Cybersecurity & Compliance
Employers today face more than plan administration and reporting deadlines. They also need to pay attention to operational compliance, vendor accountability, cybersecurity controls, and regulatory filing requirements that support a more secure and better-documented benefits environment.
Compliance Priorities for Employers
A strong compliance process includes more than annual notices. It should also address testing, internal plan operations, vendor oversight, and ongoing deadline tracking so problems can be identified before they turn into penalties, corrections, or administrative issues.
Nondiscrimination Testing
Conduct nondiscrimination testing and make any necessary adjustments for highly compensated or key employees prior to plan year-end.
Operational Compliance Audit
Audit plan operations for compliance with ERISA, COBRA, HIPAA, ACA, and MHPAEA to confirm your documentation, administration, and processes are aligned.
Service Provider Oversight
Confirm that carriers, TPAs, PBMs, and other service providers are meeting their contractual and compliance obligations. Request NQTL comparative analysis, fee disclosures, and other documentation as needed.
Compliance Calendar Management
Prepare or update a compliance calendar to track notice distribution and filing deadlines, including Form 5500, ACA reporting, and the Gag Clause Attestation.
What to Review
- Eligibility rules and plan administration
- Required notices and filing deadlines
- Vendor contracts and service commitments
- Testing results and correction opportunities
Why It Matters
- Reduces risk of penalties and corrections
- Improves plan consistency and documentation
- Supports fiduciary and administrative oversight
- Helps prevent missed deadlines
Best Practice
- Review responsibilities before renewal season
- Document who owns each task
- Confirm outside vendors are delivering as promised
- Keep a central calendar for annual compliance activity
Cybersecurity Regulation Updates & Reminders
Cybersecurity expectations continue to evolve, and covered entities should review whether current policies, access controls, scanning practices, and annual filing requirements remain aligned with the latest regulatory standards.
Annual Compliance Submissions Due by April 15
Covered entities subject to the cybersecurity regulation should review their filing obligations through the DFS portal and determine whether they will submit a Certification of Material Compliance or an Acknowledgement of Noncompliance.
- A Certification of Material Compliance confirms that the entity materially complied with applicable regulation requirements during the prior year.
- An Acknowledgement of Noncompliance identifies the sections not met and includes a remediation timeline.
- Covered entities with a full exemption generally do not file an annual compliance notification.
- Covered entities with limited exemptions still must submit annual compliance notifications.
Omnia Benefits Reminder
April 15 is an important annual checkpoint for covered entities reviewing cybersecurity compliance obligations.
This is also a good time to confirm documentation, exemptions, remediation plans, and internal ownership of the filing process.
Access Privileges & Management
Covered entities without a full exemption should review access management controls and strengthen account oversight.
- Limit user access privileges, including privileged account access.
- Review access regularly and remove accounts that are no longer necessary.
- Disable or securely configure protocols that permit remote control of devices.
- Promptly terminate access after personnel departures.
- Implement a reasonable written password policy where passwords are used.
Vulnerability Management
Vulnerability management should include a structured process for discovering, analyzing, and reporting weaknesses across systems.
- Conduct automated scans of information systems.
- Perform manual review of systems not covered by automated scanning.
- Set scanning frequency based on risk assessment.
- Perform prompt review after material system changes.
Malicious Code Protection
Covered entities should maintain controls designed to detect, prevent, and respond to malicious code across relevant systems and endpoints.
- Implement controls that protect against malicious code.
- Review these controls in connection with your broader risk assessment and system monitoring practices.
- Coordinate technical controls with vendor and internal security responsibilities.
Monitoring & Training
Class A entities face additional expectations around technical monitoring and centralized visibility into security events.
- Implement an endpoint detection and response solution to monitor anomalous activity.
- Implement a centralized logging and security event alert solution.
- CISOs may approve reasonably equivalent or more secure compensating controls in writing.
- Confirm training, documentation, and internal sign-off procedures are current.
Practical reminder: Cybersecurity compliance is not just about submitting an annual filing. It also involves user access controls, vulnerability review, malicious code protection, monitoring, documentation, and clear accountability for ongoing remediation where needed.
Need Help Reviewing Compliance Responsibilities?
Omnia Benefit Partners can help employers better organize benefits compliance responsibilities, renewal preparation, reporting timelines, and key operational review areas so important requirements do not get overlooked.