The Year-End Group Health Plan Compliance Checklist for Plan Sponsors

Every other part of your business runs on a plan. Sales has a forecast. Finance has a close calendar. Operations has a cadence. Then December arrives, and group health plan compliance turns into a scramble of last-minute attestations, notices nobody drafted, and filings that somebody assumed the carrier was handling. That scramble is not a reflection of your team. It is a reflection of a system that was built to keep employers reactive.

It does not have to work that way. Year-end group health plan compliance is finite. There is a known list of deadlines, a known set of notices, and a known set of dollar figures that reset for the new plan year. Once you can see the whole list in one place, the work stops feeling like a threat and starts looking like what it actually is: a governance routine you can run every year with confidence. This checklist walks through what plan sponsors need to close out 2026 cleanly and step into the 2027 plan year without a single avoidable penalty.

Why Year-End Health Plan Compliance Deserves a Real Process

Health plan compliance failures rarely start with bad intent. They start with an assumption. The broker assumed the TPA filed it. The TPA assumed the plan sponsor signed it. Nobody owned the calendar, so the calendar owned everybody.

The cost of that gap is not theoretical. The Department of Labor’s inflation-adjusted penalty schedule reaches up to $2,670 per day for a failure to file Form 5500, up to $1,406 per failure for not providing a Summary of Benefits and Coverage, and up to $141 per day per employee for missing the CHIP notice. Those amounts are adjusted annually, and they apply per plan, not per company.

Meanwhile the underlying spend keeps climbing. KFF found that annual family premiums for employer coverage rose 6 percent in 2025 to $26,993, with workers contributing an average of $6,850 out of their paychecks. You are being asked to defend a bigger number every year while carrying more administrative risk on top of it. Treating group health plan compliance as a documented, repeatable process is how you take that risk off your desk permanently.

Health Plan Compliance Deadlines to Map First

Before you touch a single form, build the calendar. Most of the year-end pressure comes from deadlines that were knowable eleven months earlier. Here is the sequence that matters for a calendar-year plan closing out 2026.

Deadlines That Land Before December 31, 2026

Deadlines That Follow in Early 2027

Print that. Assign a name to every row. A health plan compliance calendar without an owner per line is a wish list.

Gag Clause Attestation: The December 31 Health Plan Compliance Deadline

If you only clear one item off this list before the year closes, make it this one. The Consolidated Appropriations Act prohibits group health plans from agreeing to contract terms that restrict access to provider cost and quality data or de-identified claims information. You have to attest that your contracts are clean.

CMS is explicit on timing: the first attestation was due December 31, 2023, and subsequent attestations are due by December 31 of each year thereafter. The submission runs through the CMS portal, and it covers both insured and self-funded arrangements.

Two traps catch plan sponsors here, and both are health plan compliance failures hiding inside a vendor relationship. First, fully insured employers often assume the carrier submits on their behalf. Many do, but the obligation still sits with the plan unless you have that agreement in writing. Second, self-funded employers who have never actually read their TPA and PBM contracts cannot honestly attest to anything. Reading those contracts is the real work. The attestation is just the receipt.

This is also the single clearest test of whether your data belongs to you. If a vendor will not let you see your own claims, that is not a compliance problem to paper over. That is a partner problem to solve.

Medicare Part D Health Plan Compliance: Two Obligations, Not One

Plan sponsors routinely knock out half of this requirement and miss the other half entirely. Part D is one of the few health plan compliance items with two separate audiences and two separate deadlines.

The Notice to Medicare-Eligible Individuals

You must tell every Medicare-eligible person covered by your prescription drug plan whether that coverage is creditable, and CMS requires the notice annually prior to October 15. That population is wider than most employers assume. It includes active employees and their dependents, COBRA participants and their dependents, Medicare-eligible disabled individuals on the plan, and retirees and their dependents.

The Online Disclosure to CMS

Separately, you have to complete the Online Disclosure to CMS Form no later than 60 days after the start of your plan year, within 30 days of a plan termination, and within 30 days of any change in creditable coverage status. For a calendar-year plan, that first deadline lands in early March. Nobody sends you a reminder.

Why it matters to your people: an individual who goes 63 days or more without creditable coverage after their initial Part D enrollment window can be hit with a permanent late enrollment penalty. Getting this notice right is not a filing exercise. It protects a retiree’s monthly budget for the rest of their life.

ACA Reporting and the Employer Mandate for 2027

The employer mandate math resets every year, and 2027 moves in the wrong direction for employers. This is the most expensive health plan compliance category on the list, so load the new numbers now, before you finalize contribution strategy.

The 2027 Affordability Threshold

The IRS set the required contribution percentage for plan years beginning in 2027 at 10.22 percent in Revenue Procedure 2026-26. That is the first time the affordability threshold has crossed into double digits, and it gives applicable large employers meaningfully more room on the employee-only contribution for the lowest-cost plan that provides minimum value. Run your safe harbor calculation against the new figure rather than rolling last year’s contribution forward.

