August 2026 Regulatory & Legislative Update

This regulatory and legislative update covers issues involving 2027 affordability standards, HIPAA, health plan communication, and more.

2027 Affordability Standards

In Revenue Procedure 2026-26, the Internal Revenue Service released certain affordability standards for 2027 as they apply to the Affordable Care Act (ACA), as follows:

Affordability Standard – Employer Shared Responsibility Mandate

Coverage under an employer-sponsored plan is deemed affordable if the employee’s required contribution to the plan does not exceed 10.22% (plan years beginning in 2027, up from 9.96% for 2026) of the employee’s household income for the taxable year, based on the cost of single coverage in the employer’s least expensive plan.

As background, employers subject to the ACA’s employer shared responsibility mandate who fail to offer minimum essential coverage to their full-time employees or fail to offer adequate and affordable coverage may be subject to an excise tax if at least one of its employees qualifies for premium assistance through a marketplace. If an employer does not know an individual’s household earnings, it can use one of three safe harbors for purposes of determining affordability; they are:

• A Form W-2 determination in which the employer’s lowest cost self-only coverage providing minimum value does not exceed 10.22% (for 2027 plan year; 9.96% in 2026), of the employee’s Form W-2 wages (Box 1) for the calendar year.
• A rate of pay method in which the minimum value cannot exceed22% (for 2027 plan year; 9.96% in 2026), of an amount equal to 130 hours, multiplied by the employee’s hourly rate of pay as of the first day of the coverage period. For salaried employees, the monthly salary is used instead of the 130-hour standard. An employer can apply this method to hourly employees if they experience a reduction in pay during the year; however, this methodology cannot be used for commissioned salespeople.
• A Federal poverty line (FPL) standard in which cost of single coverage does not exceed 10.22% (for 2027 plan year; 9.96% in 2026) of the individual federal poverty line rate for the applicable calendar year, divided by

For 2027 calendar year plans using the FPL safe harbor, the maximum an employee can be required to pay for single coverage is $135.92 since the 2026 FPL must be used. Federal poverty level guidelines for 2027 will likely be issued in January of 2027 which could impact affordability for non-calendar year plans. 

Out-of-Pocket Limits

2027 Out-of-Pocket Limits

The ACA imposes certain cost-sharing restrictions, such as out-of-pocket (OOP) limits on health plans. These limits are adjusted annually and apply to (1) insured plans offered through the marketplace; and (2) insured and self-funded plans offered outside marketplace.

Note: The OOP limits applicable to high-deductible health plans (HDHP) used in conjunction with health savings accounts (HSAs) differ from these cost sharing limits.

Previously, cost of living adjustments for health savings accounts (HSAs) and EB-HRAs were released. For additional information, see our past Benefit Beat article here.

Health Savings Accounts (HSAs)

• Catch-up contributions for people aged 55 or over remain unchanged at $1,000.
• The contribution limit applies to the 2027 calendar year.
• The HDHP deductible and out-of-pocket limits apply to plan years beginning in 2027.

4980H(a) & (b) Penalties

As a reminder, the 4980H(a) penalty applies if an employer subject to employer shared responsibility (50 or more employees) does not offer minimum essential coverage to at least 95% of its full-time employees.  The 4980H(b) penalty applies if an employer subject to employer shared responsibility does not offer adequate affordable coverage.

Premium Tax Credit

The following contribution percentages are used to determine whether an individual is eligible for a premium tax credit for health coverage purchased through the marketplace for the 2027 tax year:

HIPAA – A Real Risk

A recent cybersecurity resolution agreement is notable because it involves an employer-sponsored health plan.

The U.S. Department of Health and Human Services Office for Civil Rights executed a $450,000 resolution agreement with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans on June 18, 2026. The settlement resolves an investigation into a 2021 ransomware attack by the Conti gang that exposed the protected health information of over 10,000 plan participants and beneficiaries.

In November 2021, staff were prevented from connecting to the company’s virtual private network. The access issues were determined to be caused by a ransomware attack. Ransomware was used to encrypt files, including files that contained plan members’ electronic protected health information (ePHI). Data exposed and potentially stolen in the incident included names, addresses, zip codes, phone numbers, email addresses, and Social Security numbers.

