San Francisco Health Care Security Ordinance: 2026 Guide

You may be dealing with this right now. You offer a health plan, your broker set it up years ago, payroll runs on time, and then someone asks whether you're compliant with the San Francisco Health Care Security Ordinance. Your first reaction is usually reasonable: “We already provide insurance, so we should be fine.”

That assumption is where many employers get into trouble.

The San Francisco Health Care Security Ordinance isn't merely about whether you offer coverage. It hinges on whether you made the mandated health care contributions for each covered employee, tracked the right hours, handled any shortfall correctly, and filed the required paperwork on time. If you miss the spending calculations, the year-end remedial payment is often the issue that exposes the gap.

Table of Contents

• What Is the HCSO and Why It Matters to SF Businesses
  • Why the law exists
  • Why owners and HR teams misread it
• Determining If Your Business and Employees Are Covered
  • Employee-level coverage rules that affect spending
  • Where employers usually make the wrong call
  • A practical audit process
• Understanding Your Core HCSO Obligations
  • Spending mandate versus coverage mandate
  • What the top-off payment actually measures
  • Where careful employers get tripped up
  • What a workable compliance approach looks like
• Calculating and Meeting Required Health Expenditures
  • The 2026 expenditure rates
  • How to calculate the required amount
  • A practical example
  • Ways employers satisfy the spending requirement
  • What works operationally
• Navigating HCSO Compliance and Reporting Deadlines
  • The annual reporting rule
  • Records you need to keep
  • Deadline mistakes that create avoidable exposure
  • A practical way to stay on schedule
• Your Step-by-Step HCSO Compliance Checklist
  • Step 1 through Step 3
  • Step 4 through Step 6
  • A simple internal control setup
  • What a good checklist prevents
• How Benely Simplifies HCSO Compliance and Benefits
  • Where employers usually get stuck
  • Why integrated administration matters for HCSO
  • What to look for in a partner

What Is the HCSO and Why It Matters to SF Businesses

A lot of employers first hear about the ordinance after opening an office in San Francisco, hiring a remote employee who works in the city, or getting a year-end compliance question from finance. At that point, the law can sound like one more local benefits rule layered on top of everything else.

It's more important than that. The San Francisco Health Care Security Ordinance was enacted effective January 9, 2008, and it requires covered employers to make minimum health care expenditures for non-exempt employees working within the city and county, according to this University of California eScholarship paper on the HCSO and Healthy San Francisco. The same source explains that the ordinance established two central elements: Healthy San Francisco and a mandatory employer spending requirement.

Why the law exists

This ordinance wasn't built as a symbolic rule. San Francisco designed it to make sure workers in the city have health care funding support, even when they aren't covered through a traditional employer medical plan in the way many owners assume.

That matters because the law changes how you think about benefits compliance. Under many benefit rules, the first question is whether you offered a plan. Under the HCSO, the more practical question is whether your business spent enough, for the right people, during the right period, using a qualifying method.

Practical rule: If you're treating HCSO as a simple insurance-offer question, you're starting from the wrong framework.

Why owners and HR teams misread it

The confusion usually comes from everyday language. People hear “health care ordinance” and translate it to “health insurance requirement.” That shortcut causes payroll teams to undercount hours, HR teams to assume premiums automatically satisfy the law, and finance teams to overlook year-end reconciliation.

A better way to think about it is this:

Common assumption	What the HCSO actually asks
Do we offer health insurance?	Did we make the required health care expenditure?
Are enrolled employees covered?	Are covered employees receiving enough qualifying spend?
Is payroll done?	Are payable hours tracked correctly and documented?

If you operate in San Francisco, this ordinance belongs on the same compliance checklist as wage-and-hour rules, paid leave administration, and annual reporting. It affects budgeting, payroll setup, benefits design, and audit readiness.

Determining If Your Business and Employees Are Covered

A common failure point looks like this: an employer offers a medical plan, assumes that settles the issue, and only learns later that the HCSO applied to more people, more hours, and more payroll categories than the benefits team tracked. Coverage starts with scope. If you get the scope wrong, the top-off calculation later will be wrong too.

