Modernizing Compliance: DOL Proposes Safe Harbor for Electronic Group Health Plan Disclosures Under ERISA

The U.S. Department of Labor (DOL) recently proposed a new rule (the “Proposed Rule”) that would offer group health plan administrators an additional safe harbor for electronically furnishing required group health plan disclosures to participants and beneficiaries.

If finalized, the Proposed Rule would give group health plan administrators a modernized alternative to the current, more limited, electronic delivery framework.

What You Need to Know Modeled on Retirement Plan Rules, with a Key Limit: Group health plan administrators would be able to make electronic delivery the default, just as retirement plans have since 2020. However, citing privacy concerns under the Health Insurance Portability and Accountability Act (HIPAA), the Proposed Rule does not permit direct delivery by email. Four Core Requirements to Qualify: Administrators of group health plans under the Employee Retirement Income Security Act of 1974 (ERISA) would need to satisfy four core requirements to rely on the new safe harbor. These include a Notice of Internet Availability (NOIA), a compliant website, unlimited free paper copies with opt-out rights, and an initial paper notice. Comment Deadline and Open Questions: The Proposed Rule is open for public comment through September 21, 2026, with the DOL seeking input on several implementation questions. These include whether to permit direct email delivery and whether the safe harbor should extend to other welfare benefit plans, such as disability or life insurance.

The Proposed Rule is modeled closely on a more permissive notice-and-access safe harbor the DOL previously adopted for retirement plans in 2020 (the “2020 Retirement Plan Safe Harbor”), which makes electronic delivery of retirement plan documents the default, subject to a participant’s right to request paper copies or opt out entirely. At the time, the DOL declined to extend the 2020 Retirement Plan Safe Harbor to group health plans. However, industry groups and practitioners have since urged the DOL to do so, citing administrative inefficiencies of the current rules governing group health plans and the substantial printing and mailing costs that result.

Background: Current Electronic Disclosure Rules Applicable to Group Health Plans

Under Title I of ERISA, group health plan administrators are required to furnish certain documents to plan participants and beneficiaries, including, but not limited to, the summary plan description (SPD), summaries of material modifications, and the summary annual report. (Certain disclosures carry additional delivery requirements—for example, an initial Consolidated Omnibus Budget Reconciliation Act (COBRA) notice to a covered employee’s spouse generally requires the spouse’s own independent consent for electronic delivery.) Under the current safe harbor rules, adopted in 2002 (the “2002 Rules”), in order to furnish documents electronically, a group health plan administrator must first determine whether each participant is “wired at work.” A participant is “wired at work” if regular, work-related access to a computer is an integral part of the participant’s job duties.

Common examples of employees who are considered “wired at work” include those with a desk-based job requiring regular computer use, such as administrative or management staff. By contrast, active employees who work away from a desk, such as those in the retail, hospitality, health care, or agricultural sectors, typically are not considered “wired at work,” even if they occasionally use a shared computer or interact with an electronic medical device as part of their duties.

While “wired at work” participants may receive required disclosures electronically without providing consent, all other participants must affirmatively consent to receive required documents electronically. If affirmative consent is not provided, the documents must be mailed or hand delivered. In any event, all group health plans must still provide a paper copy of any required disclosures upon request.

Determining whether employees qualify as “wired at work” is not always straightforward for group health plan administrators, particularly when access to workplace technology varies by shift, role, or location. Even where this determination can be made with confidence, a substantial share of participants, such as those who work away from a desk, may fall outside the “wired at work” category and are unable to receive documents electronically absent their affirmative consent. Accordingly, while the 2002 Rules provided a pathway for electronic delivery of documents, the categorical and consent requirements of these rules have proven administratively inefficient and costly for many group health plan administrators.

What Plans, Individuals, and Documents Does the Proposed Rule Apply To?

• Covered Plans. The Proposed Rule would add a new safe harbor available only to “group health plans,” as defined under Section 733(a)(1) of ERISA, which include medical, dental, and vision benefits. If an insurer has agreed to provide the Covered Documents (defined below) on behalf of a group health plan administrator, the insurer may also rely on the new safe harbor.
• Covered Individuals. The Proposed Rule defines “Covered Individual” to include any participant, beneficiary, or other individual entitled to Covered Documents who provides the plan with an electronic address, such as an email address or a mobile telephone number. This includes a dependent child who has attained age 18, so long as they provide an electronic address. An electronic address assigned by an employer for other employment-related purposes also qualifies.
• Covered Documents. The Proposed Rule broadly defines “Covered Documents” to include any document required to be furnished under Title I of ERISA, including documents that need only be furnished upon request. This includes, but is not limited to, plan documents, SPDs, summaries of material modifications, summary annual reports, and claims and appeals notices.

