ACA Compliance Checklist: 8 Steps for 2026

ACA compliance is less a filing task than a recordkeeping test. The employer mandate became effective on January 1, 2015, first applying to employers with 100 or more full-time equivalent employees, while employers with 50 to 99 employees received transition relief until 2016 and employers below that level weren't subject to the mandate at that time, as explained in the University of North Carolina School of Government ACA materials. That history still explains why workforce measurement belongs at the front of every defensible ACA process.

A workable ACA compliance checklist connects employee counts, hours, eligibility, coverage offers, affordability, minimum value, plan documents, notices, carrier data, payroll deductions, and federal or state reporting. The right workflow also separates what your team owns from what a carrier, broker, payroll provider, or reporting vendor must deliver.

The eight checkpoints below follow that operating sequence. Requirements can vary by employer size, plan structure, workforce classifications, renewal date, and state. Confirm current obligations with the IRS employer ACA resources, the Department of Labor, HHS, CMS, and applicable state authorities. For employers that need one place to connect benefits, payroll, enrollment, and compliance records, Benely is one example of a centralized workflow.

Table of Contents

• 1. Employer Shared Responsibility Payment Calculations and Reporting
  • What to review every month
• 2. Health Insurance Marketplace Reporting Forms 1095-B and 1094-B
  • Reconcile before the deadline
• 3. Affordable Care Act Notice and Disclosure Requirements
  • Build a notice calendar
• 4. Preventive Services Coverage Verification and Implementation
  • Check the plan, not just the brochure
• 5. COBRA Administration and Compliance Management
  • Assign each handoff
• 6. Grandfathered Health Plan Compliance and Monitoring
  • Create a change-control file
• 7. Mental Health Parity and Addiction Equity Compliance
  • Ask for evidence, not assurances
• 8. Cost Transparency and Data Security
  • Protect the records behind the workflow
• 8-Point ACA Compliance Comparison
• Turn the Checklist Into a Year-Round Control System
  • Correct urgent issues
  • Document the correction
  • Schedule recurring reviews

1. Employer Shared Responsibility Payment Calculations and Reporting

The first question is whether your organization is an Applicable Large Employer, or ALE. The IRS generally treats an employer with 50 or more full-time employees, including full-time equivalents, as subject to section 4980H reporting rules and the Forms 1094-C and 1095-C framework. The IRS explanation of Forms 1094-C and 1095-C explains that ALE members report offers of coverage to full-time employees and family members, including self-insured coverage.

Your team owns the workforce record. That means tracking hours, employment status, waiting periods, measurement methods, terminations, leaves, and coverage offers. Your carrier or benefits administrator owns plan terms and enrollment records, while payroll owns wage and deduction data. Someone must still reconcile all three.

What to review every month

Affordability shouldn't be treated as a year-end calculation. For plan years beginning in 2026, the IRS affordability percentage is 9.96%, up from 9.02% in 2025, with recent values including 8.39% in 2024, as reported in this 2026 ACA affordability update. Review employee contributions whenever pay rates, plan costs, payroll frequency, or plan designs change.

Use a documented process to:

• Measure ALE status: Review the prior calendar year's workforce data and preserve the calculation.
• Track eligibility: Flag employees whose hours or status create a coverage-offer obligation.
• Test coverage: Confirm the offer reaches at least 95% of full-time employees and their dependents, and that the plan meets the 60% minimum value standard, according to this ACA compliance checklist from Take Command Health.
• Validate reporting: Reconcile Forms 1094-C and 1095-C against payroll, benefits, and employee records before filing.

Practical rule: If an eligibility decision can't be explained from preserved records, it isn't ready for an audit or an IRS inquiry.

Automation can reduce duplicate entry, but it doesn't replace review. Benely can help centralize payroll and benefits information, document offer activity, and surface affordability or classification issues before reporting season.

2. Health Insurance Marketplace Reporting Forms 1095-B and 1094-B

Marketplace reporting is often confused with ALE reporting. Forms 1095-B and 1094-B generally relate to coverage information reported by health insurers and certain self-insured employers. Your responsibility depends on the plan structure, funding arrangement, and whether another party is preparing the forms.

Start by assigning ownership in writing. The carrier should confirm what it will report for insured coverage. A self-insured employer or its administrator may need to assemble covered-member information, months of coverage, and identifying details. HR should maintain enrollment and eligibility records, while payroll should confirm that deductions and employment dates don't contradict coverage dates.

