even where extraordinary circumstances hindered a participant’s ability to meet the deadline. The Fourth Circuit emphasized that ERISA protects “contractually defined” benefits in group benefit plans by requiring plan administrators to follow plan terms, calling the focus on a plan’s written terms “the linchpin of [the] system.” Prudential’s denial of benefits was based on strict adherence to unambiguous plan terms and therefore upheld under ERISA.

The Hayes case underscores the unyielding nature of unambiguous ERISA plan terms like deadlines. The case also illustrates the importance of communicating life insurance conversion deadlines to departing employees. Employers sponsoring group life insurance should carefully review the plan terms in order to understand what is required of them, which could include sending written notice of conversion rights when group coverage terminates. Not only may clear notice of conversion rights be required to satisfy an employer’s ERISA fiduciary duty (when the plan requires such notice by the employer), but it is also the necessary catalyst for employees to meet strict conversion deadlines.

Hayes v. Prudential »

On February 17, 2023, the HHS Office for Civil Rights (OCR) released two annual reports to Congress summarizing the agency’s key HIPAA enforcement activities during the 2021 calendar year as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. The first report, HIPAA Privacy, Security, and Breach Notification Rule Compliance, identifies the number of complaints received, the method by which those complaints were resolved, and other OCR HIPAA compliance enforcement activities. The second report, Breaches of Unsecured Protected Health Information, identifies the number and nature of breaches of unsecured protected health information (PHI) that were reported to the HHS and the actions taken in response to the breaches.

Due to a lack of financial resources, OCR did not conduct any audits in 2021. Further, OCR requested that the HITECH civil penalty caps be increased in the HHS Fiscal Year 2023 Legislative Supplement sent to Congress to secure enough staff and resources to carry out OCR’s enforcement activities.

The highlights of these two reports are as follows:

• New complaints alleging violations of HIPAA Rules and the HITECH Act in 2021 were 34,077, a 25% increase from calendar year 2020.
• Of those new complaints, OCR resolved 20,661 (78%) before initiating an investigation.
• The top five complaints resolved were: impermissible uses and disclosures, right of access, safeguards, administrative safeguards under the HIPAA Security Rule, and breach notice to individuals.
• OCR resolved 13 complaint cases in 2021 through resolution agreements and/or corrective action plans and monetary settlements totaling $815,150. Two complaint investigations resulted in the assessment of civil money penalties totaling $150,000.
• OCR received 609 notifications of breaches affecting 500 or more individuals, a decrease of 7% from the calendar year 2020.
• Hacking/IT incidents remained the largest category of breaches among incidences affecting 500 or more individuals in 2021. The largest category of breaches of 500 or more individuals by location involved network servers.
• For breaches affecting fewer than 500 individuals, the largest category by type of breach report was unauthorized access or disclosures, and the largest category by location was paper records.

The appendices sections of both reports include:

• The actual cases of the Resolution Agreements.
• A summary of the settlement terms that provide helpful insights to employers.
• Other covered entities (e.g., insurers) for the potential consequences of failing to comply with HIPAA rules.

These annual reports are an important reminder of the agency’s HIPAA compliance enforcement activities. So it is crucial that employers are educated in overall HIPAA rules and review their HIPAA compliance.

HHS: Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2021 »
HHS: Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2021 »

The Department of Labor’s Advisory Council on Employee Welfare and Pension Benefit Plans has issued a report addressing cybersecurity issues affecting health plans. While the Council has issued two reports on cybersecurity issues affecting employee benefit plans in the past (the first in 2011; the second in 2016), this report marks the first time the Council has focused exclusively on cybersecurity regarding health benefit plans alone.

This report emphasizes the vast amount of individualized data obtained, produced, and maintained by health plans makes these plans especially tempting targets for cyberattacks. Health plan datasets, after all, include not only standard personal identification information (e.g., names, addresses, phone numbers, social security numbers, etc.) but also extremely sensitive (and therefore extremely valuable) personal health information that cybercriminals can trade or sell on the “dark web” or exploit in other ways, such as through ransomware.

The Council paints a stark picture, noting that the HHS Office for Civil Rights has reported that since 2015 cybersecurity breaches among healthcare providers have affected the greatest number of individuals. Additionally, the FBI has identified the Healthcare and Public Health Sector as the US critical infrastructure sector most victimized by ransomware in 2021, and IBM has reported that the healthcare industry has borne the highest data breach costs of any industry for 12 years in a row, with the average cost totaling $10.1 million in 2022.

