BENEFITS DIGEST

Primary sources. Practical insight. Every weekday.

A publication of The Inner Firm

Thursday, August 13, 2026

№ 30

23 items · ~5 min read

Regulatory & Guidance (1)·Retirement Plans (9)·Health & Welfare (6)·Case Commentary (3)·Leave & Time Off (2)·Executive Compensation (1)·Also Noteworthy (1)

The Two Things

The First Thing: Rollovers may finally get simpler. In Notice 2026-49, the IRS proposes four optional sample forms and standardized procedures for moving money between employer plans or between a plan and an IRA, the first flesh on SECURE 2.0 section 324's promise to replace paper checks and faxes with a predictable process. Use is optional and no safe harbor attaches yet; comments are due October 23.

The Second Thing: The largest health data breach of 2026 is an employee benefits story, and its full scale just reached the federal record. A May cyberattack on DentaQuest, the dental and vision administrator serving 32 million Americans, was first assessed at 2.6 million individuals, then 15 million; the breach notice now on file with federal regulators puts it past 23 million, with Social Security numbers, member identifiers, and treatment records among the stolen data. Plan sponsors whose group plans touch DentaQuest should be pulling business associate agreements and confirming notification obligations before the class actions arrive.

Regulatory & Guidance (1)

Notice 2026-49: IRS Proposes Simplified Rollover Procedures and Sample Forms
IRSDeadline 2026-08-12

Implementing SECURE 2.0 section 324, the IRS proposes four optional sample forms and standardized procedures for rollovers between employer plans or between a plan and an IRA, aiming to replace today's paper-check-and-fax friction with a predictable process. Use of the forms would be optional and no safe harbor attaches yet; comments are due October 23, 2026.

Retirement Plans (9)

Your 401(k) TPA Isn’t Your Insurance Policy
The Rosenbaum Law Firm · via JD Supra 2026-08-12

Hiring a third-party administrator does not transfer responsibility for operating a retirement plan. Rosenbaum on the most common post-compliance-problem surprise he hears from plan sponsors, and where TPA reliance actually ends.

What ERISA Plan Sponsors Should Know About the FTC-Caremark PBM Settlement
Davis Wright Tremaine · via JD Supra 2026-08-12

The FTC's July settlement with Caremark resolved allegations that rebate-driven formulary practices inflated insulin list prices and patient costs. DWT draws out the plan-sponsor implications, a companion to yesterday's IFEBP settlement-terms analysis.

Health & Welfare (6)

DentaQuest Breach Exposes Data of 15M People, a Record This Year
Healthcare Dive 2026-08-11

A May cyberattack on DentaQuest, the dental and vision benefits administrator serving 32 million Americans, compromised the health data of at least 15 million individuals, the largest health data breach reported to federal regulators this year. Plan sponsors whose group plans use DentaQuest should be reviewing their business associate agreements and notification obligations.

DentaQuest Starts Notifying 15 Million+ Individuals About May 2026 Cyber Incident
HIPAA Journal 2026-07-23

The detailed accounting, published as notification letters began going out: names, Social Security numbers, member and Medicaid/Medicare identifiers, and dental and vision treatment and billing information, with independent analysis suggesting up to 23.4 million unique individuals, including 1.7 million Social Security numbers that appear to belong to children. Affected individuals are being offered 24 months of credit monitoring.

DentaQuest Disclosed a Data Breach That Impacted 23 Million Individuals
Security Affairs 2026-07-27

The security press take from late July: the ShinyHunters extortion group claimed responsibility for the May intrusion, stealing 234 GB of data after ransom negotiations failed, with files dating back to 2009 and a final assessment above 23.4 million people, well past the 15 million in initial reports.

IRS Proposes Rules on Dependent Care FSA Discrimination Testing, Including 55% Benefits Test
Lockton 2026-08-12

Lockton's compliance team digs into the section 129 half of this week's proposed regulations and finds the detail vendors will care about most: the 55% average benefits test denominator counts only employees actually receiving dependent care assistance, not the whole workforce. The alert walks through correction mechanics for failed tests and advises employers to test early and verify their vendor's methodology for 2026.

Finally! DOL Proposes New ERISA Health Plan Electronic Disclosure Rule
Warner Norcross + Judd · via JD Supra 2026-08-12

Warner Norcross joins the e-disclosure commentary with the practitioner's sigh of relief in the title: the DOL's proposed additional safe harbor would let group health plan administrators furnish required disclosures electronically.

Case Commentary (3)

Fourth Circuit Expands Class Certification Defense to 401(k) Class Actions
Bradley · via JD Supra 2026-08-13

Class actions aggregating employee claims against 401(k) plans are big litigation, with gross settlements exceeding $500 million since 2021. Bradley on how the Fourth Circuit's certification reasoning arms defendants, the latest entry in the class-certification story that led yesterday's Digest.

Leave & Time Off (2)

Executive Compensation (1)

Also Noteworthy (1)