Reconcile before the deadline

Don't rely only on claims data. Claims may show that someone used coverage, but they don't necessarily establish the correct effective date, termination date, dependent record, or month-by-month enrollment status. Request coverage verification directly from each carrier and compare it with your benefits administration system.

A strong process includes:

• Effective-date matching: Compare enrollment elections, carrier records, payroll deductions, and termination transactions.
• Dependent validation: Confirm that covered individuals are tied to the correct employee record.
• Feed testing: Test carrier and payroll data feeds before forms are generated.
• Exception review: Investigate gaps, duplicate coverage, retroactive changes, and unexplained cancellations.
• Correction tracking: Record who identified an error, which vendor owns the fix, and whether a replacement form or filing is needed.

Begin reconciliation well before the applicable IRS deadline so carriers have time to correct source records. Keep the final data file, approval record, submission confirmation, and employee communications together.

For a practical explanation of employer reporting responsibilities, review Benely's ACA reporting requirements guide. It can help benefits teams distinguish data verification, filing preparation, and questions that require qualified tax or benefits advice.

A vendor can prepare forms, but the employer still needs to validate the underlying population. The best arrangement gives one person authority to approve the final file and one backup reviewer who understands the plan structure.

3. Affordable Care Act Notice and Disclosure Requirements

Notice failures usually happen because employers treat communications as an afterthought. Employees need clear information about coverage, enrollment, plan terms, rights, and changes. The documents may come from different sources, but HR needs a controlled distribution process.

The summary of benefits and coverage, or SBC, should match the plan offered. The Notice of Exchange Alternatives, notices relating to grandfathered status, patient-protection information, privacy notices, and other required disclosures should be mapped to hiring, enrollment, qualifying events, and plan changes. The exact obligation depends on the employer, plan, and notice type, so use the Department of Labor's health benefits compliance assistance alongside carrier guidance.

Build a notice calendar

Create a calendar that names the notice, triggering event, audience, delivery method, owner, source document, and proof of delivery. Store the delivered version, not just the template. When a carrier changes plan language, archive the old version and prevent it from being reused.

Useful controls include:

• New-hire delivery: Add required notices to onboarding and verify delivery for employees without work email.
• Open-enrollment review: Obtain carrier materials early enough to correct inconsistent terms.
• Change management: Trigger a review whenever deductibles, networks, contributions, eligibility, or plan documents change.
• Access controls: Give employees a reliable way to retrieve current notices and request paper copies.
• Acknowledgment records: Track delivery or acknowledgment where appropriate, without treating an acknowledgment as proof that the employee understood every term.

Electronic delivery may be efficient, but it needs a reliable access process. Maintain print-on-demand capability and document how employees without regular electronic access receive materials.

A notice repository should answer three questions quickly: what was sent, to whom, and which plan version was in force?

Carriers and brokers often supply content, but the employer owns the employee experience and should verify that the correct population received the correct document. A centralized platform can connect the notice calendar with onboarding, enrollment, and employee records, reducing the chance that a required communication lives only in an inbox.

4. Preventive Services Coverage Verification and Implementation

Preventive-care compliance is a plan oversight responsibility, not merely a communication exercise. Under ACA section 2713, non-grandfathered health plans generally must cover specified preventive services without cost-sharing when delivered in-network, including applicable USPSTF Grade A or B services, ACIP immunizations, HRSA women's services, and pediatric preventive services. The HealthCare.gov preventive services guidance provides a public explanation of the categories employees may encounter.

The carrier processes claims, but the employer should verify that the plan design and administrative instructions match the legal requirement. Ask for current preventive-care implementation materials, review the summary plan description, and compare employee-facing explanations with the claims rules.

Check the plan, not just the brochure

A recurring review should cover:

• Service coding: Confirm that eligible preventive services are identified correctly at the point of service.
• Network rules: Verify how in-network status affects cost-sharing.
• Age and frequency rules: Review the conditions attached to specific services.
• Provider communication: Ask how carriers notify providers about updated coverage rules.
• Employee complaints: Create an escalation path for unexpected copays, deductibles, or coinsurance.

The 2026 plan-year period also requires attention to updated preventive-care obligations. Independent compliance guidance identifies patient navigation for breast and cervical cancer screening, additional breast cancer imaging, and updated RSV, pneumococcal, and influenza vaccine coverage among requirements that non-grandfathered plans may need to address for plan years beginning in 2026. Review the employee benefits compliance checklist from Apex Benefits Group with your broker or adviser and match the review to your plan's start date.