The 2027 Penalty Amounts

Revenue Procedure 2026-22 sets the indexed penalties. For 2027, the adjusted 4980H(a) amount is $3,780 per full-time employee and the adjusted 4980H(b) amount is $5,670 per employee who receives a premium tax credit. The (a) penalty is the one that should keep you up at night, because it applies across your entire full-time population if you fail the 95 percent offer test in any month. For a 300-employee organization, a single bad month of eligibility tracking is a very expensive mistake.

Furnishing and Filing the Forms

For the 2026 reporting year, Forms 1094-C and 1095-C follow the pattern in the IRS instructions: furnish employee statements by March 2, 2027, and file electronically with the IRS by March 31, 2027. Electronic filing is mandatory once you are filing 10 or more information returns in aggregate across all return types, which captures nearly every applicable large employer.

Use the alternative furnishing method if it fits your operation. It is one of the few health plan compliance rules that actually reduces your workload. Instead of mailing every statement, you can post a clear, conspicuous, and accessible notice on your website by the furnishing deadline, keep it up through October 15 of that year, and provide a statement within 30 days of any employee request. It cuts print and postage without cutting corners.

Reset the Plan Limits Before Open Enrollment Closes

Health plan compliance failures at this stage are usually configuration failures. The rules were followed. The system was never updated.

HSA and HDHP Figures for 2027

Revenue Procedure 2026-24 sets the 2027 amounts. HSA contributions rise to $4,500 for self-only coverage and $9,000 for family coverage. To qualify as a high deductible health plan, the minimum annual deductible is $1,750 for self-only and $3,500 for family, and the maximum out-of-pocket cannot exceed $8,700 for self-only or $17,400 for family. The excepted benefit HRA maximum newly available for plan years beginning in 2027 is $2,250, and the same revenue procedure sets the 2027 figures for direct primary care service arrangements.

ACA Out-of-Pocket Maximums

This one is larger than most people expect. CMS set the 2027 maximum annual limitation on cost sharing at $12,000 for self-only coverage and $24,000 for other than self-only coverage, roughly a 13.2 percent jump from the 2026 parameters of $10,600 and $21,200. Non-grandfathered plans have to stay inside those ceilings. Remember that HDHPs have to satisfy both the ACA limit and the tighter IRS out-of-pocket cap, so the IRS number is the one that binds.

Health FSA and Cafeteria Plan Items

Cafeteria plan limits are a quiet health plan compliance risk because they are easy to overlook in a system migration. For 2026, the IRS set the health FSA salary reduction limit at $3,400 with a maximum carryover of $680. The 2027 adjustments typically arrive in the fall, so build your enrollment communications with a placeholder and confirm the final figure before materials go to print. While you are in the cafeteria plan, verify that your written document reflects the actual election rules you are administering, including any grace period or carryover provision. A plan that operates differently from its document is a plan with a problem.

Reconcile Every Required Participant Notice

Notices are the least glamorous part of health plan compliance and the easiest to prove you missed. Build a distribution log with dates, methods, and recipient groups. If a Department of Labor investigator asks, the log is your defense.

• Summary of Benefits and Coverage with the uniform glossary, distributed with enrollment materials, plus 60 days advance notice of any mid-year material modification
• Medicare Part D creditable coverage notice before October 15
• CHIP premium assistance notice annually
• Women’s Health and Cancer Rights Act notice at enrollment and annually
• Newborns’ and Mothers’ Health Protection Act description in the SPD
• HIPAA special enrollment rights notice at or before enrollment
• HIPAA privacy notice for self-funded plans, with the reminder of availability at least every three years
• COBRA general notice within 90 days of coverage starting
• Wellness program notices if you run a health-contingent program, including reasonable alternative standard language
• Summary Annual Report for plans that file a Form 5500

Every item above is a documented health plan compliance obligation with a date attached, which means every item is provable either way.

Add your state layer on top. Employers with employees in states such as California, Massachusetts, New Jersey, Rhode Island, Vermont, and the District of Columbia have individual mandate reporting obligations that run on their own timelines and are not satisfied by federal filings.

Confirm Your Plan Documents Match Reality

Written documentation is where health plan compliance either holds up or falls apart under review.

ERISA requires a written plan document and a Summary Plan Description, and it requires them to describe the plan you are actually running. If you changed networks, added a spousal surcharge, moved to a reference-based pricing model, carved out specialty pharmacy, or adjusted eligibility for variable-hour employees, those changes need to show up in writing on or before their effective date.

Work through a short list. Is there a signed plan document and a current SPD for every ERISA welfare benefit plan, including dental, vision, and the health FSA? Has a Summary of Material Modifications gone out for mid-year changes? Do your wrap document schedules still list the right carriers and contract numbers? Is the named fiduciary and plan administrator language accurate, or does it still name someone who left three years ago?