Start with the employer test. The HCSO applies to for-profit employers with 20 or more employees worldwide and nonprofits with 50 or more employees worldwide, and a covered employee is one who works at least 8 hours per week in San Francisco, has been employed for more than 90 days, and triggers spending based on payable hours, according to Keenan's HCSO compliance briefing.

The worldwide headcount point causes real problems. A business can have a small San Francisco team and still fall under the ordinance because the threshold is measured across the full organization, not the local office.

Once the company is covered, the employee review gets more technical. HCSO status does not turn on whether someone is full-time, benefits-eligible, or enrolled in your plan. It turns on where they work, how long they have been employed, and how many payable hours you must count.

Employee-level coverage rules that affect spending

For a worker to be covered, the practical questions are straightforward:

• Do they work enough time in San Francisco to meet the weekly threshold?
• Have they passed the 90-day employment mark?
• Are you tracking payable hours, not just hours worked?

That last point matters more than many employers expect. Payable hours can include paid sick leave, vacation, and PTO, subject to the ordinance cap. If payroll only counts scheduled or clocked hours, the business can understate required spending and miss a top-off obligation even when it contributes toward health insurance.

Where employers usually make the wrong call

The mistakes are usually operational, not legal.

• Counting only San Francisco headcount for employer coverage. The ordinance looks to worldwide employee count.
• Excluding part-time employees too early. Part-time status does not remove someone from HCSO review if they work enough hours in San Francisco and meet the tenure rule.
• Using benefits eligibility as a shortcut. Someone can be outside your regular medical plan rules and still be a covered employee for HCSO purposes.
• Missing payable-hour categories in payroll. That creates the same downstream problem every time. The required spend is understated, and the year-end reconciliation exposes the gap.

This is the point many owners miss: determining who is covered is not separate from the spending analysis. It sets up the top-off analysis. If a covered employee's payable hours are understated, the required expenditure will be understated. If the employee is left off the covered list entirely, no top-off review happens at all.

A practical audit process

Use a repeatable review that HR, payroll, and finance can all follow:

1. Confirm total employee count worldwide and apply the correct employer threshold.
2. Pull a list of employees performing work in San Francisco, including part-time and temporary staff on payroll.
3. Check average weekly time worked in San Francisco against the ordinance standard.
4. Review hire dates to identify who has passed the 90-day mark.
5. Test payroll coding for payable hours, including paid leave buckets that affect HCSO spending.
6. Flag covered employees for quarter-by-quarter expenditure review, especially if employer premium contributions vary by class or waiting period.

If your team needs broader background on how traditional plan eligibility works, this guide to employer-sponsored health coverage can help. Keep the distinction clear. Regular health plan eligibility rules and HCSO covered-employee status are related, but they are not the same compliance test.

Understanding Your Core HCSO Obligations

A common audit scenario goes like this. The company offers a solid medical plan, pays a meaningful share of the premium, and assumes the HCSO is covered. Then the year-end review shows certain San Francisco employees were still below the required spend. The plan offer was real. Compliance still failed.

That happens because the HCSO is a health spending rule. It is not a simple requirement to offer coverage.

Spending mandate versus coverage mandate

A coverage mandate focuses on access to a plan or enrollment in a plan. The HCSO focuses on employer dollars spent for each covered employee. That difference drives the entire compliance process, especially if you use different contribution levels by class, waiting period, or work schedule.

As explained in Word & Brown's discussion of HCSO top-off obligations, the ordinance requires employers to meet a minimum health care expenditure. If the value of the employer contribution through the medical plan does not reach that amount, the employer may need to direct the shortfall to another permitted vehicle, such as an HSA or the SF City Option.

For employers that already sponsor group health insurance plans, this is the mistake that causes trouble. The existence of a plan does not answer the HCSO question. The real test is whether the employer funded enough for that specific covered employee during the applicable period.

What the top-off payment actually measures

The top-off is the gap between what the ordinance required you to spend and what you spent.

That sounds simple, but the calculation gets missed because employers often review benefits at the plan level and the HCSO works at the employee level. An employee can be enrolled all year and still have a shortfall. Another employee can waive the plan and still require HCSO spending through another permitted method. If your medical contribution falls below the required expenditure floor, you owe the difference.

