Here are some benefits updates and reminders to ring in the new year:

HSA telehealth relief to be extended

In what will come as welcome news to many employers, the Further Continuing Appropriations and Disaster Relief Supplemental Appropriations Act, 2025 is set to extend telehealth relief through plan years beginning before Jan. 1, 2027. Though at the time of writing this bill has not yet passed, it is expected to pass.

Without this relief, employers with high-deductible health plans (HDHPs) would have been required to impose plan deductibles for any non-preventative services offered via telehealth beginning on Jan. 1, 2025. In recent years, many employers have rolled out low-cost telehealth options. These options have been popular with employees but have created a looming headache for those with coverage through HDHP plans, because without specific relief, many of these programs provide services that will need to be subject to deductible minimums for employees to maintain HSA eligibility.

This extension temporarily solves this issue, which will come as a relief to many. We hope to see a more permanent solution in the future.

ACA reporting obligations reduced

For those employers covered by the Affordable Care Act (ACA), reporting forms create a multipronged headache. However, one prong of that burden has been lifted by the Paperwork Burden Reduction Act (PBRA).

Under the PBRA, which will apply to the 2024 Form 1095-C, employers will no longer be required to distribute the form to employees so long as they provide employees with a notice of availability and give employees a copy of the form upon request.

DOL updates cybersecurity guidance

As anyone running a business is aware, cybersecurity is one of those topics that ramps up in importance every year. In recognition of this reality, the Department of Labor has released updates to its 2021 cybersecurity guidance. Of note, this updated guidance applies to both health and welfare and retirement plans.

Employers of all sizes are directed to ask their plan service providers about their security standards, practices, policies, and audit results. They are then asked to consider industry standards for comparable services to determine if their service providers offer sufficient protections. Service providers with recognized standards and annual audits of their practices are preferred.

The guidance also includes best practices, which are worth review by anyone sponsoring an employee benefits plan.

New HIPAA privacy protections on the horizon

On Dec. 23, 2024, new reproductive health care privacy protections took effect. While the rules have been subject to substantial and ongoing attack, their effective date remains in place, calling for action by those holding protected health information as a covered entity or business associate:

Uses and disclosure are subject to the new protections effective Dec. 23, 2024. If you receive a request for such information, we suggest contacting counsel.
HIPAA policies and procedures must be updated to comply with the new protections.
Notices of privacy practices must be updated by Feb. 16, 2026.

More information about the protections covered by these new rules can be found at www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html.

Gag clause attestations still loom large

Plan providers and employers were to file gag clause attestations no later than Dec. 31, 2024, attesting to the fact that their contracts contain no prohibited terms. This is the second year this requirement has been in effect and has thankfully not proven as complex as some of the recent filing requirements imposed on plans.

For employers with insured health plans, this requirement falls to the insurer and does not pose a concern but those with self-insured health plans will want to speak to plan vendors to ensure they have clarity as to who will make the filing.

Consider testing cafeteria plan contributions early

Every year several clients reach out in December with concerns about their cafeteria plan nondiscrimination tests. These tests, which look at whether the plan favors highly compensated and key employees, either in design or operation, sneak up on employers and come to their attention during their fall open enrollment cycles. However, this timing is not ideal.

Whereas we are used to correcting retirement plan issues in the tax year that follows a retirement plan year, cafeteria plan testing issues can only be cleanly resolved during the tax year in which the error occurs. It’s best to know about any testing problems by midyear. Finding out about issues early allows plan sponsors to reduce contributions for highly paid employees or otherwise make adjustments to address any concerns. Consider checking this compliance topic off your list in the summer of 2025.

Iris Tilley is a Barran Liebman partner. She advises employers on a range of benefit and employment law matters.