Compliance Monthly Update
May 2026
A brief update on what happened the prior month in group health plan compliance at the federal level, organized chronologically. An update for the state and local level are further down. If you would like additional information, please reach out to the GBS Compliance Team.
Federal Compliance Update
2027 ACA employer mandate penalty amounts released.
On May 4, the IRS issued Rev. Proc. 2026-22 with 2027 indexed amounts used to calculate the ACA employer shared responsibility payments (ESRP) that applicable large employers (ALEs) may be liable for if they (1) fail to offer minimum essential coverage to 95% of full-time employees and their dependent children (the subsection (a) penalty), or if they (2) fail to offer coverage to full-time employees that is affordable and minimum value (the subsection (b) penalty). The adjusted penalty amount for failures occurring in the 2027 calendar year under subsection (a) will be $3,780 per full-time employee (less the 30-employee reduction)—a $440 increase from 2026. The 2027 calendar year penalty under subsection (b) will be $5,670 per full-time employee that receives subsidized coverage through an Exchange—a $660 increase from 2026. Prior year’s penalty amounts are available on the IRS Question and Answers on Employer Shared Responsibility under the ACA webpage. Note that the IRS uses Letter 226-J to inform ALEs of potential ESRP amounts, and a response is generally due within 90 days for the ALE to inform the IRS if they agree or disagree with the proposed penalty. ALEs should be prepared to promptly respond to any Letter 226-J received.
Medicare to provide $50/month GLP-1 medication.
On May 6, CMS announced they will provide eligible Medicare beneficiaries with access to certain GLP-1 medications for $50 per month beginning July 1, 2026, through December 31, 2027.
HHS reports to Congress on 2023 HIPAA compliance and breach notification.
HHS posted its 2023 reports to Congress titled “HIPAA Privacy, Security, and Breach Notification Rule Compliance” (the “Compliance Report”) and “Breaches of Unsecured Protected Health Information” (the “Breach Notification Report”). The reports include important data from the HIPAA complaints investigated in 2023. In addition, they highlight areas of noncompliance and provide insights into issues such as cybersecurity readiness. The Compliance Report summarizes key HIPAA enforcement activities undertaken by HHS during 2023, including the number of complaints received and the method by which those complaints were resolved. The Breach Notification Report identifies the number and nature of breaches of unsecured protected health information (PHI) that were reported to HHS during 2023 and the actions taken in response. The Breach Notification Report also includes a helpful list of the most common post-breach remedial actions taken to mitigate harm and prevent future breaches. The reports can help covered entities and business associates target and strengthen their HIPAA compliance efforts. Regulated entities should note that HHS opens compliance reviews to investigate all reported breaches impacting 500 or more individuals and may also open compliance reviews of reported breaches impacting fewer than 500 individuals.
Proposed rule to provide fertility coverage as an excepted benefit.
On May 13, the DOL, IRS, and HHS published a proposed rule (and associated news release) which would establish a new category of excepted benefits for certain fertility-related coverage. This proposed rule is in response to the February 2025 executive order titled “Expanding Access to In Vitro Fertilization” and other guidance issued by the Trump Administration. If finalized, the proposed rule would be effective for plan years beginning in 2027. As a reminder, excepted benefits (which are designed to offer supplemental or limited coverage) are generally exempt from many federal group health plan and market reform requirements such as the ACA preventive services coverage mandate and the prohibition on lifetime/annual limits for essential health benefits (EHBs). A plan providing limited coverage for a specialized benefit (like fertility benefits) is unable on its own to meet the ACA coverage mandates unless it fits into an excepted benefit category. A plan that fits into an excepted benefit category gives a plan sponsor more flexibility in terms of plan design and eligibility—e.g., could offer a standalone fertility benefit that isn’t tied to (integrated with) enrollment in a major medical plan that satisfies the ACA coverage requirements. So, the proposed rule is intended to reduce regulatory burdens and encourage broader access to fertility-related benefits (including IVF) by creating “excepted fertility benefits” if they meet the following requirements:
- Substantially all of the benefits must be for the diagnosis, mitigation, or treatment of infertility or infertility-related reproductive health conditions, substantially all of which are provided by medical professionals authorized to practice under applicable law. Covered benefits may include diagnostic testing, preconception care, fertility awareness-based methods, medications, surgical procedures, IVF, other assisted reproductive technology procedures, and fertility counseling and education. Abortion and abortion-related services are excluded.