The Safe Harbor

The Proposed Rule establishes a notice-and-access safe harbor that allows group health plan administrators to deliver Covered Documents electronically by posting documents on a website and notifying participants of their availability. To rely on the new safe harbor, group health plan administrators would need to satisfy four core requirements:

1. The Notice of Internet Availability. A compliant NOIA must be electronically provided to each Covered Individual every time a Covered Document is posted.
2. Standards for a Compliant Website. Websites on which Covered Documents are posted must comply with certain standards and remain accessible.
3. Requirements for Paper Copies and Opt-Outs. Covered Individuals must be able to request a free paper copy of any Covered Document or globally opt out of electronic delivery.
4. Requirements for Initial Notification. Covered Individuals must receive an initial paper notification before a group health plan administrator may rely on the safe harbor.

Each of these four requirements is discussed in further detail below. The Proposed Rule also includes special rules addressing the continued use of an employee’s electronic address following severance from employment and permitting administrators to combine multiple disclosures into a single annual notice.

1. The Notice of Internet Availability

The Proposed Rule requires the group health plan administrator to electronically furnish a NOIA each time a Covered Document is posted. The NOIA must contain the following:

• A required header reading: “Disclosure About Your Health Plan”;
• Identification of the Covered Document and, when necessary, a brief description of the Covered Document;
• A link either directly to the Covered Document or to a login page that prominently links to the Covered Document;
• Statements of the participant’s right to request a free paper copy and to globally opt out of electronic delivery entirely; and
• A telephone number for the group health plan administrator.

Group health plan administrators may furnish one combined annual NOIA covering multiple Covered Documents, including the SPD, at the time of open enrollment.

2. Standards for a Compliant Website

The Proposed Rule sets minimum standards for the website on which Covered Documents are posted. At a minimum, the website must ensure that the Covered Document is timely posted, remains available for at least one year, and is presented in a format that is readable online, printable, searchable, and capable of being permanently retained. The website must take reasonable measures to protect the confidentiality of personal information to comply with the safe harbor.

The Proposed Rule defines “website” broadly to include any internet or electronic-based information repository, such as a mobile application, to which Covered Individuals have reasonable access. Read together with the confidentiality requirement above, this permits administrators to use an access-restricted, individual-specific repository for documents containing sensitive information, so long as Covered Individuals retain reasonable access to it outside the workplace.

Notably, the Proposed Rule does not permit direct delivery of Covered Documents by email (unlike the 2020 Retirement Plan Safe Harbor). The DOL cited heightened privacy concerns associated with protected health information under HIPAA’s privacy rule as the reason for this limitation.

3. Requirements for Paper Copies and Opt-Outs

Covered Individuals must retain the right, free of charge, to request a paper copy of any Covered Document and to globally opt out of electronic delivery entirely. In contrast to the 2020 Retirement Plan Safe Harbor (which only guarantees one free paper copy of each document upon a participant’s request), the Proposed Rule would require group health plan administrators to provide every requested paper copy of a Covered Document free of charge, without limitation. The group health plan administrator must also establish reasonable procedures for handling such requests. Additionally, the system used to furnish the NOIA must be designed to detect and remedy invalid or inoperable electronic addresses. If the issue cannot be resolved, the affected individual must be treated as having opted out of electronic delivery and provided a paper copy.

4. Requirements for Initial Notification

To rely on the safe harbor, the group health plan administrator generally must furnish an initial notification, on paper, to each Covered Individual explaining that Covered Documents will be provided electronically going forward and describing the Covered Individual’s rights under the new framework. Group health plan administrators are not required to furnish this initial notification on paper to Covered Individuals who were already receiving disclosures electronically under the 2002 Rules before the rule takes effect (i.e., those who are “wired at work” or who have already provided affirmative consent).

What Are the Potential Implications of the Proposed Rule?

