DOL Proposes New Electronic Disclosure Safe Harbor for Group Health Plans Under ERISA

Executive Summary

On July 23, 2026, the U.S. Department of Labor (DOL) issued proposed regulations that would establish a new safe harbor allowing group health plan administrators to use electronic media to furnish documents and information to participants and beneficiaries under ERISA. The proposed rules largely mirror the 2020 electronic disclosure safe harbor that currently applies to pension benefit plans, but with certain modifications tailored to the group health plan context as discussed in more detail in this alert. If finalized, these rules would provide plan administrators with a “notice-and-access” model for electronic disclosure, offering significant cost savings and administrative efficiencies while preserving participant rights to receive paper copies and opt out of electronic delivery entirely. The proposed rules are subject to a 60-day notice-and-comment period that ends September 21, 2026. We will provide further information once the notice and comment period has closed and a final rule is issued.

Q1: What is the regulatory context for the proposed rules?

A1: Under current DOL rules, group health plan administrators may use electronic media to furnish required disclosures under the 2002 safe harbor. However, the 2002 safe harbor is available only for two categories of individuals: (1) participants who are “wired at work” (i.e., those with access to the employer’s electronic information system as an integral part of their job duties), and (2) participants, beneficiaries, and other individuals who affirmatively consent to receive documents electronically. In May 2020, the DOL adopted a more flexible “notice-and-access” safe harbor for pension benefit plans, which allows electronic delivery by default based on the provision of an electronic address, with robust rights to request paper copies and opt out. Since then, stakeholders have expressed a desire to harmonize electronic disclosure methods across pension and group health plans and to take advantage of the efficiencies and cost savings achieved under the 2020 pension safe harbor. In response, and following consultation with Treasury and HHS, the DOL is now proposing to extend a substantially similar safe harbor to group health plans.

Q2: Which plans and disclosures are covered by the proposed safe harbor?

A2: The proposed safe harbor applies to “group health plans”—i.e., employee welfare benefit plans that provide medical care to employees or their dependents. It does not extend to other welfare benefit plans (such as disability, life insurance, or vacation benefits), which the DOL notes are subject to fewer disclosure requirements with different considerations. The definition of “covered documents” is intentionally broad: it includes any document or information that the administrator is required to furnish to participants and beneficiaries pursuant to Title I of ERISA. This includes, but is not limited to, Summary Plan Descriptions, Summaries of Material Modifications, Summary Annual Reports, Summaries of Benefits and Coverage, COBRA notices, HIPAA special enrollment notices, and claims procedure disclosures.

Q3: Who qualifies as a “covered individual” under the proposed rules?

A3: A “covered individual” is a participant, beneficiary, or other individual entitled to covered documents who provides the employer, plan sponsor, or administrator (or their designee) with an electronic address—such as an email address or smartphone number—at which the individual may receive a Notice of Internet Availability (NOIA). This electronic address may be provided when the individual begins participating in the plan, as a condition of employment, or otherwise. Alternatively, if an employer assigns an electronic address to an employee for employment-related purposes, the employee is treated as having provided that address for receipt of a NOIA. Additionally, the proposed rules include a special provision for dependent children who are beneficiaries under the plan: if a dependent child has attained age 18 and has provided an electronic address, that dependent qualifies as a covered individual and may receive disclosures independently.

Q4: What are the key requirements for electronic delivery under the proposed safe harbor?

A4: The proposed safe harbor operates on a “notice-and-access” model with several key components:

• Notice of Internet Availability (NOIA): For each covered document, the administrator must furnish a NOIA to the covered individual’s electronic address at the time the document is made available on the website. The NOIA must contain specific information, including:
  • A prominent statement announcing “Disclosure About Your Health Plan”;
  • A statement that “Important information about your health plan is now available. Please review this information”;
  • Identification of the covered document by name and, if necessary, a brief description;
  • The website address or hyperlink where the covered document is available (which must lead directly to the document or to a login page that prominently links to the document);
  • A statement of the right to request and obtain a paper version free of charge, with instructions on how to exercise this right;
  • A statement of the right to opt out of electronic delivery and to receive only paper versions, free of charge, with instructions on how to exercise this right;
  • A cautionary statement that the document is not required to be available on the website for more than one year (or until superseded); and
  • A telephone number to contact the administrator or other designated representative.

