Hotchkiss Insurance · Employee Benefits Intelligence
The Benefits Brief
For CFOs and HR leaders who don't have time for filler. A monthly read on the regulatory shifts, market moves, and money on the table.
Inside This Issue
01
Cybersecurity Is Now a Health Plan Fiduciary Duty. Most Committees Don't Know It.
PG. 02
02
A New $2,500 Employer Contribution Benefit Just Went Live. Your Board Will Ask About It.
PG. 04
03
2027 Stop-Loss Renewals Are Landing at 30%. The RFP Window Is Open Now.
PG. 06
04
Following Up · What changed since July
PG. 08
05
On My Radar · Three stories worth tracking
PG. 09
01
The Benefits Brief · August 2026Story 01 · Fiduciary Duty
Story 01 · Cybersecurity as Fiduciary Duty
Cybersecurity Is Now a Health Plan Fiduciary Duty. Most Committees Don't Know It.
In January 2026, EBSA named cybersecurity a national enforcement priority. In September 2024, DOL clarified that its cybersecurity guidance applies to all ERISA-covered plans — retirement and health and welfare alike. Most benefits committees have never asked their TPA the questions DOL says they're required to ask.
Enforcement Priority
2026
EBSA named cybersecurity a top enforcement priority in its January 2026 national enforcement plan
DOL Checklist
12
Cybersecurity best practices DOL expects plan fiduciaries to verify with their service providers
Overlapping Regimes
2
HIPAA/HITECH and DOL cybersecurity guidance now apply to self-funded health plans simultaneously
Here is the shift most CFOs missed. In 2021, DOL issued cybersecurity guidance framed around retirement plans. Health plans assumed it didn't apply — they were already covered by HIPAA and HITECH. That reading held until September 6, 2024, when DOL Compliance Assistance Release 2024-01 explicitly confirmed the guidance applies to all ERISA-covered plans, including health and welfare. Then in January 2026, EBSA elevated cybersecurity to a national enforcement priority. The obligation isn't new. The enforcement posture is.
Why This Is a Fiduciary Question, Not an IT Question
Under ERISA, plan fiduciaries have a duty to prudently select and monitor service providers. DOL now says that duty includes cybersecurity. If your TPA gets breached and participant data is exposed, the question isn't whether your IT team failed — it's whether your fiduciary committee documented that it evaluated the TPA's cybersecurity practices before hiring them, and monitored those practices annually. The paperwork trail is the defense.
02
The DOL guidance sets out three documents fiduciaries should be using: Tips for Hiring a Service Provider with Strong Cybersecurity Practices, Cybersecurity Program Best Practices, and Online Security Tips. The first two apply directly to how your benefits committee evaluates TPAs, PBMs, stop-loss carriers, and any vendor holding participant data. The 12 best practices include annual third-party audits, documented incident response plans, and cyber insurance coverage. If your TPA can't answer whether they have all 12, that's the gap.
The overlap with HIPAA matters more than most sponsors realize. HIPAA governs how PHI is handled. DOL cybersecurity guidance governs how the fiduciary selected the entity handling the PHI. They are complementary duties, not substitutes. A TPA can be HIPAA-compliant and still be a prudence-breach hire if the fiduciary committee didn't evaluate its cybersecurity practices at selection. Committees relying on "our TPA is HIPAA-compliant" as their cybersecurity documentation are documenting the wrong thing.
The Question to Ask at Your Next Fiduciary Meeting
"When did we last document our review of the cybersecurity practices of every vendor with access to participant data?" If the answer is never — or references only HIPAA compliance — you have a fiduciary documentation gap. The fix is not complicated. The consequence of not fixing it is a claim that survives a motion to dismiss for the same reason JPMorgan's PBM claim survived: process failures are pleaded around the standing problems that killed earlier cases.
Do Now
Send DOL's Tips for Hiring a Service Provider document to your TPA, PBM, and stop-loss carrier. Request a written response on each of the 12 cybersecurity best practices. This is a 30-day exercise. The written responses become your fiduciary file.
Document
At your next fiduciary committee meeting, add a standing cybersecurity agenda item. Minutes should reflect the annual review of TPA cybersecurity practices. Missing minutes are the same problem as missing minutes on PBM compensation — they become evidence for the wrong side.
Consider
Cyber insurance for the plan itself. Most sponsors carry corporate cyber liability; fewer carry policies naming the ERISA plan and fiduciaries as insureds. If a breach exposes participant data, the corporate policy may not extend to fiduciary liability. A broker conversation worth having before renewal.
03
The Benefits Brief · August 2026Story 02 · New Benefit Decision
Story 02 · Employer Contribution Program
A New $2,500 Employer Contribution Benefit Just Went Live. Your Board Will Ask About It.