Don't promise employees that every preventive service is free in every circumstance. Explain the in-network and plan-design conditions clearly, then direct disputed claims to the carrier's appeals process. Preserve carrier confirmations, plan amendments, employee communications, and correction records in the same compliance file.

5. COBRA Administration and Compliance Management

COBRA administration begins with a qualifying event, but the compliance risk begins earlier. HR, payroll, managers, and benefits administrators must communicate quickly when employment ends, hours are reduced, or another event affects eligibility. The employer also needs a reliable handoff to its COBRA administrator.

COBRA generally applies to group health plans maintained by employers with 20 or more employees, subject to the law's detailed rules and exceptions. Qualified beneficiaries may continue coverage for a period that can extend to 36 months, and the plan may charge the individual the applicable premium plus a 2% administrative fee, as described in the Department of Labor's COBRA continuation coverage guidance. These figures are legal parameters, not permission to let a vendor operate without oversight.

Assign each handoff

The employer owns the event data and should define who reports it. Payroll may know the termination date, HR may know whether the event is a reduction in hours, and the carrier or administrator may control election and premium records. If those systems disagree, the beneficiary can receive a late or incorrect notice.

Maintain a record with:

• Event details: Record the event type, employee, dependents, and effective dates.
• Notice status: Capture when the notice was generated, sent, and returned.
• Election tracking: Monitor elections, waivers, payments, reinstatements, and termination dates.
• Premium reconciliation: Match collected premiums to coverage months and carrier invoices.
• Exception resolution: Escalate missing addresses, returned mail, late event reports, and retroactive eligibility changes.

Don't use a spreadsheet as the only control when turnover or qualifying-event volume is high. A spreadsheet can remain useful as an export or review tool, but automated reminders and an audit trail are safer for deadline-driven work.

For a focused review of notice timing and administration, see Benely's COBRA notice requirements resource. Even when Benely or another vendor performs the administration, retain the service agreement, event feed specifications, delivery evidence, and escalation contacts.

6. Grandfathered Health Plan Compliance and Monitoring

A plan's grandfathered status requires active preservation, not passive assumption. The plan generally must have been in effect on March 23, 2010, and maintained continuously under the applicable rules. Document that history, then review every proposed amendment before approval.

Grandfathered plans still must follow important ACA protections, including dependent coverage to age 26, prohibitions on lifetime and annual dollar limits for essential health benefits, and applicable appeals and disclosure requirements. The Department of Labor's grandfathered health plan guidance explains that certain changes beyond permitted limits can end the status.

Create a change-control file

The carrier or adviser may analyze whether an amendment affects grandfathered status. The employer owns the approval decision and should obtain that analysis before implementation. An annual renewal packet is too late if a deductible, copay, contribution, or benefit change has already altered the plan's position.

Keep:

• Historical plan documents: Preserve the original plan design and later amendments.
• Change analysis: Record the proposed change, effective date, affected terms, and carrier or adviser conclusion.
• Participant notices: Retain the required statement regarding grandfathered status in participant materials.
• Business rationale: Document why the change was proposed and whether alternatives were considered.
• Approval evidence: Store the final decision with the plan-year records.

Administrative convenience can conflict with status preservation. A cost-sharing change may look modest on its own and still require technical review. Giving up grandfathered status may also be reasonable when the employer needs broader plan flexibility. Make that choice deliberately, support it with written analysis, and communicate the result accurately.

Use Benely to centralize plan documents, change records, participant communications, and approval evidence. Set up a record for each proposed amendment, assign the carrier or adviser review, and retain the written conclusion with the final decision. Benely should organize the workflow and audit trail, while the employer and qualified benefits advisers make the legal determination using carrier documentation.

7. Mental Health Parity and Addiction Equity Compliance

Mental health and substance use disorder benefits must be evaluated alongside medical and surgical benefits. The Mental Health Parity and Addiction Equity Act reaches financial requirements, quantitative treatment limits, nonquantitative treatment limits, prior authorization, medical-management techniques, and network access. A plan that offers behavioral health coverage on paper may still create parity concerns through its administration.

The employer should request a current parity analysis from the carrier or plan administrator and understand what it covers. A conclusory statement that the plan is compliant isn't the same as a documented comparison of processes, factors, evidentiary standards, and outcomes.

Ask for evidence, not assurances

Review the following areas:

• Financial terms: Compare deductibles, copays, coinsurance, and out-of-pocket treatment across benefit classifications.
• Utilization controls: Examine prior authorization, concurrent review, and medical-management rules.
• Network access: Assess whether employees can obtain behavioral health appointments through the listed network.
• Appeals: Review denial notices and escalation procedures for parity-sensitive issues.
• Documentation: Preserve the written analysis, supporting data, carrier responses, and corrective actions.

