Proposed New “Notice-and-Access” Safe Harbor for Electronic Group Health Plan Disclosures
By: Allison Martinez
This summer EBSA issued proposed rules that establish a new safe harbor allowing group health plan administrators to electronically provide ERISA required disclosures to participants and beneficiaries. The proposed rules resemble the notice-and-access safe harbor for retirement plan electronic disclosures that was finalized in 2020. Understandably, these proposed rules have attracted a lot of attention due to their promise of reining in the cost and administrative burdens associated with furnishing this information to participants and beneficiaries. It’s estimated the proposed rules will save the nearly 2.8 million affected group health plans close to $402 million each year. Once finalized, the new safe harbor will be effective on the first January 1 following the publication of the final rule. It will likely take some time for EBSA to consider the numerous comments it received and finalize the rules, but here are some things group health plan administrators should know and consider now.
The Proposed Notice-and-Access Safe Harbor
The Proposed Safe Harbor Will Not Replace Existing Rules.
Administrators of group health plans subject to ERISA are required to furnish various types of documents (“covered documents”) to plan participants and their beneficiaries using a delivery method reasonably calculated to ensure the information is actually received. Currently, group health plan administrators can only rely on provisions that are more than 20 years old to electronically deliver required covered documents to participants who are “wired at work” or who have affirmatively given consent to receive documents electronically. The proposed new safe harbor supplements—it does not replace—the existing rules.
Email Address or Smartphone Number is Required.
The proposed safe harbor is premised on a participant or other individual entitled to receive covered documents having an electronic address where they can receive a notice of internet availability. Individuals must affirmatively provide an electronic address (e.g., email or smartphone number) where they can receive notices of internet availability. Alternatively, employees who are assigned electronic addresses by employers for employment-related purposes including delivery of the covered documents are deemed to have provided such electronic address.
Mandated Notice of Internet Availability.
A notice of internet availability generally must be delivered when a covered document is made available online. There are special provisions that allow a combined notice of internet availability for certain covered documents that’s furnished each plan year and, if the combined notice was provided for the last plan year, no more than 14 months after the date the prior plan year’s notice was furnished.
The notice of internet availability must be written in a manner that is designed to be understood by the average group health plan participant and:
Prominently state in the title, legend, or subject line: “Disclosure About Your Health Plan.”
State: “Important information about your health plan is now available. Please review this information.”
Identify the covered document that’s available by name (e.g., a statement that reads: “HIPAA Notice of Special Enrollment Rights is now available”) and a brief description of the covered document if identification by name alone wouldn’t reasonably inform the recipient of the covered document’s subject.
Include an internet web address or hyperlink to the web address that leads directly to the covered document, or to a login page that provides a prominent link to the covered document or immediately provides the covered document after logging in.
State the recipient has a right to request and obtain a paper version of the covered document free of charge and explains how to exercise that right.
State the recipient has a right to opt out of electronic delivery free of charge and how to exercise that right.
Caution the recipient that the covered document is not required to be available on the website for more than one year or, if later, after it is superseded by a later version of the covered document.
Include the plan administrator or other designated plan representative’s phone number.
The system for providing notices of internet availability must be designed to notify the plan administrator if a participant or beneficiary’s electronic address is invalid or inoperable. If a plan administrator receives a notification that an electronic address is invalid or inoperable, the plan administrator must promptly take reasonable steps to cure the issue (e.g., furnish notice of internet availability to secondary electronic address or treat the participant as having opted out of electronic delivery in favor of paper only covered notices).
Website Where Covered Documents can be Accessed Must Satisfy Conditions
The website (e.g., internet website, electronic based information repository such as a mobile app) where participants and beneficiaries can access covered documents must meet certain requirements to qualify for the notice-and-access safe harbor. The plan administrator must take steps to ensure:
The covered documents are available no later than when required.
The covered document remains available for at least 1 year or, if later, the date it is superseded by a later version.
Covered documents are presented in a way designed to be understood by the average plan participant.
The covered documents are available in a widely available format suitable to be read online and clearly printed on paper, and that can be permanently retained (e.g., portable document format (PDF)).
The covered document is searchable by letters, numbers, or words.
The covered document is presented in a widely available format that allows the covered document to be permanently retained in an electronic format
Plan administrators must take measures that are reasonably calculated to ensure the website will protect the confidentiality of recipients’ personal information.
Initial Notice of Default Electronic Delivery and Right to Opt Out is Necessary
Before a plan administrator may rely on the proposed notice-and-access safe harbor with respect to any individual, a paper notice must be delivered to the individual that contains the following:
A statement that covered documents will be delivered to an electronic address;
The electronic address that will be used for the individual;
Necessary instructions to access covered documents;
A cautionary statement that covered documents are not required to be available on the website for more than one year or, if later, after superseded by a subsequent version;
A statement of the right to request and obtain a paper version of a covered document, free of charge, and an explanation of how to exercise this right; and
A statement of the right, free of charge, to opt out of electronic delivery and receive only paper versions of covered documents, and an explanation of how to exercise this right.
Note: This initial notice is not required to be furnished on paper to individuals who, before January of the first year after the date the final rule is published, have been receiving required group health plan disclosures pursuant to the 2002 electronic disclosure safe harbor in 29 CFR §2520.104b–1(c) (i.e., those who are wired at work or have given affirmative consent).
What Does This Mean for Employers and Their Group Health Plans?
Things haven’t changed yet, but that doesn’t mean it’s too early to prepare. First, consider the obvious—do you have a group health plan that’s subject to ERISA’s disclosure requirements? Second, consider how group health plan notices are currently delivered and initiate discussions with your service providers to determine who is responsible for notices and whether they intend to provide notices pursuant to the proposed safe harbor once it is finalized. From there, consider whether your service provider’s plans:
Align with what works best for your group health plan’s participants.
Affect how much the group health plan pays for services related to furnishing required notices.
Will require a renegotiation of your administrative services agreement (e.g., to delegate responsibility for providing notices; to revisit cybersecurity provisions; or to pass projected cost savings to the plan).
If you have questions regarding the proposed safe harbor and how it will affect your group health plan, please contact your Boutwell Fay attorney.
Boutwell Fay is a nationally recognized employee benefits and ERISA law firm.
With a focus on providing customized solutions and exceptional client service, we help businesses navigate the complexities of employee benefit plans. Our team of experienced attorneys is dedicated to delivering results that exceed our clients' expectations.
CA 949-660-0481 | NY 332.900.2550
© Boutwell Fay LLP 2026, All Rights Reserved. This handout is for information purposes only and may constitute attorney advertising. It should not be construed as legal advice and does not create an attorney-client relationship. If you have questions or would like our advice with respect to any of this information, please contact us.