The Fiduciary Layer of Health Plan Compliance

Here is where most checklists stop and where the real exposure now lives. Filing on time proves you are organized. Documenting a prudent process proves you are a fiduciary. Health plan litigation has moved decisively toward the second question, and “our broker handled it” has never been a defense.

Fee and Compensation Disclosure

Since December 2021, brokers and consultants to group health plans who expect $1,000 or more in compensation have had to disclose it. The Department of Labor’s guidance confirms that covered service providers must disclose both direct and indirect compensation reasonably in advance of entering into a contract, and that the responsible plan fiduciary needs enough information to assess whether that compensation is reasonable and to identify conflicts of interest. The requirement applies to insured and self-insured plans of any size, including limited-scope dental and vision.

Ask the uncomfortable question this year, because vendor compensation is the health plan compliance item with the sharpest fiduciary edge. Do you have a written 408(b)(2) disclosure on file from every broker, consultant, and advisor touching your plan? Did you evaluate it, in writing, at a meeting, with a decision recorded? If the answer is no, that gap is more dangerous than a late notice. Ethos publishes its compensation because a fiduciary standard is not selectively applied. Our Fiduciary Framework exists to make that documentation routine through quarterly committee meetings and a single audit-ready record.

Mental Health Parity

Parity is the health plan compliance area where the regulations moved and the statute did not. The Departments stated they will not enforce the portions of the 2024 MHPAEA final rule that are new compared to the 2013 rule, pending litigation plus an additional 18 months. In the same statement they were unambiguous that MHPAEA’s statutory obligations, as amended by the CAA 2021, continue to have effect. Translation: you still need a written comparative analysis of your nonquantitative treatment limitations, and you still need to produce it on request. Ask your carrier or TPA for the current version and read it before a regulator does.

Transparency in Coverage and RxDC

Non-grandfathered plans must publicly post machine-readable files covering in-network negotiated rates, out-of-network allowed amounts and billed charges, and prescription drug pricing, and CMS requires those files to be updated monthly. Plans also have to offer an internet-based self-service price comparison tool covering all covered items and services. Verify that your files are actually live and current, that the public-facing link works, and that you have documentation from your vendor confirming who posts what.

RxDC reporting runs on the same principle, and it is a shared health plan compliance obligation rather than a vendor chore. Submissions for the 2026 reference year are due June 1, 2027, and while carriers and PBMs handle most files, the plan sponsor typically owns the P2 data on premiums and average enrollment. Confirm now who is submitting on your behalf and get it in writing.

Run Nondiscrimination Testing Before the Year Closes

Testing after December 31 gives you a diagnosis with no cure. Testing in November gives you time to fix it.

Cafeteria plans under Section 125 have to pass eligibility, contributions and benefits, and key employee concentration testing, with no more than 25 percent of aggregate benefits going to key employees. Dependent care assistance programs face a 55 percent average benefits test and a 25 percent owner concentration limit. Self-funded medical plans have to satisfy Section 105(h) eligibility and benefits testing. Fail any of these and the consequence lands on the wrong people: highly compensated individuals lose the tax exclusion on amounts that should have been pre-tax, and payroll has to correct it retroactively.

If your census shifted meaningfully this year through an acquisition, a reduction, or a change in eligibility rules, test earlier than usual. Health plan compliance problems almost always trace back to a change nobody modeled.

A 30-Day Action Plan for Year-End Health Plan Compliance

You do not need a task force. You need four focused weeks and a decision-maker in the room.

Week One: Inventory

List every ERISA welfare benefit plan you sponsor. For each one, note the plan year, the funding arrangement, the participant count, the TPA or carrier, and the named plan administrator. This single document resolves more health plan compliance confusion than any other artifact.

Week Two: Contracts and Attestation

Contracts are where health plan compliance and cost control meet. Pull your TPA, PBM, and network agreements. Look specifically for language restricting your access to claims data or provider price and quality information. Resolve anything you find, then complete the gag clause attestation. Do not sign an attestation you cannot support.

Week Three: Numbers and Notices

Numbers drive most health plan compliance errors, so handle them deliberately. Load the 2027 limits into your benefits administration system and your enrollment materials. Reconcile the notice distribution log. Confirm the Part D notice went out before October 15 and calendar the CMS disclosure for early March.

Week Four: Governance

Hold a documented meeting, because governance is the health plan compliance step no vendor can perform for you. Review the 408(b)(2) disclosures, the nondiscrimination testing results, the MHPAEA comparative analysis, and the machine-readable file status. Record the decisions and who made them. That record is the difference between a plan sponsor who complied and a plan sponsor who can prove it.

Frequently Asked Questions

Close the Year With Health Plan Compliance Under Control

Nothing on this list is beyond you. It is a calendar, a contract review, a set of numbers, and a documented meeting. What makes year-end health plan compliance feel impossible is not the complexity of the rules. It is doing it alone, in December, with vendors who benefit from your uncertainty and a broker who never brought you the list in the first place.