Employers may choose self-funded group health plan coverage to gain greater flexibility in plan design and potentially reduce benefit costs. However, in doing so, there are additional responsibilities and considerations that generally do not apply for fully-insured plans. For a self-funded plan, the employer is responsible for funding plan claims with the help of a stop-loss carrier, and the employer will need a third-party administrator (TPA) to administer claims and payments. In addition, the employer will be more directly responsible for compliance. Most employers rely heavily on their TPA to assist with compliance, but it remains the employer’s responsibility as plan sponsor to manage compliance appropriately.

Below is an overview of compliance requirements for self-funded plans. Keep in mind that level-funded (or partially self-funded) group health plans are generally treated as self-funded group health plans.

• Funding & Administration §105(h) Nondiscrimination Rules
  
  
• ERISA ACA Employer Reporting (Forms 1094 & 1095)
  
  
• COBRA Essential Health Benefits – Benchmark Plans
  
  
• HIPAA Privacy & Security Mental Health Parity
  
  
• PCORI Fees Transparency Requirements
  
  
• Surprise Billing 

Funding & Administration

For funding and administration, the employer will need to:

• Obtain actuarial determinations to discern appropriate plan costs for budgeting, setting employee contributions, and setting COBRA premiums.
  
  
• Select and contract with a stop-loss carrier.
  
  
• Select and contract with a TPA to coordinate processing and paying claims. Plan sponsors will have a choice of retaining claims determination authority or outsourcing to a TPA. Claims determination authority should be clearly described in plan documents.
  
  
• Determine whether the plan will be unfunded (i.e., claims paid from employer’s general assets, not segregated) or funded (i.e., plan assets held in a separate account or trust (e.g., VEBA). Very few employers other than public entities and union-based plans set up a funded plan.
  
  
• Put appropriate accounting and auditing procedures in place since the employer funds the plan. A formal plan audit is generally not required unless the plan is funded.
  
  
• Manage the plan in a manner that serves the best interests of the participants and beneficiaries as required by ERISA.

ERISA

Most employer-sponsored plans are subject to ERISA. Especially for employers offering a self-funded group health plan, the employer should consider its ERISA fiduciary duties as plan sponsor and administrator. The plan administrator has a fiduciary duty to administer the plan properly and in accordance with its governing documents and to maintain compliance in doing so. This includes, among other things, setting and following plan terms such as benefit inclusions/exclusions, eligibility for coverage, and claims procedures; proper handling of funds (plan assets), including prudent selection and management of service providers; providing required participant disclosures; and reporting certain information to the government (e.g., Form 5500s). 

ERISA Preemption 

While a self-funded plan sponsor may have heightened fiduciary responsibilities, the plan will also qualify for ERISA preemption, allowing the plan to avoid having to comply with most state-level requirements such as insurance coverage mandates, eligibility rules, contribution requirements, continuation coverage, etc. 

Plan Documents

The TPA may provide a “benefits booklet” or coverage certificate that describes benefits provided by the plan, but the plan sponsor is usually responsible for the plan document and a summary plan description (SPD) for plans subject to ERISA. In addition, the TPA may provide a summary of benefits and coverage (SBC), but if not, the employer must take responsibility for that as well. The employer is responsible for distribution of the SPD and SBC. 

Form 5500s

An unfunded, self-funded plan with 100 or more participants is typically required to file only the main portion of the Form 5500 without any schedules. An unfunded, self-funded plan with <100 participants is not required to file a Form 5500. Most plans are unfunded, meaning plan costs are paid out of the employer’s general assets. On the other hand, if the plan is funded (i.e., assets segregated from the employer's general assets, typically via trust or VEBA), a Form 5500 is required regardless of size and additional information must be reported (e.g., via Schedule C and Schedule H).

COBRA

Self-funded group health plans offered by employers with 20 or more employees are subject to federal COBRA continuation. As mentioned above, due to ERISA preemption, self-funded plans are not subject to state continuation. Self-funded plans may determine the COBRA premium based on: (i) reasonable actuarial estimates of costs for the current plan year; or (ii) based on the cost of providing coverage in the preceding year if coverage under the plan has not significantly changed. The calculation should include anticipated paid claims, plus administrative expenses, plus changes to reserves. The employer should use an accurate estimate of the expected plan costs, including administration costs, but should NOT use the maximum liability rate under the stop-loss arrangement (or charge from the level-funded carrier). COBRA rules indicate the applicable premium must be based on the anticipated cost of providing the benefit, not the employer’s maximum potential liability.

HIPAA Privacy & Security

Employers likely face an increase in HIPAA privacy and security compliance obligations for a self-funded group health plan because the employer will have more access to protected health information (PHI). Therefore, it is important for the employer to have written privacy and security policies and procedures in place to protect the privacy of plan PHI. The employer/plan sponsor should also perform and document a security risk assessment with respect to electronic PHI and employees responsible for the management of benefit plans subject to HIPAA privacy and security rules should be trained on HIPAA requirements and on the organization's specific policies and procedures.

