Benefits compliance checklist

Last updated: February 5, 2026

Checklists can help employers comply with the reporting and notice requirements of various laws governing employer-sponsored benefits. This guide covers some of the important disclosure responsibilities of the ACA, COBRA, ERISA, FMLA, HIPAA and Medicare Part D.

Benefits compliance checklist key takeaways

• Tracking disclosure and reporting requirements is an essential aspect of any benefits compliance checklist.
• There are many laws that require notices and disclosures, including but not limited to the ACA, COBRA, ERISA, FMLA and HIPAA.
• Among other details, notices and disclosures help keep employees aware of coverage availability, material changes to plans and breaches in privacy or security.

What is employee benefits compliance?

Benefits compliance is how group health plan sponsors adhere to numerous reporting and disclosure requirements imposed by the government. Some of these mandates pertain to all employers, while others are applicable based on business size. Prominent examples include:

• Affordable Care Act (ACA)
• Consolidated Omnibus Budget Reconciliation Act (COBRA)
• Employee Retirement Income Security Act (ERISA)
• Family and Medical Leave Act (FMLA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Medicare Part D

Affordable Care Act checklist

The ACA requires applicable large employers (ALEs) to sponsor health coverage for their full-time employees (and dependent children) that is affordable and provides minimum value. The law also created the following notice and disclosure obligations for group health plans:

• Statement of grandfathered status – Plan administrators or issuers must provide this statement periodically, along with participant materials describing plan benefits, such as the summary plan description (SPD) and open enrollment materials. This requirement only applies to grandfathered plans.
• Notice of selection of providers – Plan administrators or issuers must distribute this notice whenever the SPD or a similar description of benefits is provided to a participant. The information is designed to help participants understand their care choices and expected costs.
• Uniform summary of benefits and coverage (SBC) – Plan administrators or issuers must provide the uniform SBC to participants and beneficiaries at certain times, including upon application for coverage and at renewal. They must also provide 60 days' advance notice of any material changes to the summary that occur mid-plan year.
• Exchange notice – Employers must provide all new hires with a written notice about the ACA’s health insurance exchanges.

Form W-2, Wage and Tax Statement reporting

Employers sponsoring group health plans must disclose the aggregate cost of the coverage provided to employees on their annual Form W-2 statements. Small businesses that file fewer than 250 Forms W-2 per year are exempt from this requirement until further guidance is provided.

Patient-Centered Outcomes Research Institute (PCORI) fees

Employers with self-insured health plans must help finance comparative effectiveness research. The fees are reported and paid using IRS Form 720, Quarterly Federal Excise Tax Return. If plans are fully insured, the health insurance issuer is responsible for reporting and paying PCORI expenses.

Sections 6055 and 6056 reporting

• ALEs are required to report certain information to the IRS under Section 6056 of the Internal Revenue Code (IRC).
• Non-ALEs that sponsor self-insured plans must report information under Section 6055.
• Non-ALEs that sponsor insured plans or do not offer health insurance are not required to report under either Section 6055 or Section 6056.
• IRC Sections 6055 and 6056 both require employers to provide related statements to employees upon request if certain conditions are satisfied.

These reporting requirements can be fulfilled using IRS Forms 1094 and 1095.

Consolidated Omnibus Budget Reconciliation Act checklist

COBRA requires applicable employers to provide eligible employees and their dependents who would otherwise lose group health coverage as a result of a qualifying event with an opportunity to continue coverage. Under this law, notices are necessary in certain situations:

• Initial or general COBRA notice – Plan administrators must generally provide an explanation of COBRA coverage and rights within 90 days of when group health plan coverage begins.
• Notice to plan administrator – Employers must notify plan administrators of certain qualifying events, such as an employee’s termination or reduction in hours, an employee’s death, an employee’s Medicare entitlement, or the employer’s bankruptcy. The notice must be provided within 30 days of the qualifying event, or the date coverage would be lost as a result of the qualifying event, whichever is later.
• COBRA election notice – Plan administrators must generally provide this notice within 14 days after being notified of a qualifying event (44 days after the qualifying event if the employer is the plan administrator).
• Notice of unavailability of COBRA – If an individual is ineligible for COBRA, the plan administrator generally must notify that person within 14 days after being alerted of the qualifying event (44 days after the qualifying event if the employer is the plan administrator).
• Notice of early termination of COBRA – Plan administrators must provide an early termination notice as soon as practicable following the determination that COBRA coverage will terminate earlier than the end of the maximum coverage period.
• Notice of insufficient payment – Plan administrators must notify a qualified beneficiary if a COBRA payment was less than the total due by an insignificant amount before coverage is terminated for nonpayment.
• Premium change notice – Plan administrators should provide a notice of premium increases at least one month prior to the effective date.

Employee Retirement Income Security Act checklist

ERISA establishes strict fiduciary duty standards for individuals who operate and manage employee benefit plans, and requires them to create and follow claims and appeals procedures. Plan administrators must also provide the following notices and disclosures:

• Summary plan description –
  • Plan administrators must automatically provide an SPD to participants within 90 days of becoming covered by the plan
  • An updated SPD must be provided at least every five years if changes are made to the information in the document
  • Lacking any changes, an updated SPD must be supplied at least every 10 years.

• Summary of material modifications (SMM) –
  • Plan administrators must automatically provide an SMM to participants within 210 days after the end of the plan year in which a change was adopted.
  • If benefits or services are materially reduced, participants generally must be supplied the SMM within 60 days of adoption.
  • Plan administrators and issuers must also provide 60 days’ advance notice of any material modification to plan terms or coverage that takes effect mid-plan year and alters the content of the SBC. This notice can be distributed to participants via an updated SBC or by issuing an SMM.

