In a March 21, 2022 statement, President Joe Biden cautioned businesses in the private sector to harden their cyber defenses, reiterating earlier warnings related to potential cyberattacks against U.S. organizations by Russia.
While there is no evidence of an imminent attack tied to the Russia-Ukraine crisis, Biden’s top cybersecurity officer, Anne Neuberger, noted the everyday cyber risks businesses face and the potential for Russian-led cyberattacks call for urgency.
WORLD Observation –While only tangential to employer plans, as we have noted previously, employers should note it as it provides a reminder about possible employer plan issues.
Employers often forget that they are fiduciaries concerning their employee groups’ medical and other welfare benefit plans. Fiduciary responsibility has traditionally been an issue for retirement plans, particularly 401(k) plans, as they contain employee funds. Therefore, safeguarding those funds would easily be seen as a fiduciary obligation of the employers who sponsor those plans.
Welfare benefit plans, particularly insured medical plans that most employers sponsor, do not seem to raise the same concerns. While it may have been true in the past, with the advent of several recent legislative and regulatory changes, that is less true today.
The Transparency requirements, the No Surprises Act requirements, and Mental Health Parity obligations are all the explicit responsibility of the employer, even though typically, the insurance carriers, TPAs, and other vendors perform the functions associated with those obligations. With some exceptions for fully insured medical plans, the employer will be responsible for the violations. Even more directly, the employer is charged with assessing that the fees or other compensation earned by brokers or consultants are reasonable under ERISA, per the compensation disclosure rules.
Similarly, these new warnings about potential cyberattacks from the Biden administration should serve as a reminder for employers to consider cyber protections as part of their plans. Further, the HIPAA rules for plans, specifically those covered by the Health Information Technology for Economic Clinical Health Act (“HITECH”), require sponsors to evaluate their plans technical safeguards. (Fully insured plans generally can rely on the carriers for compliance with HIPAA privacy and the HITECH rules).
The Biden Administration issued a fact sheet with specific guidance on protective measures.
These precautions are not new concepts to most employers. Nonetheless, we often lose sight of the requirements, becoming less vigilant when we do not see the threat as imminent. This serves as an excellent reminder to take the time to protect your company’s digital assets, review the potential threats to your employer plans and make sure you have the appropriate defenses in place.