BENEFITS DIGEST

The Ninth Circuit allowed claims over an alleged disclosure of confidential health information to proceed without requiring a separate showing of financial loss. It revived state-law claims against AmeriBen after an employee allegedly emailed a spreadsheet containing members’ identifying and claims information without authorization. The court connected the asserted injury to a recognized breach-of-confidence harm. It didn’t decide that AmeriBen was liable, create a private HIPAA claim or hold that every disclosure automatically satisfies the constitutional injury requirement.

An associate at AmeriBen, the company administering the plaintiffs’ employer health plan, emailed a spreadsheet of members’ claims data, names, providers, dates of service and amounts billed, to other plan members. The district court dismissed the resulting class action, finding no concrete injury. The Ninth Circuit reversed in a published opinion, holding that unauthorized disclosure of sensitive health information entrusted to a company is itself the injury. Congress’s judgment in HIPAA reinforced the point, since even mundane-looking line items can reveal a psychiatrist visit or a fertility clinic. The ruling allows the patients’ suit to proceed without requiring them to show that the disclosure caused financial loss, and it matters to sponsors because the defendant administers employer health plans across the country.

The FTC and the states have taken over where HIPAA stops on health data from website trackers. Goodwin's survey starts from the July action against telehealth platform Hims & Hers over tracking code that shared customer information with advertising platforms, and maps the wider landscape after a 2024 court ruling curbed HHS's position that tracking data from website visitors who are not logged in counts as protected health information. California wiretap and privacy statutes, Washington's My Health My Data Act, and more than 20 other state laws now regulate consumer health data outside HIPAA. Employers should check their wellness portals, benefits tools, and plan websites for tracking technology that shares information with advertising companies. HIPAA is not the only privacy law that may apply.

The comment period closed September 21 on the proposal to let group health plans deliver required notices electronically. As Hall Benefits Law explains, the optional safe harbor works by posting documents online and notifying participants where to find them, by email or through a web portal, mirroring what retirement plans have had since 2020, and anyone who prefers paper can opt out and receive paper copies. It would cover summary plan descriptions, summaries of benefits and coverage, COBRA notices, and HIPAA special-enrollment notices, among others. The website, which can be a mobile app, must keep documents up at least a year, be searchable, and let users print or save. One caution from [Marsh's alert](https://www.mercer.com/en-us/insights/us-health-news/dol-proposed-rule-would-ease-e-delivery-by-erisa-group-health-plans/) for sponsors planning ahead. A wrap document, a single document combining several benefit programs, may not fully qualify, because the safe harbor covers group health plan disclosures only.

The fourth quarter calendar for health and welfare sponsors, in one place. October 2 brings QSEHRA and ICHRA notices and Medicare Part D subsidy applications; October 15, creditable coverage notices and extended Form 5500s; December 15, summary annual reports for extension filers; December 29, the employer share of MLR rebates within 90 days of receipt; December 31, gag clause attestations plus WHCRA and Section 1557 notices. A companion checklist covers open enrollment materials—SBCs, Michelle's Law, HIPAA notices, wellness alternative standard disclosures—and the state assessments landing this quarter, from Massachusetts payor assessments to Washington's long term care tax.

The premise is simple—automation does not transfer liability. The guide works through six exposure points: AI generated participant communications that still must satisfy disclosure rules, claims administration where a vendor's biased or inadequate algorithm becomes the hiring fiduciary's problem, investment menu tools that should supplement rather than replace a live 3(21) or 3(38), committee minutes that come out either dangerously verbatim or uselessly sparse, confidentiality and HIPAA risk when nonpublic data reaches AI features, and service agreements that should name AI uses, testing, and approval rights.

A reminder that the July 23 proposed rule extending a notice-and-access electronic delivery safe harbor to ERISA group health plans is open for comment through September 21. The proposal mirrors the 2020 retirement-plan safe harbor but is website-only, with no direct email option, reflecting HIPAA privacy concerns, and it preserves unlimited free paper copies and a full opt-out for participants.

A self-funded group health plan is generally a HIPAA covered entity, while the third-party administrator that processes its claims is a business associate. Constangy walks through what the distinction means for the compliance obligations on each side.

Groom situates the new tri-agency FAQ relief against the litigation wave that produced it: by the firm's count, the HIPAA wellness program rules have drawn more than 80 putative class actions claiming that premium surcharges for tobacco use violate ERISA. The relief addresses the midyear reward-timing and notice-disclosure questions; the broader surcharge fights, including the pending Sixth Circuit appeal in the Progressive case, remain in the courts.

Federal regulators will not enforce a rule requiring wellness program rewards to be paid retroactively to the start of the plan year when a participant meets a reasonable alternative standard midyear, as long as the plan pays the reward for the rest of the year. The guidance also confirms that the reasonable alternative standard notice is required only in materials that actually describe the program's terms, not in materials that merely mention it.

A May cyberattack on DentaQuest, the dental and vision benefits administrator serving 32 million Americans, compromised the health data of at least 15 million individuals, the largest health data breach reported to federal regulators this year. Plan sponsors whose group plans use DentaQuest should be reviewing their business associate agreements and notification obligations.

The detailed accounting, published as notification letters began going out: names, Social Security numbers, member and Medicaid/Medicare identifiers, and dental and vision treatment and billing information, with independent analysis suggesting up to 23.4 million unique individuals, including 1.7 million Social Security numbers that appear to belong to children. Affected individuals are being offered 24 months of credit monitoring.

The HHS Office for Civil Rights announced two separate HIPAA enforcement actions against self-funded group health plans following ransomware breaches, a signal that plan-level HIPAA compliance, not just the employer's, is squarely in OCR's sights.

On April 23, 2026, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) announced settlements with four health entities following investigations into ransomware breaches that exposed unsecured electronic protected health information (“ePHI”).