Before making its own recommendations on how best to combat these threats, the Council sought testimony from various outside experts and industry stakeholders, emphasizing whether DOL should expressly recognize the provision of cybersecurity for health plans as a fiduciary duty under ERISA.

While opinions on this question varied among the witnesses, the Council gleaned three “important threads” when it considered their testimonies, including:

• The relationship between the obligations of health plan fiduciaries with respect to cybersecurity under HIPAA and ERISA, including whether or not compliance with the HIPAA security rule would be sufficient to meet fiduciary standards under ERISA.
• The lack of clarity about and knowledge of ERISA fiduciary duties regarding cybersecurity for health plans, especially since DOL has not yet “made a sufficiently direct statement, whether in a regulation or guidance, declaring the basic principle that health plan fiduciaries have a duty to act prudently regarding cybersecurity risks.”
• How plans address cybersecurity issues in their dealings with third-party service providers, since “most of the action, most of the information, and most of the security risk [for health plans] lies with third-party administrators, insurers, and other service providers.”

After taking all the above and more into account, the Council concludes its report with the following recommendations:

1. The DOL makes explicit that acting prudently with regard to cybersecurity risks is a responsibility of fiduciaries of all employee benefit plans, not just pension plans.
2. The DOL makes clear that the fiduciary duty to act prudently regarding cybersecurity risks includes the duty of health plan fiduciaries to ascertain that their health plan service providers have practices and procedures in effect to deal with such risks. This would include, but not necessarily be limited to, an update to the DOL’s core publication for health plan fiduciaries, Understanding Your Fiduciary Responsibilities Under a Group Health Plan, to address fiduciary duties regarding cybersecurity risks.
3. The DOL clarifies that the Cybersecurity Program Best Practices and Tips for Hiring a Service Provider with Strong Cybersecurity Practices apply to health benefit plan fiduciaries.
4. The DOL indicates the extent to which compliance with HIPAA and HITECH satisfies any of the recommended practices in the Best Practices and Tips publications.
5. The DOL reviews, on a regular and timely basis and updates, if necessary, the Best Practices and Tips so that they reflect changes in those practices in light of the evolving nature of cybersecurity threats.
6. The DOL provides education and materials to health plan sponsors and fiduciaries to assist them in understanding and carrying out these duties, including but not necessarily limited to specific tailored and targeted educational programs and materials to inform plan sponsors and fiduciaries about their ongoing responsibilities and obligations related to cybersecurity and informing plan sponsors and fiduciaries of materials available from other agencies, such as the HIPAA Security Risk Assessment Tool which is designed to assist small-to-medium-sized organizations.

Recommendations such as these by the Advisory Council are, by definition, advisory only. Furthermore, they are directed at the DOL (specifically, the Secretary of the DOL) only, and the DOL can adopt some, all, or none of them at its complete discretion and on its own time.

Nevertheless, these recommendations (along with the report itself) provide tremendous insights regarding the cybersecurity challenges health benefit plans presently face, as well as possible approaches regulators may undertake to address those challenges in the future.

ERISA Advisory Council Report on Cybersecurity Issues Affecting Health Benefit Plans »

On February 27, 2023, the IRS published a proposed rule in the federal register relating to the use of forfeitures in qualified retirement plans, including a deadline for the use of forfeitures in defined contribution plans. Previous guidance and regulations prohibited plan administrators from applying forfeitures arising from severance of employment, death, or for any other reason to increase the benefits any employee would otherwise receive under the plan. Previous regulations also required plan administrators to use those forfeited amounts as soon as possible to reduce the employer's contributions under the plan. However, the agency determined that subsequent regulation that established minimum funding requirements for defined benefits plans made the requirement to use the forfeitures “as soon as possible” infeasible.

Under the proposed rule, plan administrators can use forfeitures in the following ways to:

1. Pay plan administrative expenses;
2. Reduce employer contributions under the plan; or
3. Increase benefits in other participants' accounts in accordance with plan terms.

Note that the proposed rule does not prohibit a plan document from specifying only one use for forfeitures, but the plan may fail operationally if forfeitures in a given year exceed the amount that may be used for that one purpose.

The proposed rule also requires that plan administrators use forfeitures no later than 12 months after the close of the plan year in which the forfeitures are incurred.

