DOL Proposes Default Electronic Delivery Safe Harbor for ERISA Group Health Plan Disclosures

By: Christina L. Nechiporchik, Senior Counsel, Employee Benefits and Executive Compensation Group

07/31/26

On July 23, 2026, the U.S. Department of Labor’s Employee Benefits Security Administration (“EBSA”) published a proposed rule (the “Proposed Rule”) that would create a new, additional safe harbor for group health plan administrators to furnish participant and beneficiary disclosures electronically by default, using a “notice-and-access” model. If finalized, the Proposed Rule would extend to group health plans much of the framework adopted for pension benefit plans in 2020. (29 CFR § 2520.104b-31)

Background: Why a New Safe Harbor?

Group health plans have relied on the 2002 electronic disclosure safe harbor (29 CFR § 2520.104b-1(c)) (the “2002 Electronic Safe Harbor”) which permits electronic delivery only to (i) participants who are “wired at work” as an integral part of their duties or (ii) those who affirmatively consent to electronic delivery. Stakeholders have long criticized this framework as administratively burdensome because it required case-by-case determinations, tracking of consents, and re-consents when hardware or software requirements change.

In 2020, the EBSA adopted a more efficient notice-and-access model for pension benefit plans (the “2020 Safe Harbor”). Under the 2020 Safe Harbor, plan administrators may default to electronic delivery for participants who provide an electronic address, subject to a written Notice of Internet Availability (“NOIA”), mandatory paper-copy and opt-out safeguards, and specific website standards. The EBSA has now proposed to largely mirror these requirements and extend them to group health plans.

The Proposed Notice-and-Access Framework

1. Covered Individuals

A “covered individual” is a participant, beneficiary, or other person entitled to a covered document who provides (or is assigned by an employer) an electronic address (email or SMS-capable mobile number) at which he or she may receive a NOIA. A dependent child who is a beneficiary qualifies independently if he or she has attained age 18 and provides an electronic address.

2. Covered Documents

The Proposed Rule broadly defines a “covered document” as any document or information the administrator is required to furnish to participants and beneficiaries under Title I of ERISA, including SPDs, SMMs, SARs, SBCs, COBRA notices, HIPAA notices, MHPAEA disclosures, CHIPRA notices, WHCRA and NMHPA notices, claims and appeals as well as applicable No Surprises Act and transparency-in-coverage disclosures. Unlike the pension safe harbor, which applies only to mandatory disclosures, the group health rule also covers documents that must be distributed upon request only.

3. Notice of Internet Availability (“NOIA”)

For each covered document, the administrator must furnish a NOIA at the time the document is posted to the website. The NOIA must be provided separately from other documents or disclosures. It must be written for the average plan participant and must include, among other elements:

• A prominent title (e.g., “Disclosure About Your Health Plan”) and the standardized statement: “Important information about your health plan is now available. Please review this information.”;
• Identification of the covered document by name and a brief description if needed;
• A URL or hyperlink leading directly to the document (or to a login page with a prominent link);
• A statement of the free-of-charge paper-copy right and how to exercise it;
• A statement of the free-of-charge global opt-out right and how to exercise it;
• A cautionary statement that the document is not required to remain on the website for more than one year (or until superseded); and
• A contact telephone number for the plan administrator or other designated plan representative.

Alternatively, plans may furnish one combined NOIA for all documents if the NOIA contains all of the necessary information and is produced annually. Regardless of whether plans use separate or a combined NOIA, the covered documents must be available on the website no later than otherwise required under the applicable law or regulation.

4. Website Standards

The plan administrator must maintain an Internet website, participant portal, or mobile application (with reasonable access outside the workplace) that (i) posts each covered document no later than its ERISA due date, (ii) retains it for at least one year (or until superseded), (iii) presents it in a widely available format suitable for both online reading and clear printing, (iv) allows electronic search and permanent retention, and (v) protects the confidentiality of personal information.

A plan administrator may assign these website maintenance duties to a third party as long as the administrator complies with fiduciary obligations for selecting and monitoring the third party. The Proposed Rule does not change the overall document retention guidelines under ERISA, so while covered documents may only need to be maintained on the website for a year, they will still need to be retained longer elsewhere.

Importantly, with the presence of PHI in many group health plan disclosures, the EBSA expressly declined to extend the pension safe harbor’s alternative email-delivery method to group health plans.

5. Right to Paper Copies and Global Opt-Out

Any covered individual may request unlimited paper copies free of charge or globally opt out of electronic delivery. Administrators must maintain procedures that do not unduly inhibit these rights.

6. Initial Notification

Before relying on the safe harbor, the administrator must furnish an initial notification (generally on paper) that identifies the electronic address that will be used, explains how to access covered documents, and informs individuals of their paper-copy and opt-out rights. Individuals already receiving disclosures electronically under the 2002 Electronic Safe Harbor before the first day of the first calendar year following publication of the final rule may receive the initial notification electronically.

7. Invalid Addresses and Separation from Employment

The NOIA delivery system must detect invalid or inoperable addresses. Therefore, if a bounce-back occurs, the administrator must promptly either (1) attempt to correct it by obtaining a new address or (2) treat the individual as having opted out and furnish paper copies. Upon separation from employment, the administrator must take reasonable steps to either preserve the availability of an employer-assigned email address or obtain a new one.

8. Conforming Amendments to the Claims Regulation

The EBSA also proposes to allow adverse benefit determinations and appeals of such benefit determinations to be furnished electronically.

Some Uncertainty Remains

There are a few items that remain uncertain and may be further clarified in the final rule after the comment period:

• Whether the final rule will extend the safe harbor to other welfare benefit plans (e.g., disability, life insurance).
• Whether the EBSA will permit email delivery of the covered document with additional PHI safeguards.
• Whether the EBSA will address digital-divide concerns for older, rural, and lower-income participants who may lack reliable internet access.

Comparison: 2002 Electronic Safe Harbor vs. Proposed Rule

Next Steps for Employers and Plan Administrators

While the Proposed Rule is not yet final, employers and plan administrators should begin preparing now:

1. Inventory Title I disclosures currently furnished such as SPDs, SMMs, SARs, SBCs, COBRA, HIPAA, MHPAEA, CHIPRA, WHCRA, wellness, and claims/appeals notices.
2. Confirm which disclosures are delivered by the plan, by the carrier, or by a third-party administrator, and evaluate whether service agreements need to be updated to authorize reliance on the new safe harbor.
3. Assess electronic address collection and validation processes for participants and beneficiaries, including adult dependents; consider updating enrollment forms and new-hire paperwork.
4. Update the portal or benefits website to satisfy the website standards (timely posting, one-year retention, readability, format, searchability, retention, confidentiality).
5. Draft or update a written electronic disclosure policy and standardized NOIA and initial notification templates.
6. Establish or refresh bounce-back monitoring and paper-copy / opt-out procedures.
7. Monitor for the final rule; the safe harbor is currently scheduled to become applicable the first day of the first calendar year following publication of the final rule.

For additional guidance on compliance with the Proposed Rule, or any other legal issue involving the administration of your benefit plans, please contact the author, Christina Nechiporchik (734-930-2495  |  cnechiporchik@bodmanlaw.com) or any member of Bodman’s Employee Benefits and Executive Compensation Group. Bodman cannot respond to your questions or receive information from you without establishing an attorney/client relationship and clearing potential conflicts with other clients. Thank you for your patience and understanding.