This is why I tell employers to stop using enrollment as the proxy for compliance. Enrollment status helps determine where money went. It does not prove the amount was enough.

Where careful employers get tripped up

The problem usually is not a total lack of benefits. The problem is a mismatch between a standard benefits strategy and the HCSO math.

Common trouble spots include:

• Flat employer premium contributions that do not keep pace with payable hours for higher-hour covered employees
• Midyear eligibility changes that create partial-quarter gaps
• Paid leave periods that increase payable hours without increasing employer medical contributions at the same rate
• Waivers or lower-cost plan elections that leave less employer spend than expected
• Year-end true-ups that happen too late for orderly corrections

A health reimbursement arrangement can help in the right setup, but it has to be structured and administered correctly to count. Employers considering that route should review these health reimbursement arrangement rules before relying on an HRA for HCSO purposes.

What a workable compliance approach looks like

Start with the spending obligation, then test whether your existing benefits funding satisfies it. Do not start with the assumption that your medical plan contribution solves everything.

A practical process usually includes:

• Employee-level tracking of employer health spend, not just plan eligibility
• Quarterly comparisons between required expenditures and actual contributions
• A documented top-off review for anyone whose medical contribution may fall short
• Coordination across payroll, HR, and finance so payable hours and benefit funding are measured the same way

The same source notes that any shortfall generally must be corrected by the end of February following the shortfall year. Employers that wait until annual reporting season often find problems after the correction window has become more expensive and harder to manage.

The HCSO asks a narrow question with expensive consequences. Did the employer spend enough for each covered employee? Keep the answer tied to dollars, hours, and employee-level records, and the ordinance becomes much easier to handle.

Calculating and Meeting Required Health Expenditures

A common mistake plays out the same way every year. An employer offers health coverage, assumes that means the HCSO is handled, and later learns the ordinance was asking a different question: did the business spend enough, for each covered employee, based on payable hours?

That distinction matters. The HCSO is more than a coverage mandate. It is a health care spending mandate, and the gap between those two concepts is where top-off liabilities usually show up.

The 2026 expenditure rates

For 2026, the HCSO requires mid-sized employers with 20 to 99 workers to contribute $2.74 per hour and large employers with 100+ workers to contribute $4.11 per hour, calculated up to 172 hours per month per employee, including paid leave, according to Gusto's 2026 Healthy San Francisco and HCSO rate summary.

Employer size	2026 required expenditure
Mid-sized employers (20 to 99 workers)	$2.74 per hour
Large employers (100+ workers)	$4.11 per hour

How to calculate the required amount

Use the calculation in this order:

1. Confirm the employee is covered for the period.
2. Count payable hours, including paid sick leave, vacation, and other PTO that counts under the ordinance.
3. Apply your employer-size rate.
4. Measure actual qualifying health care spending for that employee.
5. Calculate any top-off amount if your spend falls short.

The formula is straightforward:

Payable hours x required hourly rate = minimum expenditure obligation

The top-off step is what employers miss. An employee can be enrolled in your medical plan and still generate a shortfall if your employer contribution for that employee does not reach the required HCSO amount.

A practical example

Take a covered employee at a mid-sized employer who has enough payable hours in the month to create a required expenditure of more than the employer contributed toward that employee's benefits. The difference is the top-off payment. That amount has to be funded through a qualifying method. The same analysis applies to a large employer, just at the higher hourly rate.

This is why I tell employers to stop asking only whether they offer coverage. Ask whether each covered employee received enough qualifying employer spend.

The math is easy. The risk sits in the comparison between required spend and actual employee-level spend.

Ways employers satisfy the spending requirement

The HCSO gives employers several ways to meet the obligation, but each option works only if the dollars count and the amount is high enough:

• Employer premium contributions through qualifying medical coverage
• Reimbursement-based arrangements that are set up and administered correctly
• SF City Option contributions to close a shortfall

For reimbursement strategies, the design details matter. Employers considering that route should review these health reimbursement arrangement rules before assuming the arrangement will count under the ordinance. Employers also comparing broader funding approaches can review group health insurance plans as part of that decision.