- The total lifetime benefit per participant, together with their beneficiaries (if eligible), may not exceed $120,000. For plan years beginning after December 31, 2027, this limit would be indexed for inflation.
- The fertility benefit must either be (a) provided under a separate policy, certificate, or contract of insurance, or (b) otherwise not be an integral part of the group health plan. For a benefit to be not “integral,” the same plan sponsor must make available other group health plan coverage that is not limited to excepted benefits and is not an HRA or other account-based group health plan; however, participants need not enroll in that other coverage to access the fertility benefit.
- Plans and insurers must provide written notice, calculated to be understood by the average plan participant (including use of plain language at or below an 8th-grade reading level). Required content includes a summary of benefits and limitations (including the applicable lifetime dollar limit), how to identify and use network providers, how to submit claims, and whether the benefit uses the same claims procedure as the sponsor’s other group health plans. The notice must be provided no later than the first date on which the participant is eligible to enroll, annually thereafter, and upon request.
Expansion of TrumpRx announced.
On May 18, the White House released a fact sheet announcing an expansion of TrumpRx to include more than 600 generic medications. TrumpRx is a government-run direct-to-consumer drug purchasing platform intended to provide individuals with access to discounted pricing on certain medications. Some discounts are tied to most-favored-nation (MFN) pricing agreements, which are intended to align prices with those paid in other developed countries. The newly announced generic drugs and prices will be listed separately from discounts on high-cost branded medications negotiated through MFN pricing agreements. The expansion may improve price transparency and provide another way for some consumers to compare cash prices for generic medications. However, the practical savings will vary by medication, pharmacy, insurance coverage, and whether a person is willing or able to pay outside of insurance. Because many of the generic prices appear to be made available through existing cash-pay platforms, the expansion may be more helpful as a comparison tool than as a new source of savings for all consumers. At this time, the discounts advertised through TrumpRx appear to be available only to individuals purchasing medications without using insurance.
ACA Notice of Benefit and Payment Parameters for 2027 final rule released.
On May 20, HHS published the ACA Notice of Benefit and Payment Parameters (NBPP) final rule for the 2027 plan year (and an associated fact sheet and press release). This is an annual rule implementing (among other things) guidance for insurers offering individual Marketplace plans and implements changes to essential health benefits (EHBs). HHS said in their press release that the rule’s aim is to crack down on fraud, tighten eligibility verification, and afford states greater control over their Marketplaces. Here are the highlights of the NBPP:
- New plan options. The NBPP focuses on broadening the types of plans that can participate on Marketplaces—with the goal of offering people the ability to purchase lower-cost plans that may have higher out-of-pocket costs.
- Currently, catastrophic health plans are limited to individuals under age 30 or people over 30 who don’t qualify for a Marketplace individual plan—otherwise, they must receive a hardship exemption to purchase a catastrophic health plan. The NBPP expands eligibility for the hardship exemption to certain individuals over age 30 or who are ineligible for an advanced premium tax credit or ineligible for cost-sharing reductions due to their projected household income being below 100% or above 250% of the federal poverty level. The NBPP also allows individuals to enroll in a catastrophic plan for multiple plan years, up to a period of 10 years.
- The NBPP changes cost-sharing parameters for bronze and catastrophic plans (beginning in 2028 rather than in 2027). The maximum out-of-pocket limit for catastrophic plans will increase to 130% of the maximum annual limit on cost sharing. Catastrophic plans will not be required to provide benefits for any plan year until an amount equal to 130% of the annual limitation on cost sharing is reached (except for value-based insurance design allowances).
- This change applies to catastrophic plans in the individual Marketplace and does not change the ACA out-of-pocket maximum rules for employer-sponsored group health plans. While it may create lower-premium Marketplace options for certain consumers, it also significantly increases members’ potential financial exposure before meaningful plan benefits apply. Consumers may be drawn to the lower premium without fully appreciating the higher out-of-pocket threshold, which could leave them underestimating their real financial risk if they need more than minimal care.
