The U.S. HHS OCR highlighted a 256% rise in hacking-related breaches and a 264% increase in ransomware over five years, emphasizing the importance for health plan fiduciaries to ensure HIPAA compliance, update business associate agreements, and actively engage vendors on data protection and incident response in light of a major cybersecurity incident involving Change Healthcare. Fiduciaries are advised to document these efforts to demonstrate regulatory diligence.

A February 2024 class action lawsuit alleges that Johnson & Johnson and its fiduciaries breached their ERISA fiduciary duties by mismanaging prescription drug benefits, resulting in excessive costs to the health plan and its employees. The case highlights the critical responsibility fiduciaries have to prudently select, monitor, and negotiate with pharmacy benefit managers and other health plan service providers to minimize costs and maximize plan value.

In December 2023, the IRS issued Q&As clarifying key provisions of the SECURE 2.0 Act related to 401(k) plans, including defining a “de minimis” financial incentive for employee deferrals as no more than $250 and outlining conditions for terminal illness distributions, which plans are not required to offer and only to employees eligible for in-service distributions. The guidance also extends plan amendment deadlines through 2026-2029 based on plan type and details optional Roth treatment of employer contributions, highlighting tax withholding implications for employees.