What works operationally

The employers that handle this well build the top-off review into payroll and benefits administration, instead of treating it like a year-end cleanup.

Operational habit	Why it helps
Payroll tracks payable hours, not just hours worked	Required spend is calculated correctly
HR or finance reviews health spend by employee	Shortfalls are identified before they grow
Benefits funding is tested against HCSO rates each quarter	Premium contributions are validated, not assumed
A top-off process is documented	Corrections can be made consistently and supported in records

A disciplined process prevents the expensive version of this problem, where the company offered coverage, spent real money, and still owes more because the employee-level numbers did not meet the HCSO formula.

Navigating HCSO Compliance and Reporting Deadlines

A common failure point looks like this. The company offered health benefits all year, payroll shows real employer spend, and leadership assumes HCSO is covered. Then April arrives, the Annual Reporting Form is late, or the support behind the employee-by-employee spend calculation is incomplete, and the business is exposed anyway.

That happens because the HCSO is not just a coverage issue. It is a spending and documentation rule. If your top-off payment math was off, or you cannot prove how you got there, filing season is where that problem surfaces.

The annual reporting rule

Employers covered by the HCSO must file the Annual Reporting Form (ARF) with the Office of Labor Standards Enforcement by April 30, and a missed filing can trigger a $500 per quarter penalty under the City and County of San Francisco HCSO materials.

Owners often miss the practical point behind that rule. The city can enforce reporting and recordkeeping failures separately from the spending requirement itself. A business can offer strong medical coverage and still have a compliance problem if the filing is late or the backup does not support the top-off calculation.

Records you need to keep

The same guidance also requires employers to retain compliance records for four years. For HCSO purposes, that means more than keeping a benefits invoice in a folder.

Keep records that let you reconstruct the full calculation for a covered employee, quarter by quarter:

• Payroll records showing payable hours used in the expenditure formula
• Benefit contribution and premium support showing what the employer spent
• Top-off payment calculations and proof of payment for any shortfall
• Employee notices, waivers, and related compliance documents if you rely on them

This is the area where the health coverage mandate versus health spending mandate distinction matters most. Coverage elections do not prove HCSO compliance by themselves. The file needs to show whether the employer met the required spend for each covered employee, and whether any shortfall was corrected on time.

Deadline mistakes that create avoidable exposure

The recurring mistakes are operational, not theoretical.

• The ARF is treated as a one-time filing task instead of the last step in a year-long recordkeeping process.
• Payroll, HR, and finance keep different versions of hours and employer spend, so no one can validate the final numbers.
• Teams assume enrolled employees automatically satisfy HCSO, without testing whether a top-off payment was still required.
• Shortfalls are discovered after year-end, when correction options are narrower and documentation is harder to pull together.

One owner on the team should know who calculates the shortfall, who approves the top-off, and who files the ARF. If those roles are fuzzy, deadlines slip and support goes missing.

For employers coordinating local filings with federal year-end tasks, this guide to ACA reporting requirements for employers helps line up the calendar. If you want a plain-language tool to pressure-test questions before you file, an AI legal assistant for business owners can help frame issues for counsel or internal review.

A practical way to stay on schedule

Treat April 30 as the end of the process, not the start. Reconcile HCSO spend during the year. Review covered employees quarterly. Keep the support for any top-off payment when it is made, not months later when someone is trying to rebuild the file from payroll exports and carrier invoices.

That approach reduces two expensive errors at once. It helps catch underfunding early, and it gives you a clean record set when the ARF is due.

Your Step-by-Step HCSO Compliance Checklist

Employers usually don't need a complicated framework. They need a repeatable checklist that can survive turnover, open enrollment changes, and quarterly payroll noise.

Use this one.

Step 1 through Step 3

1. Confirm that your organization is covered
   Start with employer status. Review worldwide headcount and entity type. If your business meets the ordinance threshold and has employees performing work in San Francisco, move to the employee review.

2. Identify covered employees each quarter
   Don't rely on benefit eligibility files alone. Review who is regularly working enough time in San Francisco and who has satisfied the tenure rule.