- Plans that do not use a network (a “non-network” plan) may also be offered on Marketplaces beginning in 2028. A non-network plan must demonstrate sufficient access to a range of providers that accept the plan’s benefit amount as payment in full.
- Special enrollment period (SEP) verification. The NBPP will require pre-enrollment SEP verification for Marketplaces on the federal platform (for at least 75% of new enrollments through SEPs).
- Income verification. The NBPP will require individuals to submit documents to verify their income when data sources indicate household income is less than 100% of the federal poverty level.
- Eligibility and consent documentation requirements. The NBPP will require agents, brokers, and web-brokers (starting in 2028) to use an HHS-created consumer consent form to meet the eligibility application review and consent documentation requirements prior to providing enrollment assistance and submission of an application for Marketplace coverage.
- Implementation of provisions from the One Big Beautiful Bill Act (OBBBA). The NBPP codifies elements of the OBBBA including: limits on advanced premium tax credits to certain lawfully present aliens; ending auto-reenrollment and provisional enrollment; and advanced premium tax credits will be unavailable for individuals who have not been verified for eligibility.
- Essential health benefits (EHB) changes. As a reminder, the ACA requires non-grandfathered plans in the individual and small group market to cover EHBs (which include services in 10 benefit categories).
- The NBPP states that routine adult dental services cannot be included as an essential health benefit. The ACA requires coverage of pediatric dental services as part of the EHB package, but routine dental care for adults is not treated the same way. HHS states this change is intended to keep EHBs consistent with the types of benefits typically provided under employer health plans.
- The NBPP revises states’ responsibilities when mandating benefits that are “in addition to EHB.” Beginning in 2028, any state-required benefit will be considered “in addition to EHB” (and thus not an EHB) if it is required by state action after December 31, 2011, applies to the small group and/or individual markets, is specific to required care, treatment, or services, and is not mandated for compliance with federal requirements. Under this policy, states will be required to defray the cost of these additional benefits (i.e., not pass on the cost to consumers through higher premiums) for enrollees in qualified health plans, regardless of whether the benefit is embedded in the state’s EHB-benchmark plan. State-required benefits that are “in addition to EHB” are not subject to the rules applicable to EHBs, including the prohibition on discrimination, limitations on cost sharing, and restrictions on annual or lifetime dollar limits.
2026 civil monetary penalties will not be adjusted (increased) for inflation.
On May 27, the DOL announced there will be no 2026 annual adjustments to civil monetary penalties for certain benefit-related violations. The announcement explains that, under 2015 legislation that requires annual inflation adjustments for specified civil penalty amounts, the adjustments are to be calculated using the Consumer Price Index for All Urban Consumers (CPI-U) issued by the Bureau of Labor Statistics (BLS) for the prior October. Due to the federal government shutdown that occurred during the fall of 2025, BLS was unable to produce the October 2025 data needed to calculate the 2026 penalty adjustments. Because the statute does not provide an alternate method for calculating the adjustments, the director of the Office of Management and Budget has cancelled the 2026 penalty adjustments and directed agencies to continue using the 2025 penalty amounts. This announcement provides some needed clarity regarding the 2026 penalty adjustments, which normally are announced in January of each year (and which were not provided this year). Impacted civil monetary penalties cover (among other things) Form 5500 and Form M-1 filing failures, failures relating to the SBC, violations of GINA, and failures relating to the CHIP notice.
2027 HSA, HDHP, DPCSA, and EBHRA inflation adjusted amounts released.
On May 29, the IRS released Rev. Proc. 2026-24 that provides the inflation adjusted amounts for Health Savings Accounts (HSAs), high deductible health plans (HDHPs), direct primary-care service arrangement (DPCSAs), and the maximum amount that may be made newly available for excepted benefit health reimbursement arrangements (EBHRAs). For calendar year 2027:
- The annual limitation on HSA contributions for an individual with self-only HDHP coverage is $4,500. The annual limitation on HSA contributions for an individual with family HDHP coverage is $9,000.