  The NOIA must stand on its own and be provided separately from other plan documents (although the proposed rules permit combining NOIAs) and it must be written in a manner calculated to be understood by the average plan participant. NOIAs may include design elements like logos provided they are not inaccurate or misleading.

• Website Standards: The administrator must ensure the existence of a dedicated website (or other electronic-based information repository, such as a mobile application) where covered individuals can access covered documents. The website must meet the following standards:
  • Documents must be available no later than the date they are required to be furnished under ERISA;
  • Documents must remain available for at least one year (or until superseded by a subsequent version);
  • Documents must be presented in a manner calculated to be understood by the average plan participant;
  • Documents must be in a widely available format suitable for both online viewing and clear printing (e.g., PDF);
  • Document content must be electronically searchable; and
  • The website must protect the confidentiality of personal information relating to covered individuals.

Q5: What are the opt-out and paper copy rights under the proposed rules?

A5: The proposed rules contain two key safeguards for covered individuals who prefer to receive paper copies:

• Right to Paper Copies: Upon request, the administrator must promptly furnish a paper copy of any covered document free of charge. Unlike the 2020 pension safe harbor (which permits charging for additional copies after the first), the proposed rules for group health plans would require administrators to provide all requested paper copies free of charge.
• Global Opt-Out: Covered individuals have the right to globally opt out of electronic delivery and receive only paper versions of all covered documents going forward, all free of charge. The administrator must establish and maintain reasonable procedures for processing paper copy requests and opt-out elections promptly, and those procedures may not contain any provision, or be administered in a way that unduly inhibits or hampers the exercise of these rights.

Q6: What safeguards address invalid or inoperable electronic addresses?

A6: The proposed rules require that the system for furnishing NOIAs be designed to alert the administrator when a covered individual’s electronic address becomes invalid or inoperable (e.g., if a NOIA is returned as undeliverable). When alerted, the administrator must promptly take reasonable steps to cure the problem (e.g., by using a secondary electronic address provided by the individual or obtaining a new valid address). If the problem cannot be resolved, the covered individual must be treated as if they had elected to opt out of electronic delivery, and the administrator must furnish paper versions of the covered documents as soon as reasonably practicable.

Q7: What initial notice must be provided before using the safe harbor?

A7: Before relying on the safe harbor for any individual, the administrator must furnish an initial notification containing (1) a statement that covered documents will be furnished electronically; (2) identification of the electronic address that will be used; (3) instructions necessary to access covered documents; (4) a cautionary statement about document availability; (5) a statement of the right to request paper copies free of charge; and (6) a statement of the right to opt out of electronic delivery free of charge. This initial notice cannot be provided electronically, except as noted below. It must be furnished on paper, whether by mail to each participant’s home address, through distribution at work, or otherwise. However, in a departure from the 2020 pension safe harbor, the proposed rules provide that for group health plans, the administrator may provide the initial notice electronically to covered individuals who have already been receiving electronic disclosures under the 2002 safe harbor. The DOL reasoned that participants already accustomed to electronic delivery need not receive paper notice of the transition to the new framework.

Q8: How does the proposed safe harbor differ from the 2020 pension plan safe harbor?

A8: While the proposed group health plan safe harbor largely mirrors the 2020 pension safe harbor, there are several differences:

• No Direct Email Option: The 2020 pension safe harbor permits administrators to furnish covered documents directly via email (in addition to the notice-and-access model); however, the proposed group health plan safe harbor does not include this option. The DOL explained that many group health plan disclosures contain sensitive information (i.e., PHI protected by HIPAA), and that email is not always the most secure means to deliver such information. As such, participants must be able to read, download, and print covered documents from the website where they access them.
• Documents Furnished Upon Request: The 2020 pension safe harbor exempts documents that must be furnished only upon request from the definition of covered documents. The proposed group health plan safe harbor does not include this exemption, which means that documents specifically requested by a covered individual may be furnished electronically, with the administrator directing the individual to the website where such documents are available.
• Paper Copy Fees: The 2020 pension safe harbor permits administrators to charge for paper copies after providing one free copy of any specific covered document. As noted above, the proposed group health plan safe harbor would require administrators to provide all paper copies free of charge, without limitation.
• Initial Paper Notice Exception: The 2020 pension safe harbor requires the initial notification of default electronic delivery to be furnished on paper to all individuals—including those who were already receiving electronic disclosures under the 2002 safe harbor. As noted above, the proposed group health plan safe harbor permits administrators to furnish this initial notice electronically to individuals who were already receiving electronic disclosures under the 2002 safe harbor prior to the rule’s effective date.

