For CFOs and HR leaders who don't have time for filler. A monthly read on the regulatory shifts, market moves, and money on the table.
In January 2026, EBSA named cybersecurity a national enforcement priority. In September 2024, DOL clarified that its cybersecurity guidance applies to all ERISA-covered plans — retirement and health and welfare alike. Most benefits committees have never asked their TPA the questions DOL says they're required to ask.
Here is the shift most CFOs missed. In 2021, DOL issued cybersecurity guidance framed around retirement plans. Health plans assumed it didn't apply — they were already covered by HIPAA and HITECH. That reading held until September 6, 2024, when DOL Compliance Assistance Release 2024-01 explicitly confirmed the guidance applies to all ERISA-covered plans, including health and welfare. Then in January 2026, EBSA elevated cybersecurity to a national enforcement priority. The obligation isn't new. The enforcement posture is.
The DOL guidance sets out three documents fiduciaries should be using: Tips for Hiring a Service Provider with Strong Cybersecurity Practices, Cybersecurity Program Best Practices, and Online Security Tips. The first two apply directly to how your benefits committee evaluates TPAs, PBMs, stop-loss carriers, and any vendor holding participant data. The 12 best practices include annual third-party audits, documented incident response plans, and cyber insurance coverage. If your TPA can't answer whether they have all 12, that's the gap.
The overlap with HIPAA matters more than most sponsors realize. HIPAA governs how PHI is handled. DOL cybersecurity guidance governs how the fiduciary selected the entity handling the PHI. They are complementary duties, not substitutes. A TPA can be HIPAA-compliant and still be a prudence-breach hire if the fiduciary committee didn't evaluate its cybersecurity practices at selection. Committees relying on "our TPA is HIPAA-compliant" as their cybersecurity documentation are documenting the wrong thing.
OBBBA created a new class of tax-favored savings accounts for children under 18. Employers can contribute up to $2,500 per employee tax-free, effective July 4, 2026. Treasury guidance (REG-101355-26) was released August 11. Vanguard was the first named employer to commit: $1,500 per crew member starting 2027.
Under OBBBA Section 128, employers can offer a contribution program that funds these accounts for their employees' dependents. The accounts are structured as traditional IRAs with special provisions until the beneficiary turns 18, and the federal government adds a one-time $1,000 seed contribution. What makes this different from an FSA, HSA, or 529: contributions are excluded from the employee's income, but the account is owned by the child, not the employee. That structural quirk creates real questions for cafeteria plan integration and W-2 reporting.
The complications are real. The proposed regulations (REG-101355-26) establish nondiscrimination testing requirements — if your contribution program favors highly compensated employees, some or all of the exclusion may be disallowed. A separate proposed rule would allow employees to make pre-tax salary-reduction contributions through a Section 125 cafeteria plan, expanding participation but adding administrative lift. Payroll, W-2 reporting, and trustee coordination all need to be built. This is not a benefit you announce Friday and administer Monday.
The strategic case, when it exists, is talent-based. Family formation competes for young-employee attention — most of your workforce with dependents is thinking about childcare costs, 529 plans, and retirement contributions simultaneously. A $2,500 tax-free contribution to a dependent's account signals employer investment in family formation without triggering ERISA fiduciary duty. That's a rare structural feature. Whether it justifies the administrative lift depends on your workforce composition and total rewards positioning.
Carrier loss ratios hit an 8-year high in 2024. Early signals for 2027 renewals point to 30% baseline increases, with some outliers at 50%. If your renewal falls between October and March, your RFP should be in market by the end of August.
Stop-loss carriers priced 2025 and 2026 aggressively and lost. BUCA carriers reported a 90.5% loss ratio in 2024, the highest in 8 years. Tokio Marine HCC's leadership has publicly signaled tightening through 2027 — that's not a warning, it's a forward-looking business plan. The 2027 renewal cycle is where carriers rebuild their books. Mid-market employers with clean claims experience will still see 15–20%; employers with any recent large claims should model 30% as the base case, not the worst case.