- A HDHP’s annual deductible may not be less than $1,750 for self-only coverage or $3,500 for family coverage. And the annual out-of-pocket expenses (deductibles, co-payments, and other amounts, but not premiums) for a HDHP may not exceed $8,700 for self-only coverage or $17,400 for family coverage.
- A DPCSA is not treated as a health plan with respect to an otherwise eligible individual if the aggregate monthly fees for all DPCSAs with respect to the individual do not exceed $150 or, if the individual is covered by a DPCSA that covers more than one individual, $300. As a reminder, last year the One Big Beautiful Bill Act (OBBBA) provided that certain DPCSAs are disregarded as a health plan for purposes of being eligible to make HSA contribution. To be disregarded, the aggregate monthly fees for all DPCSAs of the individual must, among other requirements, not exceed the annually adjusted amount.
- The maximum amount that may be made newly available for the plan year for an excepted benefit HRA (EBHRA) is $2,250.
State/Local Compliance Update
A brief update on what happened the prior month in group health plan compliance at the state and local level, listed alphabetically. If you would like additional information, please reach out to the GBS Compliance Team.
Colorado
Colorado AI Act repealed and replaced.
Back in June 2024, we discussed the passage of Senate Bill 24-205 (the “AI Act”) that made Colorado the first state to enact a broad regulatory framework for the development and use of artificial intelligence (AI) systems. Now, on May 14, Governor Polis signed SB 26-189 to repeal and replace the AI Act.
- The original AI Act was intended to prevent algorithmic discrimination by mandating broad-based notice, disclosure, risk mitigation, and opt-out requirements for developers and deployers of “high-risk” AI systems. Following its passage, the law was criticized for being overly complex and burdensome and faced litigation challenges. So, Governor Polis formed a working group to propose revisions to reduce the regulatory burdens, which led to the passage of SB 26-189.
- The new law replaces the original regulation of “high-risk” AI systems with a new framework governing the use of “automated decision-making technology” (ADMT) to make “consequential decisions” about consumers, while excluding routine technologies and low-stakes use cases from its scope.
- The new law abandons the prior extensive risk‑management and impact‑assessment requirements and replaces those with new obligations to notify consumers when ADMT is used to make consequential decisions and to provide explanations following adverse outcomes.
- Individuals may also now request correction of inaccurate data and request meaningful human review and reconsideration of certain automated decisions.
- There are some exemptions from the new law specific to group health plans. For example, insurers subject to Colorado’s insurance law governing the use of algorithms and external consumer data are generally deemed compliant with SB 189 in the practice of insurance. And HIPAA‑covered entities and their business associates are largely exempt from the statute’s requirements, except for limited disclosure obligations in certain financial‑assistance eligibility determinations, and healthcare providers must provide general notice regarding their use of advanced technologies.
Illinois
Chicago issues updated paid leave rules.
On May 18, updated rules were released that (effective June 1, 2026) clarify the Chicago Paid Leave and Paid Sick Leave Ordinance. As background, in November 2023, Chicago enacted the ordinance requiring employers to provide at least 40 hours of paid leave and 40 hours of paid sick leave annually to employees. The ordinance took effect July 1, 2024, and set forth accrual, usage, and eligibility requirements. The updated rules provide important clarifications regarding employer obligations and employee use of paid leave. Here are the highlights:
- Employers are required to post notices in accessible locations. The updated rules give examples of possible locations—including bulletin boards with other required postings, breakrooms/lunchrooms, display monitors, and employee swipe-in areas.
- The rules now expressly confirm that employers may take disciplinary action for misuse of paid sick leave, including where employees exhibit patterns of suspicious usage. Examples include: requesting unscheduled paid sick leave on or adjacent to weekends, regularly scheduled days off, holidays, vacation or pay day; taking scheduled paid sick leave on days when other leave has been denied; and taking paid sick leave on days when the employee is scheduled to work a shift or perform duties perceived as undesirable.