The proposed regulations will apply for plan years beginning on or after January 1, 2024. Thus, for example, the deadline for the use of defined contribution plan forfeitures incurred in a plan year beginning during 2024 will be 12 months after the end of that plan year. Taxpayers, however, may rely on these proposed regulations for periods preceding the applicability date.

The agency asks for comments within 90 days from February 27, 2023. The agency specifically asks for comments concerning:

• Whether the rules for the use of forfeitures in defined benefit and defined contribution plans can be further simplified to reduce administrative costs and burdens; and
• Whether any issues arise concerning other unallocated amounts (in addition to forfeitures) with respect to qualified retirement plans, and if issues do arise, whether guidance should be provided addressing those issues.

Retirement plan sponsors should be aware of this proposed rule and monitor developments.

Federal Register: Use of Forfeitures in Qualified Retirement Plans »

SECURE 2.0, which we covered in detail in our January 5, 2023, edition of Compliance Corner, delayed the required beginning date for required minimum distributions (RMDs) for IRA owners. IRS Notice 2023-23 provides relief for financial institutions tasked with filing Form 5498 (IRA Contribution Information) for individuals for whom an RMD would have been due in 2023 had the delay under SECURE 2.0 not occurred.

However, the delayed beginning date may result in some financial institutions sending Form 5498 erroneously. Therefore, as long as the IRA owner is notified by the financial institution no later than April 28, 2023, that an RMD is not actually required for 2023, the financial institution will be in compliance.

The IRS encourages financial institutions to clearly communicate these RMD changes to affected individuals.

IRS Notice: Relief for Reporting Required Minimum Distributions for IRAs for 2023 »

In both cases corrections are necessary. Generally, if the corrections are made before the 2022 income tax filing deadline, which is April 18, 2023, for most taxpayers, the process is greatly simplified. We can provide general information regarding the correction process for each situation. However, the employee and employer should consult with a tax advisor or counsel for specific advice and guidance.

Correction of Excess HSA Contribution

The 2022 contribution limit is $3,650 for self-only coverage and $7,300 for any tier of coverage other than self-only. Those aged 55 and older by the 2022 calendar year-end are permitted an additional catch-up contribution of $1,000.

Generally, an individual’s maximum annual contribution is limited by the number of months they were eligible for the HSA. Medicare coverage is impermissible for HSA eligibility purposes. So, when an employee enrolls in Medicare mid-year, their HSA annual contribution limit must be prorated. For example, an employee who was otherwise HSA-eligible but enrolled in Medicare on July 1, 2022, could not contribute more than half of the applicable maximum for the coverage tier ($1,825 for self-only coverage or $3,650 for coverage other than self-only) plus half of the $1,000 catch-up contribution ($500).

An employee’s HSA contribution that is greater than their 2022 applicable maximum is considered an “excess” contribution and should be removed from the HSA. Therefore, the employee should contact the HSA custodian promptly to request that the excess contribution and applicable earnings be removed from the HSA. These amounts would then be included in the employee’s gross income. If the employee fails to remove the excess contribution by the income tax filing deadline, an additional 6% penalty applies for each tax year the excess remains in the account.

IRS Publication 969 (2022), Health Savings Accounts and Other Tax-Favored Health Plans provides further information on excess contributions.

HSA Contribution for a Prior Year

Individuals who were HSA-eligible in 2022 have until the tax filing deadline to make or receive HSA contributions. So, 2022 HSA contributions, including employer contributions, must be made by April 18, 2023.

In the situation described, the employer should notify both the employee and HSA custodian that they will be making an HSA contribution for 2022. The employer should follow any specific instructions provided by the custodian to ensure the HSA contribution is designated for the prior year.

Both the employer and employee should review the proper reporting of the prior year HSA contribution with a tax advisor. Generally, the employer would report the prior year HSA contribution on the employee’s 2023 Form W-2. The employee would include this prior year contribution (along with any other HSA contributions reported on their 2022 Form W-2) when completing the 2022 IRS Form 8889, which is used to report HSA contributions and distributions, and subtract it (from the HSA contribution amount reported on their 2023 Form W-2) when completing the 2023 IRS Form 8889.

Once the 2022 income tax filing deadline has passed, the employer can no longer make an HSA contribution for 2022.

Accordingly, employers and employees should take action to address 2022 HSA contribution compliance failures before the tax filing deadline.

For further information on HSAs, please download a copy of our publication, Health Savings Accounts: A Guide for Employers.