Employee Benefits
HR & Compliance
Technology
Wellness
PEO Solutions
A founder with 38 employees can make a sensible decision to offer health insurance and still discover months later that the policy was only the beginning. She may need to distribute plan documents, explain enrollment rights, protect health information, track employee classifications, and coordinate required notices before open enrollment. Buying coverage answers one question, but it doesn't answer every question created by sponsoring a group health plan.
That distinction matters as a company grows. The most useful way to understand group health plan requirements is to track the thresholds that change the employer's responsibilities: two employees, 20 employees, and 50 full-time employees, including full-time equivalents. The rules don't all switch on at the same point, and “we aren't required to offer coverage” doesn't mean “we have no benefits compliance obligations.”
Table of Contents
- Why Offering a Plan Is Only Half the Battle
- The Federal Rules That Govern Group Health Plans
- ACA Employer Mandate and 1094/1095-C Reporting
- ERISA, HIPAA, and COBRA Administration Basics
- Plan Design Rules Employers Cannot Skip
- What Changed for Group Health Plans in 2026
- Compliance Checklist and Next Steps for SMBs
- Staying Ahead of Group Health Plan Compliance
Why Offering a Plan Is Only Half the Battle
A company can choose a carrier, compare premiums, review networks, set an employee contribution, and sign the contract, then fail its compliance review because no one can locate the Summary Plan Description, Summary of Benefits and Coverage, privacy notices, or enrollment records. The broker may help select the coverage. The employer remains responsible for administering and communicating the benefit.
Separate the work into two tracks. The first is the offer decision: whether coverage must be offered, which plan fits the workforce, and how employees enroll. The second is plan administration: disclosures, eligibility records, special enrollment, privacy safeguards, claims support, and proof that the employer followed its own plan terms.
Practical rule: Keep the insurance policy, plan document, employee notices, payroll records, and eligibility data in one compliance file. A carrier contract does not complete that file.
The threshold for offering coverage is not the threshold for following plan rules. ERISA Part 7 requirements generally apply to group health plans with two or more current employees, while the ACA employer shared-responsibility penalty rule does not apply to employers with 50 or fewer employees. The DOL health benefits compliance guide explains this distinction for companies that mistake “no mandate” for “no obligations.”
The thresholds create a moving target
At two employees, group health plan requirements can attach even when the employer has no ACA offer obligation. That is the point to establish document delivery, eligibility tracking, and enrollment procedures.
At 20 employees, COBRA becomes a major administrative concern for employers that meet its employee-count test. Build a reliable process for continuation coverage before a termination or reduction in hours creates a deadline.
At 50 or more full-time employees, including full-time equivalents, the company enters the ACA applicable large employer framework and must manage coverage offers and reporting. Employee measurement should begin before the threshold is crossed, not after.
Use this guide to offering employee benefits to organize the initial work, then assign owners for eligibility measurement, document delivery, privacy, continuation coverage, and annual reporting. Review those assignments before enrollment begins. A missed notice or incomplete employee record exposes a process failure, even when the underlying insurance plan is sound.
The Federal Rules That Govern Group Health Plans
A company can avoid the ACA employer mandate and still violate group health plan rules. Employee count determines which framework applies, but it does not answer every compliance question. ERISA governs plan administration and disclosures. HIPAA covers protected health information, portability, and special enrollment. COBRA addresses continuation coverage for employers that meet its size test. The ACA adds market reforms and employer shared-responsibility requirements.
Use the 2, 20, and 50 framework
At two or more current employees, ERISA Part 7 requirements generally apply to the group health plan. Those requirements can affect dependent coverage, preventive services, plan disclosures, special enrollment, and other design or administration duties. The ACA employer penalty framework still does not apply to employers with 50 or fewer employees. Use the DOL compliance guidance discussed earlier to separate these obligations from the employer mandate.
