How do you prepare for a Department of Labor health plan audit?

EBSA calls these reviews investigations; most employers call them audits.

Who conducts health plan investigations

The Employee Benefits Security Administration (EBSA) is the Department of Labor agency that enforces ERISA, the Employee Retirement Income Security Act, through regional offices. In fiscal year 2025, across retirement and health plans, EBSA closed 878 civil investigations, and 556 of them (63 percent) produced monetary results or other corrective action, totaling $714.4 million recovered. EBSA oversees approximately 2.8 million health plans.

Field Assistance Bulletin 2026-01 (April 2026) directs EBSA to focus on “the most egregious conduct and significant harm” and to finish routine investigations within 18 months and more complex matters within 30 months, unless there are exigent circumstances.

How an investigation usually starts

EBSA’s Enforcement Manual chapter on health plan investigations lists these sources for identifying cases:

• Computer-generated compilations drawn from reports filed with EBSA
• Review of annual reports and supporting financial statements
• Information from other government agencies
• Nongovernmental sources, such as newspapers and industry journals
• Complaints from participants, beneficiaries, fiduciaries, informants, and others

A health investigation may cover reporting and disclosure, fiduciary duties, claims procedures, and group health plan laws such as COBRA, HIPAA, mental health parity, the ACA, and the No Surprises Act.

The document request letter

The manual’s model letter asks for the documents listed in an attachment “within ten business days of your receipt of this letter” and notes that early submission “may eliminate the need for an on-site visit entirely.” That is model language: the date in your actual letter controls, and follow-up requests or subpoenas may come later.

Separately, ERISA section 104(a)(6) requires the plan administrator to furnish plan documents the DOL requests. If the administrator fails to do so at the time and in the manner the request requires, ERISA section 502(c)(6) authorizes a daily penalty that the DOL sets considering the degree and willfulness of the failure (29 CFR 2560.502c-6). The penalty is calculated from no earlier than the 30th day after the request is served, so follow your letter’s deadline and any extension the DOL authorizes.

When a letter arrives:

1. Record the date you received it and the response date it states.
2. Name one coordinator and log everything you send.
3. Call your benefits advisor, and bring in ERISA counsel for legal questions.
4. If the stated date is unworkable, call the investigator before it passes.

The document checklist

EBSA’s model letter points to a separate attachment, so this is a readiness list built on the areas investigators review. Rows marked “if applicable” depend on plan size, funding, design, or coverage.

Document	What it proves	Where to find it
Plan document and summary plan description (SPD), or a wrap document and wrap SPD	The plan exists in writing, and the SPD went out by the later of 90 days after an employee becomes a participant or 120 days after the plan becomes subject to ERISA’s reporting and disclosure rules.	HR files, broker, carrier certificates
Summaries of material modifications (SMMs)	Changes were communicated within 210 days after the end of the plan year in which they were adopted, and material reductions in group health plan services or benefits 60 days after adoption, or through regular plan communications at intervals of 90 days or less.	HR files, carrier notices
Summary of Benefits and Coverage (SBC) and notices of modification	Participants received the coverage summary required under ERISA section 715, plus advance notice of certain mid-year changes (see below the table).	Carrier or third-party administrator (TPA)
Form 5500 filings for recent years (if applicable)	Annual reports were filed by the last day of the 7th calendar month after the plan year ends, before extensions (see the exemption note).	Filing records, TPA, broker
Insurance contracts, certificates, and stop-loss policies	How benefits are funded and who carries the claims risk.	Carrier, broker
Fidelity bond (if applicable)	Plan officials who handle plan funds are bonded (see the note).	Surety or broker
Service provider contracts and compensation disclosures	Brokers and consultants expecting $1,000 or more in compensation disclosed it under ERISA section 408(b)(2)(B).	TPA, pharmacy benefit manager (PBM), and broker agreements
Section 125 cafeteria plan document	Pre-tax employee contributions run through a written plan.	Payroll or benefits vendor
COBRA notices and procedures (if applicable)	Continuation rights were explained on time (see the COBRA note).	COBRA administrator
HIPAA special enrollment notice	Employees received it at or before their first offer of enrollment.	Enrollment materials
HIPAA privacy materials (if applicable)	The plan meets the Privacy Rule duties that apply to it (see the HIPAA note).	Privacy official, business associate agreements
Claims and appeals procedures	The plan maintains reasonable procedures for claims, benefit decisions, and appeals.	SPD, carrier or TPA
Payroll deduction and deposit records	Employee contributions reached the plan on time (see the plan assets note).	Payroll and bank records
Wellness program materials (if applicable)	All plan materials describing the terms of a health-contingent program disclose the availability of a reasonable alternative standard (and, when applicable, the possibility of waiving the standard), contact information for it, and a statement that personal physician recommendations will be accommodated. Outcome-based programs also include this in any notice that someone did not meet the initial standard.	Wellness vendor
NQTL comparative analyses (if subject to MHPAEA)	The plan can produce the analyses ERISA section 712(a)(8) requires on request (see the parity note).	Carrier, TPA, or PBM
Gag clause attestation (if applicable)	The annual attestation was submitted by December 31 (see the note for exemptions).	Carrier or TPA agreement
CHIP premium assistance notice (if applicable)	All employees, regardless of enrollment or eligibility status, received the annual notice.	Open enrollment packet
Women’s Health and Cancer Rights Act (WHCRA) notice (if applicable)	For plans that provide medical and surgical benefits for mastectomy, participants received it upon enrollment and annually.	Enrollment packet, carrier
Michelle’s Law description (if applicable)	It accompanied any notice requiring certification of student status.	Dependent eligibility materials
Employee census and eligibility records	Eligibility rules were applied as written.	HR system, payroll

