When the Department of Labor (DOL) first published cybersecurity guidance for ERISA plans in 2021, many in the industry read it as a retirement plan issue. That reading no longer holds. In Compliance Assistance Release 2024-01, the DOL’s Employee Benefits Security Administration (EBSA) confirmed that the guidance applies to all ERISA plans, including health and welfare plans.
For third party administrators (TPAs), record-keepers, and self-insured employers, that clarification matters. Plan fiduciaries are expected to treat cybersecurity as part of their duty of prudence, and that expectation flows directly to the service providers who hold participant data.
What the guidance includes
The DOL guidance has three parts:
- Tips for hiring a service provider. Questions fiduciaries should ask when selecting and monitoring vendors, including how the vendor secures data, what audits it undergoes, and what its contract says about breaches and insurance.
- Cybersecurity program best practices. A list of practices the DOL expects of plans and service providers, such as a formal documented security program, annual risk assessments, third-party audits of controls, strong access control, encryption of sensitive data, security awareness training, business continuity and disaster recovery planning, and a documented incident response process.
- Online security tips for participants. Basic guidance for plan members on protecting their own accounts.
Why TPAs should pay attention
Plan sponsors are now more likely to send detailed security questionnaires, ask for independent audit reports, and write cybersecurity requirements into service agreements. TPAs that cannot show a documented program will find it harder to win and keep business. Health and welfare TPAs also often handle protected health information, which means HIPAA Security Rule obligations apply at the same time.
Practical next steps
- Map your current security program against the DOL best practices and document any gaps.
- Complete (or update) a formal risk assessment that covers participant data across all systems and vendors.
- Prepare a standard response package for client due diligence: policies, risk assessment summary, penetration test results, and incident response plan.
- Review contracts with your own subcontractors so your security commitments to plan sponsors are backed by theirs.
- For plan sponsors: add cybersecurity questions to your service provider review and keep a record of how you evaluated each vendor.
How Eagle can help
Eagle Consulting Partners works with TPAs, plan sponsors, and self-insured employers to build security programs that hold up to DOL, HIPAA, and client scrutiny. We perform security risk assessments, write policies and procedures, and help prepare the documentation plan sponsors ask for. Contact us to talk through where your program stands.
Source: U.S. Department of Labor, Compliance Assistance Release No. 2024-01.