In addition to what is specifically required under HIPAA, DOL guidance concerning cybersecurity suggests employers as ERISA plan sponsors should take reasonable steps to implement cybersecurity practices within their organizations to protect any plan data that is stored or accessed internally, as well as ensuring that their vendors/service providers implement similar practices for the data they handle. It is recommended that employers review their existing IT/security practices in light of this guidance and make sure security practices are appropriately applied to their benefit plans.

PCORI Fees 

The employer is responsible for reporting and paying PCORI fees for self-funded plans. PCORI fees based on the number of covered lives must be reported and paid via Form 720, Line 133, by July 31st of the year following the end of the plan year. 

§105(h) Nondiscrimination Rules 

In addition to §125 nondiscrimination rules, which may already apply if the employer allows employees to contribute toward benefits on a pre-tax basis through a cafeteria plan, self-funded group health plans are subject to §105(h) nondiscrimination rules. Under §105(h) nondiscrimination rules, the plan may not structure eligibility, benefit coverage, or contributions in a manner that discriminates too much in favor of highly compensated individuals. For this purpose, highly compensated individuals include the 5 highest paid officers, >10% shareholders (if also employees), and the top 25% highest paid employees. §105(h) does not require that all benefits be offered identically for all employees, but there are tests that must be passed that restrict how much benefits can vary between classifications of employees.

ACA Employer Reporting (Forms 1094 & 1095)

All employers who offer self-funded group health plans, regardless of size, must report coverage information for all individuals (including employees, non-employees and their dependents) who enrolled in the self-funded plan. 

• Applicable large employers generally report coverage in Part III of Form 1095-C.
  
  
• Small employers (fewer than 50 FTEs) report coverage on Form 1095-B.

Employers offering self-funded group health plan coverage with covered individuals who reside in California, Massachusetts, New Jersey, Rhode Island or DC must also submit coverage reporting to the applicable state agency.

Both federal and state coverage reporting is handled on a calendar year basis, even if the self-funded plan has a non-calendar plan year, and is due early in the year following the end of the calendar year.

Essential Health Benefits – Benchmark Plan

Under the Affordable Care Act (ACA), group health plans are required to comply with certain requirements in regard to coverage of essential health benefits (i.e., 10 categories including ambulatory patient services, emergency services, hospitalization, maternity and newborn care, mental health and substance use disorder services including behavioral health treatment, prescription drugs, rehabilitative and habilitative services and devices, laboratory services, preventive and wellness services and chronic disease management, and pediatric services including oral and vision care). Self-funded plans are not required to cover all essential health benefits but cannot place annual or lifetime dollar limits on any covered essential health benefits and must count any cost-sharing toward such benefits toward the plan’s maximum out-of-pocket. Essential health benefits vary from state to state, and a self-funded plan is permitted to pick any state’s benchmark plan for purposes of determining essential health benefits. Benchmark plan details for each state can be found on CMS' website here (scroll down to get to the links by state) - https://www.cms.gov/CCIIO/Resources/Data-Resources/ehb#ehb-benchmark.

Mental Health Parity

Group health plans are generally not required to offer mental health or substance use disorder benefits, except for small fully-insured plans that are required to offer essential health benefits. However, group health plans that choose to offer any mental health or substance use disorder benefits must satisfy the following requirements for such benefits:

• No lifetime or annual dollar limits lower than the limits placed on medical/surgical benefits;
  
  
• No financial requirements (i.e., deductibles or co-payments) or quantitative treatment limitations (i.e., annual visit limitation) that are more restrictive than those placed on medical/surgical benefits; and
  
  
• No non-quantitative treatment limitations (i.e., medical management standard limiting/excluding benefits) that are more restrictive than those placed on medical/surgical benefits.

For self-funded plans, the employer is primarily responsible for compliance with the mental health parity rules, although the TPA often plays a role in plan design and claims processing. Many employers select a plan design option from the TPA, and then it is recommended that the employer confirm that the TPA designed the plan benefits in accordance with applicable coverage requirements. To the extent that the employer takes more liberties with the plan design, for example excluding or limiting coverage for certain claims or adjusting cost-sharing measures, the employer should consider whether such adjustments comply with the mental health parity requirements. The employer should also confirm that the TPA will process claims, including providing disclosures for claim denials with criteria for medical necessity determinations, as required by the mental health parity rules.

In addition to ensuring plan design and claims processing is handled in accordance with these rules, the plan is also required to prepare a written comparative analysis documenting compliance for any non-quantitative treatment limitations (NQTLs). The analysis does not need to be submitted annually, but instead is completed and kept current in the employer’s files and provided if requested (e.g., by a federal or state agency or by plan participants). Employers probably cannot complete this analysis on their own, but not all TPAs are willing to help prepare a comparative analysis or audit more generally for compliance with the mental health parity rules, in which case it may be necessary to obtain the help of an outside benefits consulting firm or law firm.