The Department of Labor's mental health parity resources can help employers frame questions for their plan administrator. For a plain-language explanation of the concept, consult Benely's mental health parity guide.

Evidence beats a checkbox: Keep the analysis that shows how the plan applies its rules, not just the certificate that says the review occurred.

Employers own governance, employee escalation, and vendor oversight. Carriers and administrators typically perform the detailed claims and utilization analysis. Assign an owner to review the analysis, record open issues, and confirm that changes reach plan documents, systems, provider instructions, and employee communications.

8. Cost Transparency and Data Security

Transparency in Coverage and HIPAA create two different control problems. Transparency rules concern access to pricing and cost information, while HIPAA concerns the privacy and security of protected health information handled in benefits administration. Employers need both controls, even when carriers and vendors perform much of the technical work.

Ask carriers how their plans provide required public machine-readable files and participant-facing cost-estimate tools. Confirm that employees can find the tools, understand what they show, and obtain help when an estimate doesn't match a bill. The CMS Transparency in Coverage guidance provides federal background for employer plan oversight.

Protect the records behind the workflow

Your benefits process may contain enrollment data, dependent information, claims-related communications, and other sensitive records. Review Business Associate Agreements where applicable, access permissions, incident response plans, vendor security documentation, and employee training. HHS HIPAA Security Rule guidance is the appropriate starting point for understanding administrative, physical, and technical safeguards.

Use a control list that includes:

• Carrier verification: Request confirmation that required transparency tools and files are operating.
• Employee education: Explain where to find estimates and what limitations apply.
• Role-based access: Limit sensitive benefits information to people who need it.
• Vendor contracts: Maintain current agreements with service providers handling protected information.
• Risk review: Conduct periodic security assessments and record remediation.
• Incident response: Keep a documented process for suspected breaches and vendor incidents.
• Audit evidence: Store certifications, policies, training records, access reviews, and correction logs.

A benefits platform can centralize records, but centralization raises the importance of permissions and vendor due diligence. Review the hosting environment and security responsibilities with your technology and legal advisers. For an SMB-focused hosting option, see Cloudvara HIPAA hosting for SMBs.

The operational test is simple: can your team produce the right pricing, plan, privacy, and security evidence without exposing information to people who shouldn't see it?

8-Point ACA Compliance Comparison

Item	Implementation Complexity 🔄	Resource Requirements ⚡	Expected Outcomes 📊	Ideal Use Cases 💡	Key Advantages ⭐
Employer Shared Responsibility Payment (ESRP) Calculations and Reporting	🔄🔄🔄🔄, complex affordability math, FTE tracking, IRS filing	⚡⚡⚡, payroll/benefits integration, benefits expertise, annual updates	📊, accurate penalty exposure analysis; avoids large IRS fines	Employers with 50+ FTEs/ALEs needing ACA compliance	⭐, penalty avoidance, audit defense, benefits optimization
Health Insurance Marketplace Reporting (Forms 1095-B/1094-B)	🔄🔄🔄, carrier reconciliation and month-by-month tracking	⚡⚡⚟, multiple carrier feeds, reconciliation resources	📊, accurate participant coverage records; fewer IRS corrections	Insurers and self‑insured employers coordinating multiple plans	⭐, supports tax filings, reduces administrative burden
Affordable Care Act Notice & Disclosure Requirements	🔄🔄🔄, many notice types, timing, multilingual demands	⚡⚡, templating, multi-channel delivery, acknowledgment tracking	📊, demonstrable distribution records; fewer violations/claims	Employers with frequent hires or annual enrollment events	⭐, audit-ready documentation, improved employee awareness
Preventive Services Coverage Verification & Implementation	🔄🔄, annual verification and guideline monitoring	⚡⚟, carrier coordination, guideline tracking, communications	📊, higher preventive utilization; legal compliance with ACA §2713	Employers focused on wellness and preventive-care programs	⭐, improved employee health, potential long‑term cost savings
COBRA Administration & Compliance Management	🔄🔄🔄🔄, strict timelines, qualifying‑event tracking, elections	⚡⚡⚡, notice automation, premium collection, payroll integration	📊, reduced litigation risk; consistent premium reconciliation	Employers with 20+ employees and notable turnover	⭐, compliance automation, revenue recovery, reduced penalties
Grandfathered Health Plan Compliance & Monitoring	🔄🔄, documentation and change‑impact analysis	⚡⚟, historical plan records, annual certification from carriers	📊, preserved exemptions; prevents unintended mandate costs	Employers maintaining legacy plans originating pre‑3/23/2010	⭐, plan design flexibility, potential cost savings
Mental Health Parity & Addiction Equity (MHPAE) Compliance	🔄🔄🔄🔄, detailed parity analyses across benefit dimensions	⚡⚡⚡, comparative benefit analytics, network adequacy reviews	📊, improved access/utilization; reduced parity exposure	Employers offering behavioral health alongside medical plans	⭐, legal protection, enhanced behavioral health access
Cost Transparency & Data Security (Transparency in Coverage + HIPAA)	🔄🔄🔄🔄🔄, combines pricing disclosure rules with HIPAA obligations	⚡⚡⚡⚡, pricing tools, security infra, BAAs, ongoing audits/training	📊, empowered members, fewer surprise bills, protected PHI	Large employers prioritizing cost control and PHI security	⭐, negotiation leverage, employee cost awareness, centralized HIPAA compliance