Spencer Gifts failed to conduct a HIPAA-compliant risk analysis, violating the HIPAA Security Rule. In addition, they failed in implementing policies and procedures that comply with the HIPAA Privacy, Security, and Breach Notification requirements. The corrective action plan requires Spencer Gifts to:

• Conduct a comprehensive and accurate risk analysis,
• Review and update its HIPAA policies and procedures,
• Distribute those policies and procedures to the workforce; and
• Provide HIPAA training to its workforce. 

Sponsors of self-funded health plans should take note. Performing and maintaining a current risk analysis is very important. Very large plans should work with a cybersecurity expert to perform this. The OCR has a Security Risk Assessment Tool that might be useful for smaller plans.

As a reminder, HIPAA Privacy Regulations may be updated and released sometime in 2026, however, security regulations are not likely until Summer 2027. We will keep an eye on these updates and provide information as it becomes available.

Health Plan Communication Streamlined

The U.S. Department of Labor issued a proposed rule on July 22, 2026, to modernize electronic disclosure for group health plans. The proposal establishes an optional “notice-and-access” safe harbor for Employee Retirement Income Security Act (ERISA) group health plans, the proposal excludes other welfare plans such as life or disability benefits.

Plan administrators will be able to post documents online and send a Notice of Internet Availability instead of mailing documents. Initially, they must furnish the notice detailing the electronic address, instructions and opt-out rights. Participants will be able to request paper copies or opt-out of electronic delivery. The DOL is accepting comments on the proposal through Sept. 21, 2026, via the Federal eRulemaking Portal.

If these rules are finalized as proposed it should significantly reduce the burden of mailing plan communications. For now, plans delivering electronic information must follow the 2002 rules commonly called the wired at work rules. This standard allows electronic distribution of required ERISA notices to individuals who have regular employment-based access to the employer’s system. If the wired at work standard does not apply, advance consent and other requirements apply before communications can be delivered electronically.  

Hawaii Expands Family Leave Law

Hawaii Governor Josh Green has signed a law expanding the Hawaii Family Leave Law to include military exigency. The law took effect July 1, 2026.

Hawaii’s Family Leave Law provides employees who work for employers with 100 or more employees, up to four weeks of unpaid, job-protected family leave each calendar year, for the birth or adoption of a child or to care for a family member with a serious health condition. An eligible employee is one who has worked for an employer for at least six consecutive months prior to the need for leave.

Massachusetts PFML Contribution Formula

On June 12, 2026, Governor Healey signed legislation shifting the employer PFML contribution from medical leave to family leave, meaning beginning Jan. 1, 2027, the employee will contribute 100% of the medical contribution. The employer will contribute 60% of the family leave contribution with the employee contributing the remaining 40%, thus allowing a more favorable tax treatment.

This shift does not alter an employer’s obligation to remit PFML contributions to the Department of Family and Medical Leave, it does, however, affect how contributions are allocated between employees and employers with 25 or more covered individuals.

Currently the contribution rate is .88% of an employee’s wages up to the Social Security wage limit in which an employee contributes 100% of the family leave contribution and 40% of the medical leave contribution with the employer contributing the remaining 60% of the medical leave contribution. 

Contribution rates are set annually on October 1. The 2027 contribution rate will be announced then.

TDI/FLI Leave is Now Job Protected in New Jersey

Amendments to New Jersey’s Family Leave Act took effect July 17, 2026, which includes job-protected leave for employees taking temporary disability insurance (TDI) or family leave insurance (FLI), see prior Benefit Beat article here. 

New Jersey’s Department of Labor and Workforce Development has issued new FAQ guidance regarding this job-protected leave.

The FAQ guidance states that job protection applies to employees receiving TDI or FLI benefits even if the leave is not covered under NJ Family Leave Act or federal FMLA, meaning even very small employers are required to preserve the job of an individual out on leave.

Job protection entitles an employee to be reinstated to the same job after his/her period of leave, or reinstated to a job with the same pay, benefits, seniority, and other terms of employment as held by the employee prior to the leave.