At 20 employees, COBRA generally applies to private-sector group health plans maintained by employers with at least 20 employees on more than half of their typical business days in the previous calendar year. That threshold triggers continuation coverage administration. Confirm the count, prepare election notices, and assign responsibility before a termination or reduction in hours creates a deadline. The Department of Labor's COBRA guidance remains the practical reference for determining whether the rule applies.
At 50 or more full-time employees, including full-time equivalents, the employer becomes an applicable large employer for ACA purposes. The company must evaluate whether it offered affordable, minimum-value coverage to at least 95% of full-time employees and their dependent children up to age 26, then complete the related reporting process. The IRS employer guidance covered in the next section explains those reporting duties.
Federal floors aren't the entire answer
ERISA fiduciary and disclosure duties can apply broadly to employer-sponsored plans. Other federal rules shape plan design, including mental health parity, dependent coverage, preventive care, and women's health protections. State requirements may add obligations involving paid family leave, fertility benefits, and automatic retirement arrangements.
Headcount is only the first screen. Confirm which statute applies, whether the plan is fully insured or self-funded, whether it is grandfathered, and which states govern the employer and enrolled employees. For a practical explanation of plan documents and administrative responsibilities, review Benely's ERISA guide.
ACA Employer Mandate and 1094/1095-C Reporting
A company can offer health coverage and still fail its ACA obligations. The first question is whether it reaches applicable large employer status. Count full-time employees and full-time equivalents under the applicable rules. Part-time hours can combine into FTEs, so a payroll headcount alone is not enough.
At 50 or more full-time employees, including full-time equivalents, the employer must evaluate whether it offered affordable, minimum-value coverage to at least 95% of full-time employees and their dependent children up to age 26. Failing that test can create an assessable payment. The IRS employer guidance explains the related reporting duties, employee statements, and annual information return.
ACA Employer Mandate Thresholds at a Glance
| Threshold or Test | 2026 Figure | What It Means |
|---|---|---|
| Applicable large employer threshold | 50 or more full-time employees, including full-time equivalents | The employer must evaluate the ACA employer shared-responsibility rules and reporting obligations. |
| Coverage offer standard | At least 95% | Coverage must be offered to at least 95% of full-time employees and their dependent children up to age 26. |
| Minimum-value test | Must satisfy the applicable minimum-value standard | A plan can be offered and still create exposure if it doesn't provide minimum value. |
Affordability requires its own review. Use current payroll and employee-premium data, then apply the relevant ACA affordability safe harbor and minimum-value rules. A year-old spreadsheet cannot support this analysis. The Cigna employer mandate explanation also explains why employers must aggregate part-time hours into FTEs before testing affordability and minimum value.
Reporting requires monthly discipline
Form 1094-C is the transmittal, while Form 1095-C reports employee-level information. Maintain monthly records identifying who was full-time, whether an offer was made, which coverage applied, and which offer-of-coverage code belongs on each form.
Year-end reconstruction is a weak process. Payroll classifications, HR records, and enrollment files rarely match without regular reconciliation. Reconcile them each month, document measurement-period decisions, and assign a reviewer to check coding before filing. Keep evidence supporting every reported status.
For a practical workflow, use Benely's ACA reporting requirements guide to organize data collection, review, and filing responsibilities. The guide can structure the process, but the employer remains responsible for accurate employee data and timely reporting.
ERISA, HIPAA, and COBRA Administration Basics
A company can avoid the ACA employer mandate and still face administrative duties once it offers a group health plan. At around 20 employees, COBRA becomes a threshold issue. At every size, ERISA and HIPAA can govern the plan's documents, participant communications, and health information.
ERISA requires a written plan document for covered plans and a Summary Plan Description that participants can understand. Distribute the SPD to newly eligible participants within 90 days. Written requests for plan information can also trigger a 30-day response period. Keep the current SPD, amendments, distribution records, and delivery evidence together. A growing employer should assign one owner to maintain these files rather than rely on a carrier's standard packet.
