Cybersecurity risk has rapidly emerged as a critical fiduciary consideration for sponsors of ERISA health and welfare plans. As plan operations depend more and more on digital infrastructure and third-party service providers, exposures go beyond an organization’s internal systems.
Recent legal developments, including Department of Labor (DOL) cybersecurity guidance and evolving enforcement priorities and increased fiduciary litigation, signal heightened scrutiny of fiduciary practices, particularly in the areas of vendor oversight and governance. Simultaneously, industry data shows that third-party breaches are a leading driver of cyber losses, reinforcing the need for a proactive and structured approach.
Plan sponsors should prioritize comprehensive cybersecurity risk assessments, with a particular focus on third-party risk, governance and alignment with HIPAA requirements, to mitigate exposure and demonstrate fiduciary prudence.
Why cybersecurity is a fiduciary issue
Under ERISA, fiduciaries are required to act prudently and solely in the interest of plan participants and beneficiaries. This duty extends to safeguarding plan assets, including sensitive participant data such as personally identifiable information (PII) and protected health information (PHI).
The DOL has made clear that fiduciaries must take appropriate steps to manage cybersecurity risks affecting plan data and systems. Moreover, recent enforcement priorities and litigation suggest that cybersecurity failures, particularly those involving service providers, may be subject to heightened regulatory and legal scrutiny.
The foundation: Cybersecurity risk assessments
A comprehensive cybersecurity risk assessment is a foundational element of an effective fiduciary risk management strategy. For ERISA health and welfare plans, this includes:
- Identifying vulnerabilities across systems, processes and data flows
- Evaluating administrative, technical and physical safeguards
- Assessing risk exposure across both internal operations and third-party relationships
- Documenting findings and remediation steps to support fiduciary decision-making
These assessments should be conducted on an ongoing basis to reflect evolving threats, changing vendor relationships and updated regulatory expectations. An initial review during the contracting phase of the relationship is unlikely to be enough.
Integrating HIPAA requirements
ERISA Cybersecurity and HIPAA compliance are closely intertwined for health and welfare plans.
The HIPAA Security Rule requires:
- Formal risk analysis and ongoing risk management
- Access controls and authentication safeguards
- Encryption and secure transmission of ePHI
- Oversight of business associates through contractual protections
However, HIPAA compliance represents a baseline, not a ceiling. ERISA fiduciary standards require plan sponsors to evaluate whether their cybersecurity approach is reasonable and prudent in light of current risks, which may necessitate enhanced controls beyond minimum HIPAA requirements.
Third-party vendors: A primary and quantifiable source of cyber risk
Third-party vendors represent one of the most significant and increasingly measurable, sources of cybersecurity risk for ERISA health and welfare plans.
Industry data highlights the scale of exposure:
- 98% of organizations have relationships with third-party vendors that have experienced a breach
- Third parties are responsible for nearly 50% of data breach losses and 29% of first-party losses
These figures underscore a critical reality: even where internal cybersecurity controls are strong, plan sponsors remain exposed through their vendor ecosystem.
Additionally, as vendors increasingly incorporate AI into core business functions, prudent fiduciary oversight may require sponsors to evaluate not only traditional cybersecurity controls but also AI governance, transparency, data management practices, and compliance controls.
Third-party incidents also tend to create an expanded blast radius, where a single vendor breach affects multiple downstream clients and systems. The interconnected nature of today's benefits administration environment means that vulnerabilities at a recordkeeper, claims administrator, pharmacy benefit manager, wellness vendor, or technology provider can quickly become risks to plan participants, protected health information (PHI) and broader business operations. The resulting impact may take months or even years to fully understand due to complex data flows and interdependencies.
Illustrative impact of third-party breaches
Recent high-profile events across the healthcare and technology sectors show the magnitude of this risk:
- A ransomware attack on a healthcare vendor resulted in about $22 million in ransom payments, with 94% of affected hospitals reporting financial impact and widespread disruption to care delivery
- A third-party compromise at a large public healthcare system led to exfiltration of PHI, billing data, biometric data and identity documentation, creating both regulatory exposure and litigation risk
- A global outage tied to a third-party technology provider disrupted operations across industries, highlighting the systemic risk created by vendor interconnectivity
These events show that third-party breaches can result in:
- Significant financial loss (including ransom payments and remediation costs)
- Regulatory penalties, including potential HIPAA fines
- Operational disruption and business interruption
- Reputational damage and participant trust erosion
Recent legal implications: Expanding fiduciary accountability
Regulators have increasingly aligned enforcement priorities with the realities of third-party risk. The DOL says that ERISA fiduciaries must prudently select and monitor service providers, including evaluating cybersecurity practices.
Recent litigation further reinforces the importance of third-party cybersecurity oversight. Courts have increasingly recognized that cybersecurity failures can give rise to fiduciary breach claims where plan sponsors fail to prudently select, monitor, or oversee service providers. Also, legal precedent has recognized the DOL’s authority to obtain information regarding service provider cybersecurity practices when evaluating whether fiduciaries have satisfied their ERISA duties. As a result, cybersecurity governance should encompass not only a plan sponsor's internal controls, but also the processes used to assess and monitor third-party vendors that handle plan data or support plan operations.
Failure to appropriately assess and monitor vendor cybersecurity practices may expose plan sponsors to fiduciary risk, even where the plan sponsor wasn't the origin of the breach.
Governance and process: Demonstrating fiduciary prudence
Effective cybersecurity risk management requires strong governance and clearly defined processes. Plan sponsors should establish a documented framework that includes:
- Defined roles and responsibilities for cybersecurity oversight
- Formal policies covering risk assessment, incident response and vendor management
- Integration of cybersecurity into broader ERISA governance structures
- Regular reporting to fiduciary committees and leadership
Documentation is critical. Demonstrating a prudent, repeatable process can be essential in the event of regulatory inquiry or litigation.
A practical framework: Document, monitor and mitigate
We recommend a structured approach to cybersecurity risk management:
Document: Governance and process review
Assess and document cybersecurity policies, procedures and vendor oversight frameworks. And identify gaps and align with DOL guidance and HIPAA requirementsMonitor: Ongoing assessment and vendor oversight
Implement consistent processes to evaluate cybersecurity controls and vendor practices, including alignment with recognized frameworks (e.g., NIST, ISO)Mitigate: Risk reduction and contracting
Address identified risks through enhanced controls, stronger contractual protections (e.g., breach notification, audit rights) and, where appropriate, cyberinsurance strategies
This approach supports both operational resilience and fiduciary defensibility.
Key takeaways for plan sponsors
- Cybersecurity is a core fiduciary duty under ERISA not solely an IT function
- Risk assessments are essential to identifying and managing cybersecurity exposure
- Third-party vendors represent the most significant and measurable source of cyber risk
- HIPAA compliance should be integrated into a broader ERISA governance framework
- Strong governance, documentation and ongoing monitoring are required to demonstrate fiduciary prudence
We support plan sponsors in developing and improving cybersecurity risk management strategies through:
- ERISA and HIPAA-focused cybersecurity risk assessments
- Third-party vendor risk evaluation and due diligence
- Cybersecurity governance and policy design aligned with DOL and HIPAA expectations
- Overall plan governance gap assessment and action plan
- Ongoing monitoring and advisory support
Author
