Employers are being pitched AI for nearly every part of their benefits program in 2026: enrollment, employee questions, claims analysis, invoice checks and cost forecasting. Some of it saves real time. Some of it puts protected health information somewhere it should not be. This page covers where AI helps, where it falls short, and the HIPAA and ERISA rules that set the limits.
Where does AI help in employee benefits?
AI works best in benefits on document-heavy, repeatable work where a person can check the result. The table below covers the common uses, what they do well and what to watch.
| Use | What it does well | What to watch |
|---|---|---|
| Plan documents | Sorts and labels SPDs, SBCs, contracts and filings, and flags what is missing or out of date | Someone still has to confirm the right version is the one in force |
| Employee questions | Answers plan questions in plain language, around the clock | Answers must come from your own plan documents, which govern when the two disagree |
| Enrollment support | Walks employees through options and compares costs for their situation | Recommendations rely on the data the tool can see, and on HIPAA limits on that data |
| Administration | Matches carrier invoices to enrollment records and flags billing errors | Exceptions still need a person, and the tool needs a clean eligibility feed |
| Claims and cost analysis | Groups claims data, spots trends and flags unusual patterns or possible billing errors | Forecasts of high-cost claims are estimates, not facts, and the work must run on protected systems |
| Communications | Drafts open enrollment emails and plain-language summaries | Every draft needs review for accuracy and compliance before it goes out |
The pattern is the same across the table. AI does the first pass and a person makes the call. A tool that gives a confident wrong answer about a deductible or a waiting period creates a problem that the plan, not the vendor, has to fix.
Where should employers not use AI?
Employers should avoid three uses of AI, or handle them with great care.
- Reading workplace communications for signs of stress or burnout. Monitoring employee email or chat to infer mental health raises serious privacy and employment law questions. Anonymous surveys and a well-communicated employee assistance program are safer ways to understand need.
- Using health data in employment decisions. HIPAA requires the group health plan’s documents to bar the plan sponsor from using or disclosing protected health information for employment-related actions and decisions. An AI tool does not change that rule.
- Pasting member details into a consumer chatbot. A free or personal AI account is not a business associate of your plan. Putting a member’s claim, diagnosis or appeal into it is a disclosure HIPAA does not allow.
AI in open enrollment: what to set up first?
Enrollment chatbots and decision support tools fail in ways a product demo never shows. A model that isn’t grounded in your plan documents will still answer, fluently, with last year’s deductible or a rule from someone else’s plan, and the employee has no way to catch it. The moment an employee mentions a diagnosis or a pregnancy, the tool is handling PHI. And a tool that recommends a plan is optimizing for something: ask what.
A short set of written decisions before enrollment opens covers most of the risk. The NIST AI Risk Management Framework organizes this as govern, map, measure and manage:
- Name one owner who is accountable for what the tool says.
- Write down the scope: what it may answer, what it must hand to a person, and what it must never do.
- Ground it in this year’s documents: current SPDs, rates and networks, updated when the plan changes.
- Test it before launch with real questions from last year, checking every answer against the plan document.
- Tell employees they are talking to software, and how to reach a person.
- Review the logs. Every question it gets is a sign of what your employee communications didn’t explain.
AI in claims review: who makes the call?
TPAs, carriers and utilization management vendors increasingly use algorithms to flag, route or decide claims and prior authorization requests. For a self-funded ERISA plan, that doesn’t move the duty. The ERISA claims procedure rule requires a full and fair review of denied claims, and on an appeal that turns on medical judgment, the plan must consult a health care professional with appropriate training and experience. Choosing and monitoring the vendor that runs that process is a fiduciary act.
Ask your TPA or claims vendor, and keep the answers in writing:
- Where in claims and utilization management is AI used, and for which decisions?
- Does a qualified clinician make the final call on every denial, delay or change, or can the tool act alone?
- How is the tool tested for accuracy and bias, and how often are its outcomes reviewed?
- How does a member get a person to look again at an AI-supported decision?
Courts reviewing fiduciary decisions tend to look at whether the process was reasonable and documented, not whether every outcome was perfect. A file with these answers is that process.
What does HIPAA require of AI tools?
HIPAA applies to the group health plan, which is a covered entity, and to the vendors that handle its protected health information (PHI). Four rules shape how AI fits in.
- Business associate agreements. A vendor that creates, receives, maintains or transmits PHI on behalf of the plan is a business associate under 45 CFR § 160.103. It needs a signed business associate agreement (BAA) before it touches the data. HHS has said a cloud provider that stores PHI is a business associate even if the data is encrypted and the provider holds no key, and that using such a provider without a BAA violates the HIPAA Rules. AI vendors fall under the same logic.
- Minimum necessary. Under 45 CFR § 164.502(b), uses and disclosures of PHI must be limited to the minimum necessary for the purpose. Send an AI tool only the fields the task needs.
- The plan sponsor firewall. Under 45 CFR § 164.504(f), the employer, as plan sponsor, receives PHI only for plan administration, under plan document terms that keep it away from employment decisions. Only the people named for plan administration should see AI output that contains PHI.
- De-identified data. Information de-identified under 45 CFR § 164.514 is not PHI. For most leadership reporting, de-identified or summary data is enough and carries less risk.
What should you ask an AI vendor?
Ask whether the vendor will sign a BAA, where your data goes and how errors are caught. Choosing a tool that helps run an ERISA plan, or that the plan pays for, counts as a fiduciary decision. ERISA section 404 requires it to be prudent and made in participants’ interest, so ask these questions and keep the answers:
- Will you sign a BAA, and does it cover every subcontractor that sees our data?
- Where is our data stored, who can access it, and is it used to train models for other customers?
- Where do answers come from, and can a user see the source document and page?
- How are errors caught, and when does a person review the output?
- What does the tool cost, who pays for it, and does any vendor in our plan receive payment tied to it?
- What happens to our data if we leave?
For the broader compliance picture, see the ERISA compliance checklist.
How does Ethos Benefits use AI?
At Ethos Benefits, the Fiduciary OS keeps every document, number and decision about a client’s health and welfare plans in one record. AI sorts each plan document into that library, and Ask Ethos, a plan question feature still in development, is designed to answer from the client’s own plan documents with a link to the exact page, while the client’s Ethos team sees every thread and steps in when a question needs judgment.
The principle behind it is the one this page recommends: AI handles the first pass, the source is always visible, and a person stays accountable for the answer.