The federal government is enhancing healthcare price transparency through new regulations and initiatives, while states are demanding detailed payment-integrity analyses from companies to prevent overpayment in healthcare spending. Concurrently, lawsuits allege fiduciary breaches by employers in managing insurance programs, signaling a shift toward greater scrutiny, competition, and disclosure in employer-provided healthcare.

New York's "Trapped at Work Act," effective December 19, 2025, prohibits employers from requiring workers—including employees and many non-employees—to sign employment promissory notes that obligate repayment of training or onboarding costs if they leave early, with limited exceptions. Employers must review and revise relevant agreements to ensure compliance, as violations may incur penalties, while additional regulatory guidance and potential amendments are forthcoming.

The IRS issued Notice 2025-68 providing initial guidance on Trump Accounts, a new type of traditional IRA established for children under Section 530A of the IRC, allowing tax-deferred savings with contributions from federal, parents, employers, and other sources for expenses like education and first-home purchases. Employers may contribute up to $2,500 annually pre-tax per employee under written plans, though administrative details and regulations are still forthcoming.

The Treasury and IRS proposed rules for "Trump accounts," a new type of IRA established for eligible children born between 2025 and 2029, featuring special rules during a growth period until the child turns 18, including a $1,000 government contribution, investment restrictions, and distinct contribution limits. After the growth period, Trump accounts follow standard IRA rules, while employer contributions up to $2,500 annually per employee (not per dependent) are excluded from taxable income under a specific employer program.

Effective January 1, 2026, California prohibits stay-or-pay clauses in employment contracts requiring employees to repay amounts upon termination, with limited exceptions such as certain sign-on bonuses meeting specific conditions. Employers must review and amend existing contracts to comply, as violations can lead to void provisions and potential employee lawsuits seeking damages and legal fees.

The IRS announced that for 2026, individuals with more than $150,000 in 2025 FICA wages must make catch-up retirement contributions on a Roth basis, updating the previously expected $145,000 threshold. Additionally, 401(k) contribution limits for 2026 increased, including a total contribution limit of $72,000, a deferral limit of $24,500, and catch-up limits raised to $8,000 or $11,250 depending on age.

On January 10, 2025, the IRS issued proposed rules requiring new defined contribution retirement plans to include automatic enrollment features, with specific conditions and exceptions, and provided guidance on the SECURE 2.0 mandate that catch-up contributions for participants earning over $145,000 must be designated Roth contributions, including correction procedures for errors. These rules aim to clarify compliance details for employers and plan administrators, especially amid mergers and acquisitions.

At the end of 2024, two significant lawsuits were filed impacting group health plan sponsors: a class-action alleging SaveOnSP, Express Scripts, and Accredo engaged in a fiduciary breach and RICO violations by diverting patient copay assistance funds for their own and plan sponsors’ benefit; and a challenge by the ERISA Industry Committee against Minnesota’s Pharmacy Benefit Manager law for unlawfully regulating ERISA plans and their sponsors. Additionally, ERISA fiduciaries are urged to promptly update compliance with the Mental Health Parity and Addiction Equity Act, select qualified service providers, and establish fiduciary committees to oversee health plans in 2025.

On September 6, 2024, the U.S. Department of Labor clarified that its 2021 cybersecurity guidance applies to all employee benefit plans, including health and welfare plans, urging fiduciaries to rigorously evaluate and contract with service providers based on strong cybersecurity practices and standards. The guidance emphasizes due diligence in assessing providers’ security policies, audit results, breach history, and insurance coverage to protect plan participants’ data.

The U.S. Department of Health and Human Services issued new HIPAA regulations, effective December 23, 2024, restricting employer-sponsored health plans and their vendors from using or disclosing reproductive health care information for investigations or legal actions against individuals seeking lawful reproductive services. Covered entities must update privacy policies, obtain attestations for certain disclosures, and train staff to comply with these enhanced protections following the Supreme Court's Dobbs decision.