SBC changes. When a plan or insurer makes a material modification that would affect the content of the SBC, is not reflected in the most recently provided SBC, and occurs other than in connection with a renewal or reissuance of coverage, enrollees must receive notice at least 60 days before the change takes effect, in addition to the SMM deadlines.

CHIP notice. The duty applies to an employer whose group health plan is in a state offering premium assistance, and the notice tells each employee about assistance in the state where that employee lives. Alabama is on the state list in EBSA’s model notice, current as of July 31, 2026.

Notes on the rows that need the most care

Form 5500 small-plan exemption

Under 29 CFR 2520.104-20, a welfare plan is exempt from filing Form 5500 if it has fewer than 100 participants at the beginning of the plan year, is not subject to Form M-1 filing, and pays benefits solely from the employer’s general assets, exclusively through insurance whose premiums the employer pays from general assets, or both. Employee contributions toward those premiums must be forwarded within three months of receipt, and an insured plan must return refunds owed to contributing participants within three months and tell participants on entry how refunds are allocated.

A plan that pays benefits from a trust or other fund separate from the employer’s general assets falls outside the exemption; a self-funded plan paying claims as needed solely from general assets can meet the funding condition. DOL treats a plan tied to a Section 125 cafeteria plan that meets Technical Release 92-01 as unfunded for annual reporting, even with employee contributions (Field Assistance Bulletin 2008-04). The three-month condition belongs to this exemption only, and the exemption leaves other Title I duties, such as furnishing SPDs, in place.

Fidelity bond

Under the same bulletin, plan officials who handle plan funds generally need a bond of at least 10 percent of the funds handled in the prior year, with a $1,000 minimum and a $500,000 maximum ($1,000,000 for plans holding employer securities). A plan paying benefits only from general assets is exempt as unfunded. Insured benefits, a trust, employee contributions, or a separate plan bank account generally end that status, with one exception: as an enforcement policy, DOL treats a Section 125-linked plan meeting Technical Release 92-01 as unfunded for bonding. For fully insured plans, premiums paid directly from general assets need no bond, and bonding applies when plan officials handle money belonging to the plan, such as retained refunds or dividends. Confirm your plan’s status with counsel.

COBRA timing

Federal COBRA generally applies to group health plans of employers with 20 or more employees in the prior year.

• General notice: due to each covered employee and covered spouse by the earlier of 90 days after their coverage begins (or after the plan first becomes subject to COBRA, if later) or the date an election notice would be due to the employee, the spouse, or a dependent child, and a timely election notice furnished to the employee or spouse satisfies that person’s general notice (29 CFR 2590.606-1).
• Employer-reported events, such as death, termination of employment, or reduced hours: the employer generally has 30 days to notify the administrator (29 CFR 2590.606-2), which then has 14 days to send the election notice. An employer that is also the administrator has 44 days from the event, or from the loss of coverage if the plan’s terms start both continuation coverage and the employer’s notice period on that date (29 CFR 2590.606-4).
• Participant-reported events, such as divorce, legal separation, or a child losing dependent status (29 CFR 2590.606-3): the election notice is due 14 days after the administrator receives that notice, including when the employer is the administrator.

Multiemployer plans follow separate timing rules.

HIPAA privacy: covered status first

Under 45 CFR 160.103, a group health plan is a HIPAA covered entity only if it has 50 or more participants or is administered by an entity other than the employer that established and maintains it. A plan with fewer than 50 participants that the employer administers entirely itself falls outside that definition. Whether a carrier’s or TPA’s role counts as outside administration is a question for counsel.

For covered plans, 45 CFR 164.530(k) excuses a plan from most Privacy Rule administrative requirements (a privacy official, training, safeguards, a complaint process, sanctions, mitigation, and written policies) when it provides benefits solely through an insurance contract and creates or receives no protected health information (PHI) beyond summary health information and enrollment or disenrollment information. It must still refrain from retaliation and from requiring waivers of rights, and it keeps documentation of plan amendments made to share information with the employer. Self-funded plans, and insured plans that create or receive other PHI, fall outside this exception.

