What is a Department of Labor health plan audit?
What employers call a Department of Labor audit is formally an investigation by the Employee Benefits Security Administration (EBSA), the agency that enforces Title I of ERISA. The authority comes from ERISA Section 504, which lets the Secretary of Labor investigate whether any person has violated the law and require the plan to produce its books and records.
Investigations are not reserved for retirement plans. EBSA’s enforcement priorities include mental health and substance use disorder benefits, surprise billing and cybersecurity, all of which reach health plans. In fiscal year 2025, EBSA Benefits Advisors handled over 27,000 No Surprises Act complaints, resulting in $67 million in benefit payments, according to EBSA’s fiscal year 2025 fact sheet.
How often do investigations end in findings?
More often than not. The same fact sheet reports that in fiscal year 2025, EBSA:
| Measure | FY 2025 result |
|---|---|
| Recovered for plans, participants and beneficiaries | $1.4 billion |
| Civil investigations closed | 878 |
| Civil investigations with monetary results or other corrective action | 556 (63%) |
| Criminal investigations closed | 253 |
Those figures cover retirement, health and welfare plans together. The message for a health plan sponsor is the same: once an investigation opens, the odds favor some correction.
What triggers an EBSA investigation?
EBSA’s Enforcement Manual section on health plan investigations lists where cases come from:
- compilations of plans and service providers drawn from reports filed with EBSA, such as Form 5500
- review of annual reports, financial statements and other internal EBSA sources
- information from other agencies, such as HHS and state insurance departments
- news reports, industry publications, patient advocacy groups and private litigation
- complaints from participants, fiduciaries, informants and others
- national enforcement strategies and regional office priorities
There is rarely advance warning. Whatever process exists when the letter arrives is what you defend the plan with.
What does EBSA review in a health plan?
According to the Enforcement Manual, a health investigation may review all applicable ERISA provisions, including:
| ERISA area | What it covers |
|---|---|
| Part 1, reporting and disclosure | Plan documents, SPDs, Form 5500 and participant notices |
| Part 4, fiduciary responsibility | Prudence, loyalty, reasonable fees and prohibited transactions |
| Part 5, claims procedures | How claims and appeals are decided and communicated |
| Parts 6 and 7, health laws | COBRA, HIPAA, mental health parity, WHCRA, the Newborns’ Act, GINA, Michelle’s Law, CHIPRA and the ACA |
The manual says investigators should generally evaluate every health plan and benefit package option the employer offers, and that the review will typically include an operational look at claims data. Plan-level investigations also examine claims administration, failure to provide promised benefits, reasonable administrative fees and potential prohibited transactions.
Two areas deserve extra attention. Mental health parity is an EBSA priority, and the Consolidated Appropriations Act, 2021 requires plans to make their comparative analyses of nonquantitative treatment limitations available on request (see mental health parity and NQTLs). And plans must file the Gag Clause Prohibition Compliance Attestation by December 31 each year; a missed filing is one more gap in the record (see the gag clause attestation).
What happens when the letter arrives?
EBSA’s model health plan document request letter cites Section 504, names the Part 7 laws the plan will be examined under, and asks the plan administrator to submit the documents on an attached list within ten business days. The letter explains that sending documents before any on-site work can reduce the time spent with plan officials and may eliminate the need for an on-site visit.
Investigators can send similar requests to the plan sponsor and to service providers, including insurers and TPAs, and can use subpoenas when needed. A request letter may ask for existing documents but not for documents to be created. That detail matters: if the committee minutes or vendor reviews do not already exist, there is nothing to produce.
Separately, ERISA Section 502(c)(6) lets the Department assess a penalty of up to $100 a day, capped at $1,000 per request before inflation adjustments, when a plan administrator fails to furnish requested plan documents within 30 days.
How do investigations get resolved?
EBSA says it is its policy to promote voluntary compliance with ERISA whenever possible. When fiduciaries take proper corrective action, the Department will not bring a civil lawsuit over those issues. Corrections can include restoring losses, ensuring claims are properly processed and paid, and paying applicable penalties. When voluntary compliance fails, EBSA may refer the case to Department of Labor attorneys for litigation.
The financial exposure is personal. The Department of Labor says fiduciaries who do not follow the basic standards of conduct may be personally liable to restore losses to the plan. On top of any recovery, ERISA Section 502(l) requires a civil penalty equal to 20% of the amount recovered from a fiduciary for a breach, including amounts paid under a settlement with the Department.
Why is “I don’t know” the worst answer?
Donovan and Chelsea Ryckis discussed this with Patrick Williams on The Business of Benefits, Episode 83. Patrick, co-founder of Fiduciary in a Box, told the story of a company with roughly 3,000 covered lives that passed on documenting its fiduciary process. Six months later it was notified of a Department of Labor audit and called back for help loading what it could into a system after the fact.
“That’s just not defensible. Picture this: your organization is being investigated by the Department of Labor, and your response is ‘I don’t know.’ You’re the plan sponsor and the fiduciary. That’s not a good answer, and it’s not a way to start off a meeting.” Patrick Williams
The Department of Labor’s own guidance makes the same point in plainer terms. Fiduciary status depends on the functions a person performs, not their title, and prudence focuses on the process for making fiduciary decisions. Documenting decisions and the reasons behind them is how a fiduciary shows that process existed.
Does your advisor carry the right coverage?
Patrick flagged a second blind spot on the episode:
“When you put together a committee, whether for your retirement plan or your health and welfare plan, one of the insurances you acquire is fiduciary liability coverage. But did you know the advisor you’re working with on your health and welfare doesn’t have fiduciary liability insurance? They carry a separate type of coverage that doesn’t protect them in the event of an ERISA claim. You have someone brokering insurance who isn’t protected under an ERISA claim themselves.” Patrick Williams
Fiduciary liability insurance is separate from the ERISA fidelity bond, which protects the plan against loss from theft or fraud by people who handle plan funds (see the ERISA bond). Ask your own committee’s carrier what the policy covers for health and welfare decisions, and ask any advisor whether its coverage responds to an ERISA claim, in writing. Fiduciary insurance guidance is where that review starts.
What does a documented process look like?
None of this requires a legal department. It requires a rhythm:
- Form a real committee. Name the people responsible for plan oversight, define what they are accountable for, and adopt a written charter. A committee that exists only in conversation cannot be verified.
- Meet regularly and keep minutes. ERISA sets no frequency; quarterly is a common baseline. Minutes should show what was reviewed, discussed and decided.
- Review vendors and fees on purpose. The Department of Labor says hiring a service provider is a fiduciary function and that fees must be reasonable. Benchmark them and keep the review, not just the renewal that followed.
- Keep plan documents current. The plan document, SPD and wrap document should match how the plan actually operates (see the ERISA compliance checklist).
- Track every filing and attestation. Form 5500, the gag clause attestation, parity analyses and participant notices, each with proof of completion.
- Keep the file ready to produce. Store charters, minutes, vendor reviews and filings where they can be sent within days, not weeks.
Fiduciary governance is how Ethos Benefits sets this up for clients: a committee, a charter, quarterly meetings, minutes and a record of every decision. For the CFO’s view of the same work, read a CFO’s fiduciary playbook. See what a documented, data-driven renewal produced for one employer in the Axiom Healthcare case study.
When should you build the record?
Before the letter arrives. An EBSA investigation does not ask whether you meant well. It asks what you can prove, and the documents it can request are the ones that already exist. If your health plan does not have a documented fiduciary process today, building one now keeps the timeline in your hands instead of the government’s.
This article is general information, not legal advice. It reflects EBSA guidance and enforcement data available as of October 27, 2026.