The captive question we raised in June is now urgent. Group captives — pooled self-insurance arrangements — are absorbing employers who won't accept open-market pricing at these levels. HUB International's 2026 outlook confirms rising captive interest among mid-market employers, with the structural argument unchanged: rate stability, no-new-laser provisions, and surplus return. The captive is not the cheapest year-one number. It is the model that stops the volatility. For employers on their fourth consecutive year of double-digit increases, that trade is starting to look different.
There is one operational point that gets missed in the captive-vs-open-market conversation. Captive entry has an underwriting window — most captives underwrite new members on a defined intake schedule, often quarterly. If you decide in November to explore a captive for a January 1 renewal, you have already missed the window. The captive question needs to be raised in August or September for a January 1 renewal to be operationally viable. This is not about being convinced. It is about not foreclosing the option.
Three open loops from last issue. One closed. One went live. One took a genuinely new turn worth extended coverage.
Comments are in; the Departments are now reviewing before finalization. Industry submissions predictably focused on the HSA coordination question we flagged — trade associations urged Treasury to address whether excepted fertility benefit enrollment disqualifies HDHP participants from HSA contributions. Final rule expected before plan year 2027. If you commented, thank you. If you did not, monitor the final rule for the HSA answer — it decides whether adoption is workable for employers with meaningful HDHP populations.
The $15 IDR fee has been live since June 11; portal registration functionality goes live 90 business days after the Departments issue technical guidance. Dispute volume is up materially in Q3. If your TPA has not confirmed readiness in writing, that ask is now overdue. The CARC/RARC coding requirement is where most operational failures show up first — watch for ineligible disputes reaching your plan that should have been screened out at the remittance level.
A string of late-2025 filings against LabCorp / Allied Universal sued not only plan sponsors but also Willis Towers Watson, Mercer, and Lockton as defendants. This is a departure from the PBM cases (J&J, Wells Fargo, JPMorgan), where only sponsors were named. The theory rides on CAA 2021 broker compensation disclosure requirements. The plaintiffs' bar is expanding the defendant pool. If your broker cannot produce their CAA 2021 disclosure on request, that is now a plan sponsor risk — not just a broker risk.
Not yet ready for full coverage. Each one will shape someone's 2027 renewal — and the employers who see them coming get the cheaper outcome.
Self-insured ERISA plans must now secure annual PBM compensation disclosures before contract execution, including estimates of non-transparent compensation. A larger disclosure regime for 100+ employee plans arrives August 3, 2028. The immediate lift is small; the fiduciary implication is not. Every disclosure creates a documented record — and a fiduciary evaluation obligation for anything the disclosure reveals.
DOL's May 2025 nonenforcement position on the 2024 MHPAEA Final Rule is still in effect. The underlying CAA 2021 statutory obligation continues — comparative analyses and NQTL reviews are still required; only the 2024 add-ons are on ice. If your TPA has not delivered a current NQTL analysis, that is still a documentation gap. Nothing about the current DOL posture relieves it.
The Employer Health Plan Flexibility Act, introduced July 22, would let ERISA plans opt out of ACA essential health benefits requirements. Long odds of passage in current form, but the direction of policy signaling matters. If you have benefit design flexibility questions parked in "waiting on regulation," this is one to watch through fall. A serious markup would change 2028 plan design conversations.
Cybersecurity is now an ERISA fiduciary duty, not just an IT concern. Get written responses from your TPA, PBM, and stop-loss carrier on the 12 DOL best practices, and add a standing cybersecurity item to your fiduciary committee agenda. The paperwork is the defense.
The board or HR question is coming — have a considered answer before it lands. If yes, start payroll and trustee coordination now for 2027; if no, document why. Either position is defensible; not having one is not.
2027 stop-loss is landing at 30% baseline. Get claims data cleaned, document your high-cost claimants, and ask your broker to model open-market vs. captive over a 5-year horizon. Preparation, not market conditions, decides your quote.
No sales pitch. No pressure. Just an honest conversation about where your benefits strategy stands — and where it could go.
"The system wasn't built for employers. I help you build one that was."
The Benefits Brief · August 2026 · Hotchkiss Insurance
Every edition of The Benefits Brief, one click away.
The Benefits Brief · Tess McCoy · Hotchkiss Insurance · Houston, Texas