- The ordinance allows use of paid leave when an employee needs to care for a family member whose school, class, or “place of care” has been “closed.” The rules clarify that a “place of care” can include informal childcare arrangements—such as babysitters, family members, or friends who provide care while the employee is working. And a “closure” can include situations in which the childcare provider is unexpectedly unavailable.
- The rules confirm that employers may utilize a single, combined PTO policy to satisfy their obligations under the ordinance in lieu of separate paid leave and paid sick leave banks—provided the policy meets all statutory requirements, including accrual, carryover, and permissible use.
Massachusetts
Massachusetts PFML Act retaliation verdict puts employers on notice.
On April 27, a jury handed down the first verdict in Massachusetts, validating a retaliation claim under the Massachusetts Paid Family and Medical Leave (PFML) Act. The jury found that the employer retaliated against the employee plaintiff for taking PFML leave, despite the employee’s poor, and well-documented, performance reviews that predated her leave. The verdict resulted in a $4.7 million award, including $4 million in punitive damages, $600,000 for emotional distress, and more than $75,000 in back pay. This verdict emphasizes the significant risk employers face when terminating employees within six months of their return from PFML leave. The Massachusetts PFML Act imposes a higher evidentiary standard on employers defending against retaliation claims than the federal FMLA. Under the federal FMLA, an employer needs only to articulate a legitimate, nondiscriminatory reason for the adverse action. By contrast, under the Massachusetts PFML Act, the employer must justify its decision by clear and convincing evidence.
Minnesota
Bloomington repeals their paid sick and safe time ordinance due to implementation of statewide standards.
On April 27, Bloomington repealed its Earned Sick and Safe Time (ESST) Ordinance explaining that “the primary purpose of Bloomington’s ESST ordinance, to guarantee paid sick and safe time, has been fulfilled by the statewide law.” Bloomington is the second Minnesota city to repeal its paid sick and safe leave ordinance due to the application of statewide standards. (Duluth previously repealed its ordinance effective January 18, 2024, shortly after the state law took effect, rather than continuing to maintain a parallel framework.) Since Bloomington last amended its ordinance to align with state law, the state statute has been amended twice, and forthcoming state rules could further impact how the state law is interpreted. Accordingly, Bloomington’s ordinance did not fully align with state law and the city acknowledged that “significant staff time is needed to track, review, and update the ordinance to align it with state law.” Bloomington also observed that “the positives of a dual system do not outweigh the negatives of requiring employers to navigate overlapping rules that are substantially similar in purpose and effect.” It is possible that Minneapolis and Saint Paul (both of which have also been playing catch up, based on changes to state law) will follow suit and reduce multi-jurisdiction compliance challenges for employers with Minnesota operations.
Tennessee
Tennessee enacts the FAIR Rx Act restricting vertical integration of PBMs.
On May 22, Governor Lee signed SB 2040 / HB 1959, the Freedom, Access, and Integrity in Registered Pharmacy (FAIR Rx) Act. The FAIR Rx Act takes effect on July 1, 2028, and targets vertical integration in the pharmacy market by prohibiting certain entities from owning or controlling a pharmacy while also owning or controlling a PBM or insurance company. Specifically, the FAIR Act states that no person or entity may, directly or indirectly, own, operate, control, or direct the operation of both a pharmacy and a health insurance issuer or PBM, when the ownership interest exceeds 5% (subject to limited exceptions). As expected, impacted entities and PBMs are pushing back, and CVS has already filed a lawsuit challenging the law based on constitutional grounds and based on ERISA preemption.
Virginia
Virginia enacts state paid sick leave law.
On May 20, Governor Spanberger signed HB 5 / SB 199 that expands paid sick leave obligations to virtually all employers in the state. The timing of when the new paid sick leave requirements go into effect depends on the employer size—it goes into effect for employers with at least 50 employees on July 1, 2027, for employers with at least 25 employees on January 1, 2028, and for employers with at least one employee on January 1, 2029. Highlights of the law include accrual at a rate of one hour of paid sick leave for every 30 hours worked, 40-hour annual caps on accrual and usage, no apparent cap on year-end carryover, a permissible frontloading alternative, a broad “family member” definition, and a requirement that paid sick leave be compensated at the regular rate.