Protect information, not just paperwork
HIPAA privacy and security obligations apply to protected health information. That includes more than medical records held by a carrier. HR may handle enrollment files, eligibility changes, claims questions, and dependent information, while vendors may process health data for the employer.
List every vendor that touches claims or health information. Put Business Associate Agreements in place where required, restrict system access by job function, document privacy procedures, and maintain a security risk process suited to the plan's operations. Payroll access does not justify broad access to health data.
COBRA generally applies when a private-sector employer maintains a group health plan and has at least 20 employees on more than half of its typical business days in the previous calendar year. The DOL COBRA employer guide outlines the rule. Administration requires the employer to identify qualifying events, issue notices, track elections, and coordinate accurately with the carrier or COBRA administrator.
The election window lasts 60 days. Do not assume the carrier knows when an employee loses eligibility. HR must transmit the event promptly, preserve the record, and confirm that the correct notice was sent. Set a clear handoff between payroll, HR, and the plan administrator before the first qualifying event occurs.
The video below provides a visual overview of these administrative responsibilities.
Plan Design Rules Employers Cannot Skip
Plan design has a federal floor. Employers can choose richer networks, different deductibles, voluntary contributions, and a range of funding arrangements, but they can't remove required protections to make the premium look lower.
For non-grandfathered plans in the individual and small-group markets, the essential health benefits package establishes a defined baseline across categories such as hospitalization, prescription drugs, maternity and newborn care, preventive services, and behavioral health. The CMS essential health benefits checklist also connects the benefit package with parity-style protections for mental health and substance use disorder benefits.
Compare the benefit floor with cost-saving choices
| Requirement | What It Means |
|---|---|
| Essential health benefits | Applicable non-grandfathered individual and small-group coverage must cover the essential health benefits package across defined benefit categories. |
| Preventive care | Non-grandfathered group health plans and group health insurance coverage must cover specified preventive services without cost sharing, subject to applicable federal guidance. |
| Mental health parity | Mental health and substance use disorder benefits must follow parity protections that prevent more restrictive treatment of those benefits than comparable medical and surgical benefits. |
| Dependent coverage | Plans subject to the ACA dependent-coverage rule must allow eligible dependents to remain covered until age 26. |
| Women's health protections | Employers must account for applicable protections involving maternity care, contraceptive coverage, and lactation support. |
The Department of Labor's ACA implementation FAQs state the preventive-care cost-sharing rule directly. In practice, confirm whether the service is covered, whether the provider is in network, and whether the plan document and Summary of Benefits and Coverage describe the rule accurately.
Don't treat fully insured and self-funded plans as interchangeable. The funding method can change who administers claims and which rules apply, but it doesn't give an employer permission to strip out required protections. Have counsel and the carrier review any design change before it reaches employees.
What Changed for Group Health Plans in 2026
For calendar-year plans in 2026, employers should review preventive-care administration before open enrollment. Updated coverage items include patient navigation for breast and cervical cancer screening, expanded breast-cancer imaging coverage, and vaccine coverage involving RSV, pneumococcal, and influenza. The Spencer Fane 2026 preventive-care update outlines these changes and explains why administrators should verify carrier materials.
Request written confirmation from the carrier or third-party administrator. Compare it with the plan document and SBC, then correct employee communications before enrollment opens. A familiar plan name does not make last year's benefits guide reliable.
Review the disclosure and HSA calendar
The gag-clause prohibition compliance attestation is scheduled to be due by December 31, 2026, under current guidance. It applies to group health plans without an employee-count threshold and reaches fully insured, self-insured, grandfathered, church, and governmental plans. Assign responsibility among the employer, carrier, TPA, and broker, and retain submission confirmation.
Telehealth and HSA-compatible high-deductible health plan rules also changed. First-dollar telehealth can be paired with an HDHP for plan years beginning in 2025. Direct primary care received additional HSA flexibility beginning January 1, 2026, according to the same Spencer Fane update noted above. Review the plan's telehealth arrangement and direct-primary-care features before communicating that the plan is HSA-compatible.
