Employee Benefit Plans: Important Considerations for Year-End and 2025

RETIREMENT PLANS 

For 2024, there are no required amendments to be adopted by year end (unless the plan sponsor implemented discretionary changes that require amendment by year end). However, the SECURE 2.0 Act of 2022 (SECURE 2.0) included numerous mandatory and optional provisions that are effective now, including:

Mandatory Changes 

• Increased RMD age. SECURE 2.0 increased the required minimum distribution (RMD) age to 73 for individuals who attain age 73 after December 31, 2022. This change applies to 401(k) plans, 403(b) plans, and pension plans (although many pension plans require participants to commence benefits well in advance of their RMD age). For 401(k) plans and 403(b) plans, your plan’s recordkeeper has already implemented this change in plan operations.
• No more pre-death RMDs on Roth contributions. Effective January 1, 2024, SECURE 2.0 allows participants with Roth contributions to avoid pre-death RMD distributions on these Roth amounts. This change applies to 401(k) and 403(b) plans. Your plan’s recordkeeper should have already implemented this change.
• Long-term part-time employee eligibility. SECURE 2.0 allows part-time employees who complete 500 hours of service in the past two consecutive plan years (reduced from three years under the Setting Every Community Up for Retirement Enhancement Act of 2019 (SECURE 1.0)) and are at least 21 years of age to make deferrals to a 401(k) or 403(b) plan. This change is generally effective for plan years starting after December 31, 2024. Though plan sponsors should already be tracking hours, as required under SECURE 1.0, it is important that plan sponsors bring this issue to the recordkeeper’s attention. This change may also impact the vesting and nondiscrimination testing provisions of your plan document. (For more information, see our series on this topic.).

Optional Changes 

• Increased catch-up contributions. Effective January 1, 2025, plan sponsors may allow participants who attain ages 60, 61, 62, and 63 during the calendar year to make catch-up contributions up to the greater of $10,000 (indexed) or 150% of the regular catch-up limit. For 2025, the “enhanced” catch-up contribution limit for this group is $11,250. This change applies to 401(k) plans and 403(b) plans. This change may require additional efforts from the plan sponsor’s payroll and/or human resources information system team. However, this design change can be valuable for recruiting and retaining employees by allowing participants to put away even more for retirement.
• Increased cash-out limit. Effective January 1, 2024, plan sponsors may increase the cash-out limit for small accounts under a 401(k), 403(b), or pension plan from $5,000 to $7,000. Many plan sponsors have already implemented this change in practice.
• Federally declared disaster relief. Effective for distributions after enactment of SECURE 2.0, the plan sponsor may allow participants impacted by federally declared disasters to request distributions of up to $22,000, which are not subject to the 10% early withdrawal penalty. Further, the maximum loan amount that a participant can take may also be increased to $100,000 (or 100% of their vested account, if less) and the loan repayment period can be extended by one year. This optional provision applies to 401(k) plans and 403(b) plans. Many plan sponsors are implementing these features to provide more flexibility to participants.
• New penalty-free distributions. SECURE 2.0 included various new distributions not subject to the 10% early withdrawal penalty, including distributions to victims of domestic violence up to the lesser of $10,000 (indexed) or 50% of the vested account (effective for distributions after December 31, 2023), for emergency expenses up to $1,000 per year (effective for distributions after December 31, 2023), and to pay for long-term care insurance (effective for distributions after date of enactment). Plan sponsors should expect their recordkeeper to contact them regarding implementation of some or all of these penalty-free withdrawals.
• Automatic portability. Without automatic portability, plan sponsors may automatically cash out small account balances of $7,000 or less into a default individual retirement account. Under SECURE 2.0, automatic portability allows plan sponsors, through the use of a clearinghouse, to transfer a participant’s balance from their retirement plan into the retirement plan sponsored by the participant’s new employer, absent a participant election to the contrary. This change is effective one year after enactment of SECURE 2.0 and applies to 401(k) and 403(b) plans. Because this change is optional, plan sponsors must opt into automatic portability through the plan’s recordkeeper. If a plan sponsor opts in, they must allow rollovers into their plan from other plans. Adding automatic portability is intended to help low-income workers, especially minorities, women, and young people, to stay connected to their funds and save for retirement. Plan sponsors should discuss this potential change with their recordkeepers and their fiduciary bodies before proceeding. Plan sponsors should also make sure they understand the potential gaps in the automatic portability process, such as the current inability to accommodate an automatic transfer of Roth and after-tax contributions.