• Reduced Administrative Costs. The Proposed Rule would likely generate cost savings for group health plan administrators by reducing printing and mailing costs as electronic delivery becomes the default method of disclosure.
• Enhanced Accessibility of Disclosures. Electronic delivery may improve participants’ ability to locate, search, and retain Covered Documents, particularly through hyperlinks and search functionality that is not available in paper documents. It may also allow participants to access plan information more quickly during time-sensitive situations, such as medical emergencies.
• Continued Uncertainty for Certain Populations. There is uncertainty as to whether electronic disclosure may be less effective for older, rural, or lower-income participants. These individuals may have limited internet or smartphone access and may also struggle to navigate password-protected websites. They retain the right to opt out entirely, though exercising that right may itself require the same technical access and knowledge in question.
• Continued Patchwork of Disclosure Rules. The Proposed Rule does not consolidate or preempt the other electronic delivery frameworks that already govern group health plan disclosures, such as the Summary of Benefits and Coverage rules. As a result, employers that sponsor multiple types of benefit plans will need to continue to monitor and track different electronic disclosure standards depending on the type of plan and disclosure at issue. The safe harbor also does not extend to plans providing only life, disability, or similar benefits. Consequently, it is not clear how this safe harbor will apply to a “wrap” SPD, a single document that covers both group health plan benefits and life or disability coverage.

Open Questions and Comment Period

The Proposed Rule is open for public comment for 60 days, through September 21, 2026. The DOL solicits comments generally and on the following specific questions:

• Are certain types of participants less likely to use electronic disclosures?
• Is furnishing the initial notice electronically, as opposed to on paper, enough to make sure individuals understand their new rights?
• What percentage of plan participants currently receive plan documents and notices electronically, and how might that change under the Proposed Rule?
• What data or estimates exist comparing the frequency of fraud or loss of personally identifiable or protected health information under mailed versus electronic disclosure methods?
• Should group health plan administrators be permitted to deliver Covered Documents directly by email, consistent with the option currently available to pension plan administrators under the 2020 Retirement Plan Safe Harbor?
• Should the safe harbor established under the Proposed Rule be extended to other employee welfare benefit plans not currently within its scope (e.g., disability, life, etc.)?
• Should the applicability date be sooner, given that use of the safe harbor is optional, or later, to safeguard participants and beneficiaries from potential harm if administrators rely on it too soon?

A close reading of the Proposed Rule also raises an additional open question not directly addressed by the DOL's request for comments: “What standard should apply in determining whether a private, non-public website or portal satisfies the 'reasonable access' requirement for Covered Individuals located outside the workplace?”

What Group Health Plan Administrators Should Do Now

The Proposed Rule, if finalized, would offer group health plan administrators an additional method of satisfying ERISA’s disclosure requirements electronically, providing relief for many who find the current rules cumbersome. In the interim, group health plan administrators may continue to rely on the existing 2002 Rules or paper delivery. In anticipation of a final rule, administrators should also give thought to preparing for compliance with updated regulations and do the following:

• Consider which Covered Documents might be suitable for delivery under the new framework, and which website, notice, and recordkeeping practices would need to be established or updated to satisfy regulatory conditions.
• Plan for the operational infrastructure the safe harbor requires. Using the new safe harbor will depend on having a system in place to track and honor opt-out elections. This is not a new challenge: the 2002 Rules already require that any participant who affirmatively consents to electronic delivery be given the ability to withdraw that consent at any time, and this requirement has proven to be an operational hurdle for many employers.
• Expect to design a system for detecting and remedying invalid or inoperable electronic addresses to comply with the Proposed Rule. This may prove to be a heavier operational lift than the DOL’s cost estimates assume.
• Be aware that the Proposed Rule does not address compliance with other relevant laws, such as HIPAA’s privacy and confidentiality requirements, or alter the content, timing, or notice-specific requirements applicable to any disclosure, such as the COBRA example noted earlier. Each of these obligations continues to apply independently of the safe harbor.

We will monitor the rulemaking process as it develops and provide updates as they occur.

* * * *

For additional information about the issues discussed in this Insight, please contact the attorney(s) listed on this page or the Epstein Becker Green Employment, Labor & Workforce Management attorney who regularly handles your legal matters.

Gianna Ferraro, a Summer Associate—not admitted to practice—in Epstein Becker Green’s Pittsburgh office, and Staff Attorney Elizabeth A. Ledkovsky contributed to the preparation of this Insight.