OBBBA created a new class of tax-favored savings accounts for children under 18 — formally, Trump Accounts. Employers can contribute up to $2,500 per employee tax-free, effective July 4, 2026. Treasury guidance (REG-101355-26) was released August 11. Vanguard was the first named employer to commit: $1,500 per crew member starting 2027.
Employer Cap
$2.5K
Maximum tax-free employer contribution per employee, per year (indexed after 2027)
Annual Limit
$5K
Combined annual contribution cap per account from all sources — employer, family, and individual
ERISA Status
Not Title I
DOL Technical Release 2026-02 confirms these accounts are not subject to ERISA Title I
Under OBBBA Section 128, employers can offer a contribution program that funds these accounts for their employees' dependents. The accounts are structured as traditional IRAs with special provisions until the beneficiary turns 18, and the federal government adds a one-time $1,000 seed contribution. What makes this different from an FSA, HSA, or 529: contributions are excluded from the employee's income, but the account is owned by the child, not the employee. That structural quirk creates real questions for cafeteria plan integration and W-2 reporting.
Why This Is on Your Radar in August, Not January
Vanguard announced $1,500 per employee for 2027 the same day Treasury guidance dropped. Every mid-market CFO should expect a board or HR question about this in the next 90 days. If you don't have a considered position by open enrollment planning, you'll be reacting under time pressure. The right answer might be no — but it should be a documented no.
04
The complications are real. The proposed regulations (REG-101355-26) establish nondiscrimination testing requirements — if your contribution program favors highly compensated employees, some or all of the exclusion may be disallowed. A separate proposed rule would allow employees to make pre-tax salary-reduction contributions through a Section 125 cafeteria plan, expanding participation but adding administrative lift. Payroll, W-2 reporting, and trustee coordination all need to be built. This is not a benefit you announce Friday and administer Monday.
The strategic case, when it exists, is talent-based. Family formation competes for young-employee attention — most of your workforce with dependents is thinking about childcare costs, 529 plans, and retirement contributions simultaneously. A $2,500 tax-free contribution to a dependent's account signals employer investment in family formation without triggering ERISA fiduciary duty. That's a rare structural feature. Whether it justifies the administrative lift depends on your workforce composition and total rewards positioning.
Do Now
Get in front of the question before it lands on your desk. Draft a one-page internal position: (1) your workforce demographic case, (2) administrative lift estimate, (3) 2027-vs-2028 decision timeline. If the position is "not yet," write down why. If it's "yes," start payroll and trustee coordination now.
Ask This
Of HR: "What percentage of our workforce has dependents under 18, and how does that compare to industry benchmarks?" The strategic case rises or falls on this number. An older or dependent-light workforce makes this low-priority; a young, family-forming one makes it strategic.
Watch
Adoption announcements through Q4. Vanguard was first; Fortune 500 total rewards teams are evaluating in parallel. If two or three peers in your industry announce before your renewal cycle, the competitive pressure shifts. Watch adoption in your talent-competitor set — that's the signal to move.
05
The Benefits Brief · August 2026Story 03 · Stop-Loss Market
Story 03 · 2027 Renewal Reality
2027 Stop-Loss Renewals Are Landing at 30%. The RFP Window Is Open Now.
Carrier loss ratios hit an 8-year high in 2024. Early signals for 2027 renewals point to 30% baseline increases, with some outliers at 50%. If your renewal falls between October and March, your RFP should be in market by the end of August.
2027 Target Increase
30%
Early market signal for baseline 2027 stop-loss renewal targets; some outliers at 50%
BUCA Loss Ratio
90.5%
BUCA carriers' 2024 loss ratio — the highest in 8 years; tightening continues through 2027
Compound Cost Growth
+62%
Employer healthcare cost growth since 2017 (BGH 2026) — structural, not cyclical
Stop-loss carriers priced 2025 and 2026 aggressively and lost. BUCA carriers reported a 90.5% loss ratio in 2024, the highest in 8 years. Tokio Marine HCC's leadership has publicly signaled tightening through 2027 — that's not a warning, it's a forward-looking business plan. The 2027 renewal cycle is where carriers rebuild their books. Mid-market employers with clean claims experience will still see 15–20%; employers with any recent large claims should model 30% as the base case, not the worst case.
The Gap That Decides Your Renewal
Carriers are widening the gap between best risks and average risks. Clean data, documented cost containment, and a clear narrative on high-cost claimants get materially better pricing. Groups that walk into renewal with 60 days of prep get quotes; groups that walk in with 15 days get rate caps. The variable isn't the market — it's preparation. The RFP timeline decides more than the RFP content.
06
The captive question we raised in June is now urgent. Group captives — pooled self-insurance arrangements — are absorbing employers who won't accept open-market pricing at these levels. HUB International's 2026 outlook confirms rising captive interest among mid-market employers, with the structural argument unchanged: rate stability, no-new-laser provisions, and surplus return. The captive is not the cheapest year-one number. It is the model that stops the volatility. For employers on their fourth consecutive year of double-digit increases, that trade is starting to look different.