Q9: Can notices be combined under the proposed rules?

A9: The proposed rules permit administrators to furnish a single combined NOIA that incorporates content for multiple covered documents under certain circumstances. Specifically, a combined NOIA may be used for (1) the Summary Plan Description; (2) any covered document that must be furnished annually and does not require action by the covered individual by a particular deadline (for example, an open enrollment deadline); (3) any other covered document authorized in writing by the Secretary of Labor to be issued under a single combined NOIA; (4) any applicable notice required by the Internal Revenue Code if authorized by the Secretary of the Treasury to be issued under a single combined NOIA; and (5) any covered document that must be furnished with annual enrollment materials or that describes plan benefits, if the NOIA is provided at annual enrollment time. If a combined NOIA is used, it must be furnished each plan year (and no more than 14 months after the prior year’s combined NOIA). Importantly, even when a combined NOIA is furnished once per year, each underlying covered document must still be made available on the website no later than its applicable ERISA deadline.

Q10: Can insurers and TPAs use the safe harbor on behalf of group health plans?

A10: Yes. The DOL acknowledges that group health plan administrators often contract with health insurance issuers or third-party administrators (TPAs) to provide disclosures required under ERISA. Accordingly, if a health insurance issuer and a group health plan sponsor enter into a written agreement under which the issuer agrees to provide the information required under ERISA, the issuer may utilize the safe harbor under the proposed rules. Similarly, the website required by the safe harbor may be established and maintained by an issuer (for insured plans) or by a TPA or other service provider (for self-insured plans). Note, delegation of website-related activities does not relieve the administrator of its compliance obligations under the safe harbor or its general fiduciary duties under ERISA to prudently select and monitor service providers to ensure they are complying with the obligations delegated to them.

Q11: What happens when an employee terminates employment?

A11: When a covered individual who is an employee terminates employment—and the administrator has been using an employer-assigned electronic address to furnish covered documents—the administrator must take measures reasonably calculated to ensure the continued accuracy and availability of such electronic address or to obtain a new electronic address that enables receipt of covered documents following the individual’s severance from employment. This is particularly important for group health plans given the continuing COBRA and other disclosure obligations that apply to former employees and their dependents.

Q12: What are some compliance considerations for group health plan administrators who may seek to take advantage of the safe harbor (if and when it is finalized)?

A12: The proposed rules include several important compliance considerations:

• Voluntary Safe Harbor: The proposed safe harbor is an additional option for compliance with disclosure obligations—not a mandate. Administrators may continue to use the 2002 safe harbor, furnish paper documents by mail or hand-delivery, or use any other method reasonably calculated to ensure actual receipt. The choice of delivery method remains at the administrator’s discretion.
• Reasonable Procedures: The proposed rules include a provision addressing temporary unavailability of covered documents due to technical maintenance or unforeseeable events beyond the administrator’s control. The conditions of the safe harbor will be satisfied despite temporary unavailability if the administrator (1) has reasonable procedures in place to ensure documents are available as required, and (2) takes prompt action to restore availability once the administrator knows or reasonably should know of the issue.
• HIPAA and Other Laws: Compliance with the proposed safe harbor is not determinative of compliance with other applicable federal or state laws. The proposed rules explicitly remind administrators that group health plans are covered entities under HIPAA and must comply with HIPAA’s provisions regarding the confidentiality and privacy of PHI. As noted above, the interplay between ERISA disclosure requirements and HIPAA privacy obligations was a primary driver behind the decision not to permit direct email delivery of group health plan documents.
• Claims Procedures: The proposed rules would amend the ERISA claims regulation to align it with the new safe harbor. Specifically, electronic notification of adverse benefit determinations and benefit determinations on review would be permitted if they comply with the standards of the proposed safe harbor.

***

If you have questions about these proposed rules or their potential impact on your group health plans, please reach out to the authors, other members of our Benefits Consulting Group, or your usual Ropes & Gray advisor. In addition to providing legal guidance regarding health and welfare plan compliance with ERISA, COBRA, HIPAA, ACA, and the Internal Revenue Code, our Benefits Consulting Group can manage our clients’ vendor relationships (including negotiation of administrative service agreements), strategize on all aspects of plan design and cost of benefits, implement new benefit programs, and review, underwrite, and negotiate health and welfare plan renewals for our clients.