Transparency Requirements

The Consolidated Appropriations Act (CAA) and the Transparency in Coverage (TiC) Final Rule impose several new requirements on group health plans. For a self-funded plan, the responsibility of compliance lies with the employer as the plan sponsor. However, many of the requirements force employers to rely on their TPA and others to implement appropriate measures to comply with these new requirements. The following is a checklist of the various transparency requirements that employers offering self-funded group health plans need to determine whether the TPA will handle or whether the employer is responsible to handle on their own (or to find another solution). It would also be appropriate to confirm what costs, if any, may apply for the TPA’s assistance with the requirements described below.

No Gag Clause in Provider Contracts – All gag clauses must be removed from relevant provider contracts and provider contracts (e.g., TPA contracts) must also contain provisions that they will make sure not to have any gag clauses in downstream contracts either. In addition, carriers and health plans must submit an annual attestation of compliance by December 31st of each year via CMS’ online portal.

ID Cards / Provider Directory Accuracy – ID cards must include certain required information, including deductible and copay details. In addition, accurate provider directory information must be available online and by telephone, and the information is required to be verified and updated at least every 90 days. If an individual is provided inaccurate information by the provider directory stating that the provider or facility was a participating provider or facility, the plan may apply cost-sharing only equal to or less than it would for a participating provider or facility and must count such cost-sharing amounts toward any in-network deductible or maximum out-of-pocket. 

Continuity of Care – When a provider or facility is no longer in-network or covered under the plan, participants must be permitted to continue care for up to 90 days under the same terms and conditions that were in place prior to the change in network or coverage.

Health Plan Data (Machine-Readable Files) – Group health plans must make machine-readable files (MRFs) publicly available that disclose pricing information. These files generally include: (i) in-network rate information for covered items and services; (ii) out-of-network allowed amounts and billed charges; (iii) internal provider taxonomy mapping or other rules supporting the pricing disclosures; (iv) provider utilization information; and (v) a text file with the source page URL that hosts the MRF and contact information for the MRF. Except for the utilization file, which must be updated annually, the MRFs must generally be updated quarterly.

Except for the text file MRF, all MRF files should be published in JavaScript Object Notation (JSON). The files must be publicly accessible through a website, with a homepage footer link titled "Price Transparency" or "Transparency in Coverage" directing users to the disclosures. Plans must also maintain a monitored email address for inquiries regarding the files. In addition, the plan or TPA (if written statement confirms that the TPA will do so) must attest to the accuracy and completeness of the data provided in the MRFs

The TiC final rule issued in October 2026 provides a phased implementation approach during 2027 and 2028 for the required file formats and reporting content described above. Additional FAQs released around the same time indicate that technical schemas and implementation specifications for prescription drug MRFs are expected in late 2027. As a result, plans should coordinate closely with TPAs to understand implementation timelines and allocate responsibility for compliance.

Prescription (Rx) Drug Cost Reporting – The plan must submit a plan list file and 8 data files, along with narratives, containing certain information about the plan’s prescription drug and health care spending annually to CMS (the RxDC Report). The reporting is required annually in June. It is possible the information required for the RxDC Report will need to be gathered from several different sources (e.g., TPA, PBM, other vendors, employer) and that there may be multiple reporting entities involved in compiling and submitting data for the plan.

Price Comparison Tools / Cost-Sharing Disclosures – Personalized cost-sharing information for covered health care items and services from each provider must be provided through an internet-based self-service tool, by telephone, and by paper upon request. If applicable, the tool must also include a balance billing disclosure where participants may be responsible for additional amounts. This tool will typically be made available by the TPA. 

Surprise Billing

Under the No Surprises Act, balance billing is prohibited for the following claims:

• Out-of-network emergency services;
  
  
• Out-of-network air ambulance services (not ground ambulance); and
  
  
• Non-emergency services by out-of-network providers for services performed at in-network facilities.

For such claims, the plan may only impose in-network cost-sharing, and claims incurred must count toward the plan's in-network deductible and maximum out-of-pocket. In addition, the provider cannot balance bill participants for any additional amounts, although there is an exception if the provider obtains the participant's consent to charge more for non-emergency out-of-network providers at an in-network facility. For the amount that cannot be billed to the participant, the provider and plan are responsible for negotiating and settling on a total payment amount from the plan to the provider. If they cannot reach an agreement, they can use the independent dispute resolution (IDR) process, unless the claim is subject to an All-Payer Model Agreement or state law. 
For self-funded plans, this responsibility will largely be handled by the TPA on behalf of the plan, but the employer should check with the TPA to ensure the proper handling of claims, how pricing is set for such claims, the TPA's willingness/ability to handle negotiations and participate in the IDR process when appropriate, and any costs associated with the TPA's efforts.

Finally, plans are required to post a model notice on their public website (e.g., on the TPA’s website) and include the notice on each explanation of benefits (EOBs).