On July 23, 2026, the Department of Labor (DOL) issued a proposed rule that would modernize the currently outdated group health plan disclosure methods. The proposal creates a new, additional safe harbor allowing plans to provide required documents digitally.
The proposed change aims to ease the administrative burden faced by plan administrators when providing plan disclosures and to acknowledge the reality that an increasing share of the public relies on electronic communication and internet-based platforms as their primary method of accessing information.
Notice and Access Standard
The proposed rule creates a new “notice and access” safe harbor for group health plan notifications. This means plan administrators could satisfy ERISA’s disclosure requirements by posting required documents to a website and providing participants and beneficiaries with a Notice of Internet Availability. The proposed rule largely mirrors the 2020 safe harbor for retirement plans, with a few modifications to reflect unique requirements of group health plans. The new proposal would not eliminate the DOL's existing 2002 electronic disclosure safe harbor; it offers an additional safe harbor option for employers.
The History
In 2002, the DOL, issued a rule that provided a safe harbor for electronic communication for ERISA plans. However, it was restricted to recipients in two categories:
Following is a summary of each of the key concepts outlined in the proposed rule.
1. Covered Individuals
A covered individual is any participant or beneficiary who is entitled to covered documents who has provided an electronic address to the employer or plan administrator. This includes:
Dependent children who are beneficiaries under the plan and have attained age 18 would be eligible to receive disclosures directly if they provide their own electronic address.
2. Covered Documents
The proposed rule applies to documents relating to ERISA-covered group health plans (medical, dental, vision, FSA, EAP, etc.). This means any document or notification that the administrator is required to furnish for ERISA group health plans as well as other required disclosures such as COBRA and HIPAA notices. This broad definition includes:
In addition to documents that the plan administrator has an obligation to furnish, the proposal also permits using the new safe harbor for documents that must be furnished only upon participant request.
3. What is Not a Covered Document?
As currently proposed, the safe harbor only applies to certain group health plan documents (as outlined above). It does not extend to other types of welfare benefits, such as life insurance and disability plans, accident/sickness policies, pre-paid legal services, etc.
Employers that use a wrap SPD and/or wrap plan document that incorporates health plan benefits and non-health plan benefits may be challenged to use the safe harbor as it is currently written (specifically for providing a wrap SPD). As written, employers would need to continue relying on the 2002 safe harbor for non-health plan benefit disclosures. Many hope that this is an oversight that it will be addressed in the finalization process.
4. Notice of Internet Availability (NOIA)
To use the new safe harbor, administrators must provide covered individuals with a Notice of Internet Availability (NOIA) which serves to notify individuals that plan information has been posted on the website and available. The NOIA must be distributed to the email address or cell phone number provided by the covered individual and must include the following elements:
5. Separate vs. Combined NOIAs
The general rule requires that separate NOIAs must be sent each time a covered document is posted on the website.
However, certain exceptions to this rule are outlined in the proposed safe harbor. Specifically, administrators may send a combined NOIA for recurring annual disclosures that do not demand time-sensitive participant action. As an example, a combined NOIA may be sent that highlights multiple documents posted at open enrollment (such as the SPD along with other required group health plan notices)
Stand-alone NOIAs are required for all notices that are time sensitive or require participant action. For example, a COBRA Qualifying Event Notice would require a NOIA outlining the election form posting.
6. Initial Notification
Before relying on the safe harbor, administrators must provide an “initial notice” that serves as an outline of the plan’s electronic delivery procedures. The initial notice must contain the following information:
The initial notice would need to be in paper form except for individuals who already qualify to receive electronic disclosures under the existing 2002 safe harbor. Electronic notification can be used for those individuals.
7. Website Requirements
Under the new safe harbor, administrators would be required to maintain a website where covered documents are posted, and covered individuals can access them. Secure websites (including benefits administration platforms), portals, or mobile apps are all permissible options to host documents. The website must satisfy the following requirements:
If a group health plan disclosure contains HIPAA-protected PHI, a password-protected or otherwise secure portal rather than a public website may be required. The most common use case for PHI in documents would be claim denial or appeal correspondence.
8. No Email Delivery Option
The proposed safe harbor does not include an email delivery option. The DOL excluded this option citing privacy concerns because group health plan disclosures can contain protected health information (PHI) which could be unsecured if transmitted via email or exposed if sent to a company email. This is a key difference from the 2020 retirement safe harbor rule which permits email delivery.
9. Invalid or Terminated Email Addresses
Administrators would be required to monitor for invalid or inoperable email addresses. If an electronic notice (such as an NOIA) is returned as undeliverable, the administrator must take reasonable steps to obtain a valid electronic address (and redeliver the NOIA) or revert to paper delivery.
In addition, when a covered individual terminates employment, a personal email address will need to be obtained (since a work email will no longer be accessible). Otherwise, the employer will not be able to use the new notice and access safe harbor method for post-employment disclosures.\
10. Special Rights
Participants and beneficiaries have two special rights under the proposed safe harbor:
Plan administrators would be required to establish reasonable procedures for processing paper copy and opt out requests.
The DOL newly release safe harbor is only a proposed rule. This means that employers may not rely on the new safe harbor until it is finalized. If finalized, the new safe harbor would become available on the first day of the first calendar year following publication of the final rule.
In the meantime, employers should continue to rely on the 2002 safe harbor for electronic delivery or provide traditional paper documents for ERISA group health plan materials.
Although no immediate action is required, employers may wish to begin evaluating how the proposed rule could affect their employee communications if it is finalized.