There is one operational point that gets missed in the captive-vs-open-market conversation. Captive entry has an underwriting window — most captives underwrite new members on a defined intake schedule, often quarterly. If you decide in November to explore a captive for a January 1 renewal, you have already missed the window. The captive question needs to be raised in August or September for a January 1 renewal to be operationally viable. This is not about being convinced. It is about not foreclosing the option.
The Question Your Carrier Expects You Not To Ask
Lasers are the negotiation your carrier expects you to skip. Ask directly what a no-new-laser contract costs. If your carrier will not quote no-new-laser, that is a real signal — not that they will laser you, but that they want the option. Knowing the number changes the negotiation.
Do Now
If your 2027 renewal is October through March, your RFP is late by September 1. Get claims data cleaned this week. Identify your high-cost claimants and document the clinical narrative. Carriers reward the story as much as the numbers.
Ask This
Of your broker, in writing: "Model our 2027 renewal three ways — open-market with current carrier, open-market with three quotes, and captive entry — over a 5-year horizon. Show me year-over-year volatility, not just year-one premium." If they can't produce this, that itself is the finding.
Consider
Raise the captive question now — in August or September. Not because you're convinced, but because the intake window for a January 1 renewal closes long before November. Keeping the option open costs nothing; foreclosing it by inaction is the expensive default.
07
The Benefits Brief · August 2026Following Up · On My Radar
Following Up
What changed since July.
Three open loops from last issue. One closed. One went live. One took a genuinely new turn worth extended coverage.
The fertility rule comment period closed July 13.
Comments are in; the Departments are now reviewing before finalization. Industry submissions predictably focused on the HSA coordination question we flagged — trade associations urged Treasury to address whether excepted fertility benefit enrollment disqualifies HDHP participants from HSA contributions. Final rule expected before plan year 2027. If you commented, thank you. If you did not, monitor the final rule for the HSA answer — it decides whether adoption is workable for employers with meaningful HDHP populations.
The IDR Operations rule took effect August 3.
The $15 IDR fee has been live since June 11; portal registration functionality goes live 90 business days after the Departments issue technical guidance. Dispute volume is up materially in Q3. If your TPA has not confirmed readiness in writing, that ask is now overdue. The CARC/RARC coding requirement is where most operational failures show up first — watch for ineligible disputes reaching your plan that should have been screened out at the remittance level.
ERISA fiduciary suits now naming brokers and consultants.
A string of late-2025 filings against LabCorp / Allied Universal sued not only plan sponsors but also Willis Towers Watson, Mercer, and Lockton as defendants. This is a departure from the PBM cases (J&J, Wells Fargo, JPMorgan), where only sponsors were named. The theory rides on CAA 2021 broker compensation disclosure requirements. The plaintiffs' bar is expanding the defendant pool. If your broker cannot produce their CAA 2021 disclosure on request, that is now a plan sponsor risk — not just a broker risk.
08
The Benefits Brief · August 2026On My Radar
On My Radar
Three stories worth tracking before they become your problem.
Not yet ready for full coverage. Each one will shape someone's 2027 renewal — and the employers who see them coming get the cheaper outcome.
01
PBM Compensation Disclosure
New PBM disclosure rule effective for plan years on or after July 1.
Self-insured ERISA plans must now secure annual PBM compensation disclosures before contract execution, including estimates of non-transparent compensation. A larger disclosure regime for 100+ employee plans arrives August 3, 2028. The immediate lift is small; the fiduciary implication is not. Every disclosure creates a documented record — and a fiduciary evaluation obligation for anything the disclosure reveals.
02
Mental Health Parity
The 2024 MHPAEA Final Rule remains paused.
DOL's May 2025 nonenforcement position on the 2024 MHPAEA Final Rule is still in effect. The underlying CAA 2021 statutory obligation continues — comparative analyses and NQTL reviews are still required; only the 2024 add-ons are on ice. If your TPA has not delivered a current NQTL analysis, that is still a documentation gap. Nothing about the current DOL posture relieves it.
03
ACA Market Reform
A House bill would exempt ERISA plans from essential health benefits.
The Employer Health Plan Flexibility Act, introduced July 22, would let ERISA plans opt out of ACA essential health benefits requirements. Long odds of passage in current form, but the direction of policy signaling matters. If you have benefit design flexibility questions parked in "waiting on regulation," this is one to watch through fall. A serious markup would change 2028 plan design conversations.
09
Get In Touch
Questions about what you just read? Let's talk.
No sales pitch. No pressure. Just an honest conversation about where your benefits strategy stands — and where it could go.
"The system wasn't built for employers. I help you build one that was."
11