Question
The U.S. Department of Labor (DOL) has listed cybersecurity as an enforcement priority for 2026. Does this apply to health and welfare benefit plans? If so, what should employer plan sponsors consider when assessing the cybersecurity risks to these plans?
Answer
Yes, all employee benefit plans subject to ERISA, including health and welfare benefit plans, are subject to DOL enforcement. ERISA-covered health and welfare plans include medical, dental and vision plans as well as plans that provide life and accidental death and dismemberment insurance, long-term disability benefits, business travel insurance, certain employee assistance programs and wellness programs. Account-based plans, such as health flexible spending accounts and health reimbursement arrangements, are also included.
Under ERISA, plan fiduciaries must act in the best interest of the plan and its participants and beneficiaries and carry out their responsibilities in a prudent manner. A failure to safeguard against cybersecurity threats by maintaining a robust and effective cybersecurity program, which includes selecting service providers with strong cybersecurity practices and diligently monitoring their activities, may be viewed as a breach of fiduciary duty under ERISA.
Recent litigation has focused on employer plan sponsors and the actions they take as health and welfare benefit plan fiduciaries
Recent litigation has focused on employer plan sponsors and the actions they take as health and welfare benefit plan fiduciaries; therefore, it is crucial that plan sponsors properly mitigate cybersecurity risks. They should assess all their health and welfare benefit plans, as well as the vendors that service those plans, for cybersecurity risks and ensure they are acting prudently in protecting plan data, assets and personal information.
Background
The DOL Employee Benefits Security Administration (EBSA) recently updated its national enforcement priorities and projects for fiscal year 2026. On the list is a cybersecurity project that promotes best cybersecurity practices for plans and service providers to protect sensitive information and reduce the risk of fraud and financial loss. As part of its investigations, EBSA will review how plans and service providers protect their systems and data from cyber threats.
EBSA’s cybersecurity project builds on guidance previously issued in 2021 and updated in 2024. The guidance, written for plan sponsors, plan fiduciaries and service providers, is designed to help reduce cybersecurity risks for all ERISA plans and includes the DOL’s best practice recommendations for creating a sound cybersecurity program and maintaining cybersecurity.
Employer plan sponsors are expected to:
- Evaluate the cybersecurity programs of service providers
- Include cybersecurity oversight into their existing processes for monitoring service providers
- Ensure that service providers are maintaining comprehensive cybersecurity programs
Employer plan sponsors and fiduciaries that fail to do so could face increased DOL scrutiny. A breach of fiduciary duties could result in personal liability for losses caused to the plan, civil penalties assessed by the DOL, and civil actions brought by plan participants and beneficiaries.
DOL cybersecurity guidance
Although not binding, the DOL guidance listed below includes tips and best practice recommendations that may help plan sponsors and fiduciaries better manage cybersecurity risks, as well as DOL audit risks:
- Tips for Hiring a Service Provider with Strong Cybersecurity Practices: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires
- Cybersecurity Program Best Practices: Assists plan fiduciaries and recordkeepers in mitigating cybersecurity risks
- Online Security Tips: Offers rules to reduce the risk of fraud and loss for plan participants who check their online health, welfare and retirement accounts
In the event of a DOL audit, employer plan sponsors should be prepared to provide documentation regarding cybersecurity policies, service provider agreements and incident response procedures.
Employer plan sponsors should consider providing plan participants and beneficiaries with a copy of the DOL’s Online Security Tips. Although not required, this is a straightforward way for employer plan sponsors and fiduciaries to demonstrate their commitment to managing cybersecurity risks and helping plan participants and beneficiaries to secure their health and welfare accounts. The Online Security Tips are not subject to ERISA’s distribution requirements, so the notice may be shared through whatever method the plan administrator prefers (e.g., posting on the employer plan sponsor’s intranet, including in an employee newsletter or distributing through email).
Other compliance considerations
Employer plan sponsors should also consider the HIPAA Security Rule when assessing the cybersecurity risks to their health plans. While there is some overlap between the DOL’s cybersecurity program best practices and HIPAA’s security standards for securing electronic protected health information (ePHI), health plans using and disclosing ePHI must comply with the HIPAA Security Rule.
Compliance with HIPAA’s requirements does not necessarily mean that the cybersecurity program complies with ERISA in regard to fiduciary duties. For example, the business associate agreements that are required under HIPAA might not provide sufficient protection from cybersecurity risks. Employer plan sponsors should review both the DOL’s cybersecurity guidance and HIPAA Security Rule when evaluating their business associates’ cybersecurity capabilities.
Note: In December 2024, the U.S. Department of Health and Human Services, Office for Civil Rights issued proposed regulations to amend the HIPAA Security Rule, but final regulations have not been issued as of the date of this writing.
Takeaways
- Employer plan sponsors should review the cybersecurity measures for their health and welfare benefit plans, particularly relating to protecting plan and participant data, and determine whether any changes should be made to align with the DOL’s guidance
- Employer plan sponsors should review the cybersecurity standards, practices and policies of existing service providers to ensure the DOL cybersecurity guidance is being followed and confirm that contracts include provisions that enhance cybersecurity protections
- When evaluating and selecting new service providers, employer plan sponsors should use the DOL’s cybersecurity guidance to help evaluate vendor cybersecurity practices and confirm they sufficiently protect any plan and participant data that will be held by the service provider