3. Track payable hours accurately
   Your payroll process has to capture the hours that drive the ordinance calculation. If PTO, vacation, and sick leave aren't consistently included where required, your spend test won't be reliable.

Step 4 through Step 6

4. Calculate the required expenditure and compare it to actual spend
   Many employers need more discipline in this step. Run the employee-by-employee comparison before year-end, not after.

5. Correct any shortfall using a qualifying method
   If your premium contribution doesn't clear the required spending floor, address the gap. Don't assume the plan offering itself fixes the issue.

6. File, retain, and post
   Administrative compliance matters. Keep the necessary records, submit required forms on time, and make sure workplace posting obligations aren't ignored.

A simple internal control setup

If you want this to work every year, assign the checklist across functions instead of handing it to one stressed HR generalist.

Step	Best internal owner
Coverage determination	HR and legal/compliance
Employee identification	HR and payroll
Payable-hour tracking	Payroll
Spend testing	Finance and benefits
Shortfall correction	Finance and HR
Filing and retention	HR or compliance lead

Action cue: Put HCSO on a recurring annual calendar, but manage it quarterly. That's the easiest way to catch spending issues before they turn into cleanup work.

What a good checklist prevents

A strong checklist doesn't just help you avoid penalties. It prevents the quieter problems that consume time later: re-running payroll data, rebuilding missing support, reconciling plan contributions manually, and answering avoidable employee questions after the fact.

That's the value of a documented process. It reduces compliance from a scramble to a routine.

How Benely Simplifies HCSO Compliance and Benefits

A common HCSO failure looks like this. The company offers a solid medical plan, assumes that means it is covered, and finds out later that several employees still fell short of the required health care expenditure amount. The problem was never plan design alone. It was the missing employee-by-employee top-off calculation.

That distinction matters. HCSO is not just a health coverage question. It is a health spending requirement, and the businesses that struggle with it usually have a data problem before they have a benefits problem.

Where employers usually get stuck

In practice, four tasks create the cleanup work:

• Matching payable hours to the correct employees
• Testing employer health spend at the employee level, not only at the plan level
• Calculating any top-off amount before deadlines pass
• Keeping payroll, enrollment, and finance records consistent enough to support the result

A benefits and HR system should help with those exact tasks. If it cannot, HR ends up reconciling carrier bills against payroll files by hand, and finance has to verify whether the employer contribution satisfied the ordinance for each covered employee.

Why integrated administration matters for HCSO

Disconnected systems are where mistakes start. Payroll may have the hours. HR may know who enrolled or waived. Finance may know what the company paid. But HCSO compliance depends on combining those records accurately enough to answer one specific question: did the employer spend enough for this employee, or is a top-off payment still due?

That is the part many vendors gloss over.

A practical platform should support employee-level contribution visibility, benefits enrollment tracking, payroll coordination, and day-to-day administrative support in one workflow. That makes it easier to catch shortfalls before they become year-end corrections, and it gives the business a clearer record if questions come up later.

What to look for in a partner

If you are evaluating a broker, platform, or outsourced HR team, ask questions tied to the actual ordinance:

• Can you show required spend versus actual spend by employee?
• Can the team identify likely top-off obligations before the reporting deadline?
• Will payroll hours and benefits records stay aligned without manual rework every quarter?
• Who helps resolve edge cases, such as midyear hires, waivers, or status changes?

Those are the questions that save time and reduce exposure. A polished enrollment experience is useful. It does not replace spend testing.

For employers that want fewer manual handoffs, tighter payroll and benefits coordination, and better visibility into HCSO top-off risk, Benely offers a practical operating model. The value is not just administration. It is having a system and support structure that helps the business catch HCSO spending gaps early, document the fix, and keep benefits decisions aligned with compliance requirements.

---

If your team wants a cleaner way to manage benefits, payroll coordination, and local compliance obligations like the San Francisco Health Care Security Ordinance, Benely is worth a closer look. It gives growing companies a practical way to simplify administration, reduce manual work, and build a benefits process that's easier to maintain year after year.