• Plan Documents – Plan administrators must provide copies of plan documents within 30 days of a written request.

Form 5500 requirements

Form 5500 is used to ensure that employee benefit plans are operated and managed according to ERISA’s standards. The filing requirements vary by the type of ERISA plan, but unless an extension applies, the form must be filed by the last day of the seventh month following the end of the plan year (e.g., July 31 of the following year for calendar-year plans).

Summary annual report (SAR)

The SAR is a narrative summary of the Form 5500 and includes a statement of the right to receive a copy of the plan's annual report. It generally must be provided within nine months after the end of the plan year. If the Form 5500 filing deadline was extended, the SAR must be supplied within two months after the end of the extension period.

Note: Administrators of ERISA plans are subject to the Form 5500 and SAR requirements unless an exception applies.

Family and Medical Leave Act checklist

The FMLA provides eligible employees with job-protected leave for certain family and medical reasons. Employers covered under the law must also provide the following notices and disclosures:

• General notice – Covered employers must prominently post a general FMLA notice where it can be readily seen by employees and applicants for employment. If employers have any FMLA-eligible employees, they must also include the general notice in the employee handbook or other written employee guidance, or provide a copy of the notice to each person upon hire.
• Eligibility/rights and responsibilities notice – Written guidance must be provided to employees when they notify employers of the need for FMLA leave. The material should explain the employee’s specific expectations and obligations, as well as the consequences for failing to fulfill them.
• Designation notice – Once employers have sufficient information, they must inform the employee whether the requested leave is designated as FMLA leave.

HIPAA portability checklist

HIPAA’s portability rules are designed to help individuals transition from one source of health coverage to another without facing discrimination based on health status. It also permits special enrollment opportunities. Fully complying with this law requires the following notices and disclosures:

• Notice of special enrollment rights – Plans and issuers must supply this notice at or before the time an employee is initially offered the opportunity to enroll in a plan.
• Notice of alternative wellness program standard – Group health plans and issuers that offer health-contingent wellness programs must disclose the availability of an alternative standard to receive a reward under the program. This disclosure must be included in all materials that describe the wellness program.

HIPAA privacy and security checklist

The HIPAA privacy rule governs the use and disclosure of an individual’s protected health information (PHI), and the security rule establishes standards for protecting electronic PHI. These rules also require the following notices and disclosures:

• Notice of privacy practices – Plans and issuers must provide this notice when a participant enrolls, upon request and within 60 days of a material revision. Additionally, participants must be informed about the notice’s availability at least once every three years.
• Notice of breach of unsecured PHI – Covered entities and their business associates must provide notification following a breach of unsecured PHI without unreasonable delay and no later than 60 days following the discovery of the breach.

Special rules for fully insured plans

Sponsors of fully insured plans that do not have access to PHI for plan administrative purposes are not required to maintain or provide a HIPAA privacy notice. If PHI is accessible in plan administration, the sponsor must fully comply with the privacy notice requirements.

Medicare Part D checklist

Employer-sponsored health plans offering prescription drug coverage to individuals who are eligible for coverage under Medicare Part D must comply with the following disclosure requirements:

• Disclosure notices for creditable or non-creditable coverage – Medicare Part D eligible individuals who are covered by, or apply for, prescription drug coverage under the employer’s group health plan must be notified whether the coverage is creditable or non-creditable. This disclosure must be provided at certain times, including before the Medicare Part D annual coordinated election period.
• Disclosure to the Centers for Medicare and Medicaid Services (CMS) – Employers must disclose to CMS whether their plan’s coverage is creditable. This notice is required annually within 60 days after the beginning of the plan year and upon any change that affects the plan’s creditable coverage status.

The costs of ignoring employee benefits notice and disclosure requirements

Failing to fulfill notice and disclosure responsibilities can result in expensive penalties. The exact amount incurred varies by law and may be adjusted for inflation each year.

For example, the ACA imposes penalties of up to $1,000 for each willful failure to provide an SBC on time. This infraction may also trigger an excise tax of $100 per day, per individual.

Frequently asked questions about benefits compliance checklists

What are the most common mistakes a benefits compliance checklist helps prevent?

Benefits compliance checklists can help employers avoid two of the most common COBRA-related infractions:

1. Failing to distribute materials to COBRA participants during annual open enrollment.
2. Failing to send an election notice to a spouse living at a different address from a COBRA participant.

Employers may use a single COBRA election notice for qualified beneficiaries who reside at the same address. However, if employers know that a spouse lives at a different address (based on the most recent information available), they must send a separate COBRA election notice to that individual. Benefits compliance checklists can serve as a reminder to track all COBRA beneficiaries and their locations.

If we use a broker, TPA or payroll vendor, are we still responsible for compliance?

Yes, employers ultimately remain responsible for employee benefits compliance, even when using brokers, third-party administrators (TPAs) or payroll providers. These third parties act as agents, while employers serve as plan sponsors. Therefore, they retain the fiduciary duty and legal obligation to administer plans correctly and adhere to laws, like ERISA, ACA and COBRA.

This article is intended to be used as a starting point in analyzing benefits compliance and is not a comprehensive resource of requirements. It offers practical information concerning the subject matter and is provided with the understanding that ADP is not rendering legal or tax advice or other professional services.