Turn the Checklist Into a Year-Round Control System

An ACA compliance checklist works only when it becomes a control system. The practical difference is ownership. A list tells someone what to remember. A control system records who acted, which source data was used, what changed, and how the employer confirmed the result.

Start with three remediation tracks.

Correct urgent issues

First, identify errors that could affect eligibility, affordability, coverage, notices, or reporting. Prioritize employees who may have been excluded from an offer, charged the wrong contribution, enrolled on the wrong effective date, or omitted from a filing. Compare payroll records, workforce data, carrier enrollment, plan documents, and communication logs. Do not overwrite history. Preserve the original record and identify the correction.

For ALE employers, penalty exposure can be substantial. The 2026 IRS-adjusted shared-responsibility amounts are $3,340 per full-time employee, minus the first 30 employees, when an ALE fails to offer minimum essential coverage to at least 95% of full-time employees, and $5,010 per full-time employee receiving subsidized exchange coverage when the offer is unaffordable or fails minimum value, according to this 2026 penalty summary from Thomson Reuters. Reporting failures can also reach $60 per incorrect return in certain late-filing scenarios, and larger employers can face annual caps exceeding $3 million, as detailed by BDO's ACA filing and penalty analysis.

Document the correction

For every issue, record the affected employee population, discovery date, source of the error, carrier or vendor contact, correction requested, employee communication, and filing status. Include the person who approved the resolution. If a carrier corrected enrollment but payroll deductions remain wrong, keep the issue open until both records match.

Reporting deadlines require calendar ownership. The IRS states that ALE members must file Forms 1094-C and 1095-C by February 28 for paper filing or March 31 for electronic filing in the year after the covered calendar year, as explained in the IRS information-reporting instructions. Employee distribution timing also needs its own check. One employer checklist identifies March 1 as the employee distribution due date for Form 1095-C, so verify the current rule, applicable extensions, and state requirements before scheduling delivery, using the Lift HCM ACA employer checklist.

Schedule recurring reviews

Monthly reviews should cover hours, status changes, new eligibility events, coverage offers, payroll deductions, and carrier enrollment exceptions. Quarterly reviews should test affordability, plan changes, vendor performance, data-feed accuracy, and open remediation items. Annual reviews should cover ALE measurement, plan design, preventive services, parity documentation, notices, state rules, reporting, and security evidence.

State review deserves a named owner. Employers operating across jurisdictions may face additional notices, filings, or employee-distribution rules beyond federal requirements. Check current guidance from the applicable state tax, insurance, labor, or health authority rather than assuming the federal process is sufficient.

Benely can be evaluated when payroll, benefits, enrollment, notices, and compliance records are scattered across spreadsheets and vendor portals. It may help centralize workflows and create a clearer audit trail, but employers should still confirm the division of responsibilities, service scope, data retention, filing approvals, and escalation process in writing.

Use the IRS, DOL, HHS, CMS, carrier materials, state authorities, and qualified benefits or legal advisers to confirm current requirements. Treat this checklist as an operating framework, then tailor it to your workforce, plan funding, measurement method, renewal date, and states of operation.

---

Benely can connect benefits administration, payroll workflows, enrollment records, notices, and ACA reporting support in one centralized process for small and mid-sized employers. Review your current gaps and visit Benely to evaluate whether its platform and HR specialists fit your year-round compliance workflow.