Review affordability materials, participant disclosures, and plan amendments at the same time. Keep the signed amendment, carrier confirmation, employee notice, and updated SBC in one controlled record. That file should show what changed, who confirmed it, and when employees received the information. Small employers should use the same discipline as larger companies, even when no employee-count threshold applies to the requirement.
Compliance Checklist and Next Steps for SMBs
Headcount should determine the first version of your checklist, not the last. A company below the ACA applicable large employer threshold still needs a controlled process for plan documents, privacy, enrollment, and plan design.
Under 20 employees
- Distribute core documents: Maintain the written plan document, SPD, SBC, and applicable privacy and special enrollment notices.
- Document payroll treatment: Confirm Section 125 cafeteria plan documents and enrollment procedures align with the payroll system.
- Review plan design: Verify preventive services, dependent coverage, and mental health and substance use disorder protections.
- Track changes: Save amendments and carrier notices instead of relying on informal email explanations.
20 to 49 employees
- Prepare for COBRA: Confirm whether the employer meets the COBRA employee-count test and identify who sends qualifying-event notices.
- Test the workflow: Check that HR reports loss of eligibility promptly and that the administrator can track notices and elections.
- Protect health data: Review HIPAA privacy procedures, vendor contracts, Business Associate Agreements, and security risk practices.
- Watch growth: Recalculate headcount as staffing changes instead of waiting for the next renewal.
50 or more employees
- Determine ALE status: Count full-time employees and full-time equivalents using a documented method.
- Manage the 95% offer test: Track offers to full-time employees and dependent children up to age 26.
- Prepare ACA reporting: Reconcile monthly records for Forms 1094-C and 1095-C, then monitor the January 31 employee-statement deadline and applicable filing deadlines.
- Test affordability and value: Review the plan against the applicable affordability and minimum-value standards.
Use a named internal owner, not “HR” as an unnamed department. If document collection, notice tracking, or audit preparation is consuming staff time, legal assistants can help organize records and support counsel-led compliance work.
Staying Ahead of Group Health Plan Compliance
Compliance works better as an operating rhythm than as an annual emergency. The employers that stay audit-ready usually build three recurring touchpoints into the calendar: Q1 ACA filing, a mid-year plan and document review, and Q4 open enrollment preparation.
Build the year around evidence
In Q1, reconcile employee classifications, offers of coverage, and ACA reporting records. The objective isn't merely to submit forms. It's to preserve the source data that explains why each employee received a particular treatment.
Mid-year, review plan amendments, eligibility rules, vendor responsibilities, and the SPD. A carrier change, payroll integration issue, acquisition, or new employee class can make an old document inaccurate even when the plan's name hasn't changed.
In Q4, prepare open enrollment materials, confirm SBC distribution, review preventive-care updates, and complete applicable nondiscrimination testing. Ask the broker and TPA for written deliverables and service-level commitments. If a vendor owns a notice, the employer still needs evidence that the notice was sent.
Spreadsheet sprawl is a process problem, not a staffing strategy.
Centralized benefits technology can connect the SPD, SBC, enrollment records, ACA forms, and COBRA election tracking. That setup reduces duplicate entry and gives the compliance owner one place to review missing documents, unresolved eligibility changes, and upcoming deadlines. Benely can support benefits administration through a centralized employee platform, enrollment workflows, payroll connectivity, compliance tools, and access to HR specialists.
Don't wait for a carrier, state regulator, or DOL inquiry to reveal a missing disclosure. Book a 2026 compliance review now, test every threshold that applies to your workforce, and fix gaps before open enrollment turns them into employee-facing problems.
Benely helps employers compare group health plans, manage enrollment, connect benefits workflows with payroll, and organize compliance tasks around the requirements covered here. Visit Benely to schedule a benefits and compliance review before your next enrollment cycle.