Action Items:

• Plan sponsors should engage in conversations with their recordkeeper about implementation of the many optional provisions under SECURE 2.0. Please note that some recordkeepers and vendors are automatically implementing certain optional changes unless the plan sponsor affirmatively opts out.
• Plan sponsors should review their benefits governance documents to determine who has been delegated authority to make decisions about the implementation of optional provisions.
• Plan sponsors should keep good records of decisions about optional provisions, including the effective dates of any implementations. In the event the plan sponsor maintains an individually designed plan, it will be especially important to share these records with legal counsel tasked with drafting the SECURE 2.0 amendment prior to the December 31, 2026, deadline.
• Though SECURE 2.0 plan amendments are not due until December 31, 2026, plan sponsors should update the plan’s summary plan description to include any SECURE 2.0 changes already in effect.

HEALTH AND WELFARE PLANS 

Health Insurance Portability and Accountability Act (HIPAA) Reproductive Healthcare Rights 

In April 2024, the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced the final HIPAA Privacy Rule To Support Reproductive Health Care Privacy. Under the final rule, covered entities, such as group health plans, are now prohibited from using or disclosing protected health information (PHI) potentially related to reproductive healthcare if it is sought to (i) conduct a criminal, civil, or administrative investigation; (ii) impose criminal, civil, or administrative liability; or (iii) identify any person for the purpose of investigating or imposing liability. The prohibition applies only if the reproductive healthcare is (i) lawful in the state where the care is provided and under the circumstances in which it is provided; (ii) protected, required, or authorized by federal law; or (iii) provided by a third party and the rule’s presumption applies. Reproductive healthcare is presumed to be lawful unless the covered entity has actual knowledge or factual information to the contrary.

Each time a request for PHI potentially related to reproductive healthcare is made, the covered entity is required to obtain a signed attestation that meets very specific requirements. The attestation is intended to confirm that the request is not for a prohibited purpose and to acknowledge that improper use and disclosure of PHI could result in criminal penalties. The attestation requirement is effective December 23, 2024. The final rule also requires covered entities to update their HIPAA Notice of Privacy Practices (NPP) to inform individuals about these new protections. Plan sponsors have until February 16, 2026, to update the NPP.

Action Items:

• By December 23, 2024, plan sponsors should prepare a reproductive health PHI attestation form. HHS has provided a model attestation that can be adapted for this purpose.
• By December 23, 2024, plan sponsors should consider updating the group health plan’s HIPAA policies and procedures, business associate agreements, and annual HIPAA training for the reproductive healthcare requirements.
• For existing business associate agreements, by December 23, 2024, plan sponsors should consider amending any existing business associate agreements or, at a minimum, ensuring the business associate agreement contains general provisions requiring compliance with HIPAA, as amended, and contacting all plan vendors to ensure there is a process in place to handle any requests for reproductive healthcare PHI. The reproductive health requirements should be included in all applicable new business associate agreements going forward.
• Plan sponsors should work on updating the NPP by no later than February 16, 2026, and should consider whether to update sooner because of the rules taking effect much sooner. Any material updates to the NPP will need to be distributed to participants.

Section 408(b)(2)(B) Fee Disclosures

A hot topic in recent benefits news has been health and welfare fee litigation. Recent lawsuits have been filed for breach of fiduciary duty regarding the management of health plans. The suits allege that companies failed to prudently monitor their pharmacy benefit manager (PBM) and act in the best interest of participants by allowing them to overpay for prescription drugs. These lawsuits have further raised concerns about the indirect compensation that health plan vendors receive. Given recent activity in the plaintiffs’ bar, we only expect there to be more of these types of cases.

Part of the reason for the increase in lawsuits is a provision in the Consolidated Appropriations Act, 2021 (CAA) that extended the Section 408(b)(2) fee disclosure rules applicable to retirement plans to health and welfare plans. The CAA requires brokers and consultants receiving at least $1,000 in fees or commissions, either directly or indirectly, for performing certain services for group health plans to disclose their compensation to clients. The US Department of Labor (DOL) has interpreted the meaning of brokers and consultants very broadly, while those who might be classified as such have at times pushed back and argued they are not subject to the new disclosure requirements. However, even absent a direct application of 408(b)(2), plan fiduciaries still have a duty to understand the nature of fees paid by the plan, particularly as it relates to the use of plan assets.

Action Items:

• Plan sponsors should confirm that each health and welfare plan vendor is providing a fee disclosure specific to the plan. Because many health and welfare plan vendors are not proactively sending these disclosures, plan sponsors should consider whether to proactively reach out to request disclosures. Plan sponsors should keep documentation of their efforts to elicit these disclosures.
• Plan sponsors should have the plan’s named fiduciary – ideally, a fiduciary committee delegated from the board of directors – review the fee disclosures for reasonableness and to ensure they understand the nature and source of health and welfare plan fees that are paid with plan assets. At times, this task may involve hiring a third-party consultant for assistance.
• Plan sponsors should consider updating board delegations to clearly delegate health and welfare plan governance. Once the delegation is properly in effect, plan sponsors should consider an annual report on fee disclosures to be done at a committee meeting.
• Plan sponsors should conduct comprehensive, periodic, and well-documented fiduciary training for all plan fiduciaries (e.g., committee members) to ensure they are well-informed and capable of fulfilling their duties.

Mental Health Parity 

On September 9, 2024, the US Departments of the Treasury and Labor (DOL) and HHS released 550 pages of final regulations under the Mental Health Parity and Addiction Equity Act. The final rules largely track the proposed rules that came out in July 2023. The final rule codifies the requirement that health plans prepare a comparative analysis to measure the impact of non-quantitative treatment limitations (NQTLs). The final rule also requires plans and issuers to collect and evaluate relevant data in a manner reasonably designed to assess the impact of the NQTL on relevant outcomes related to access to mental health condition or substance use disorder benefits and medical/surgical benefits. We predict that there will be stronger enforcement by the DOL and HHS in this area going forward.

Action Items:

• Plan sponsors should begin working to update their existing comparative analysis to comply with the final rules, particularly those requirements first taking effect on January 1, 2025.
• Plan sponsors who have not already done so must prepare a comparative analysis, a document that has been required since early 2021. This analysis should be updated on a regular basis and be provided to plan participants and the government upon request. The comparative analysis is not quick or easy to complete and oftentimes plan sponsors face roadblocks with plan vendors and third-party administrators who refuse to provide the information necessary to complete the analysis.
• Plan sponsors should actively review the comparative analysis once available and determine whether any design changes or operational changes are needed to create parity.
• Beginning in 2025, plan fiduciaries, including for fully insured plans, will need to provide a fiduciary certification of the mental health parity items addressed above.

Cybersecurity

In April 2021, the DOL issued a three-part series of guidance related to cybersecurity for retirement plan sponsors. The guidance included (i) Tips for Hiring a Service Provider (for plan sponsors and fiduciaries), (ii) Cybersecurity Program Best Practices (for recordkeepers and other service providers), and (iii) Online Security Tips (for participants). On September 6, 2024, the DOL published Compliance Assistance Release No. 2024-01, “Cybersecurity Guidance Update,” which formally extended this cybersecurity guidance to group health and welfare plans. The DOL has already added extensive questions related to cybersecurity to its audits.

Action Items:

• Plan sponsors should be conducting periodic reviews of the cybersecurity programs of its service providers and implementing cybersecurity best practices internally.

Miscellaneous Updates 

• Consider reviewing any tobacco-cessation programs for compliance in light of recent litigation.
• For group health plans, submit a “gag clause” attestation by the December 31, 2024, deadline.
• Comply with the new required notice for employers offering fixed indemnity plans, including hospital indemnity policies, beginning on or after January 1, 2025.
• Update high-deductible health plans to account for recent guidance in Internal Revenue Service Notices 2024-71 and 2024-75 on first-dollar coverage of preventive care.
• Confirm timely reporting of medical and drug cost reporting with PBMs.
• Confirm that no impermissible double-dipping payroll tax schemes were adopted.
• Review plans and documentation for compliance with surprise billing requirements and transparency in coverage rules.
• Review the final Affordable Care Act Section 1557 rule to determine if any action is needed.

Plan sponsors should also consider whether any Summary Material Modifications or Summary Plan Description updates are needed for any of the above changes or general plan design updates. For more information on these changes, please contact your regular McDermott lawyer or one of the authors listed below.