Employee contributions are plan assets

Under the plan asset regulation, employee contributions become plan assets on the earliest date they can reasonably be segregated (separated) from the employer’s general assets, and for a welfare plan no later than 90 days after the employer receives or withholds them. A plan with fewer than 100 participants at the start of the plan year has an optional safe harbor: amounts deposited with the plan by the 7th business day after receipt or withholding are treated as timely.

Mental health parity as of September 2026

An NQTL (nonquantitative treatment limitation) is a benefit limit that is not a number, such as prior authorization.

• Which plans are subject. The Mental Health Parity and Addiction Equity Act (MHPAEA) has a small employer exemption for group health plans, and insurance offered with them, of employers that averaged no more than 50 employees on business days in the preceding calendar year, under the statute’s counting rules. It matters most for self-funded plans, because non-grandfathered small-group insured coverage must include mental health and substance use disorder benefits as essential health benefits, provided in compliance with MHPAEA rules (DOL FAQ Part XVII). Other exemptions, such as for retiree-only plans, can also apply.
• What subject plans must do. Since the Consolidated Appropriations Act, 2021, a plan or insurer subject to MHPAEA that covers both medical and mental health or substance use disorder benefits and imposes NQTLs must perform and document comparative analyses and provide them to the Secretary upon request.
• Enforcement status. On May 15, 2025, DOL, HHS, and Treasury said they will not enforce the portions of the 2024 final rule that are new relative to the 2013 rule, for failures before a final decision in pending litigation plus 18 months, and that the statutory obligations continue. Field Assistance Bulletin 2026-03 (September 8, 2026) confirmed that approach and focused analysis enforcement on blanket treatment exclusions, medical necessity review (prior authorization, concurrent review, and retrospective review), and network adequacy. EBSA may still investigate other NQTLs, particularly in response to complaints.

Gag clause attestation

Plans may not agree to contract terms with providers, networks, or TPAs that restrict sharing provider cost or quality information, access to de-identified claims data, or sharing that data with business associates. Under DOL’s FAQ Part 57, each attestation is due by December 31 and covers the period since the last one. Plans offering only excepted benefits are exempt, and the Departments exercise enforcement discretion for plans consisting solely of health reimbursement arrangements (HRAs) or other account-based plans. An insurer’s attestation for a fully insured plan satisfies the requirement for both. A self-funded plan may have its TPA attest under a written agreement, and the legal duty stays with the plan.

A 90-day readiness plan

1. Days 1 to 30: pull the plan document, SPD, amendments, and SMMs; confirm your funding arrangement, participant count, and employee count, which drive Form 5500, bonding, HIPAA, and parity status; request NQTL analyses and gag clause attestation confirmations from your carrier, TPA, and PBM.
2. Days 31 to 60: compare three recent payroll periods against deposit or remittance dates; trace one employer-reported and one participant-reported COBRA event through the deadlines; confirm this year’s CHIP and WHCRA notices went out, with proof; check the SPD against carrier contracts and actual eligibility practice.
3. Days 61 to 90: adopt missing amendments, send overdue notices, ask counsel whether a correction program fits any late filing or deposit, and store the finished file where your coordinator can reach it.

Where EBSA focuses its attention

• Parity. The joint 2025 MHPAEA Report to Congress reports that EBSA issued 14 insufficiency letters covering 32 NQTLs from August 1, 2023, through July 31, 2025.
• Late contributions. EBSA’s Voluntary Fiduciary Correction Program lists delinquent participant contributions as a correction category.

How investigations end

EBSA’s stated policy is to promote voluntary compliance with ERISA where possible, and EBSA decides whether it fits a case. Its Voluntary Compliance Guidelines treat cases involving potential fraud or criminal misconduct, or that may warrant removing a fiduciary, as generally unsuitable. The outcomes they describe:

• No violations found: the regional office issues a closing letter.
• Voluntary compliance pursued: a notice letter describes the violations and requests correction. The model letter asks for contact within ten days of its date; the date in your actual letter controls.
• Violations corrected: corrections can be documented in a settlement agreement, and a closing letter follows once correction is confirmed and any applicable penalty is paid.
• Violations left uncorrected: EBSA may refer the matter to the Office of the Solicitor of Labor for possible legal action.

For a fiduciary breach, ERISA section 502(l) requires a penalty of 20 percent of the amount recovered under a settlement agreement with the Secretary, or ordered by a court in a case the Secretary brought under section 502(a)(2) or (a)(5). In the Secretary’s sole discretion, it may be waived or reduced on a written determination that the fiduciary acted reasonably and in good faith, or is expected to be unable to restore all losses without severe financial hardship unless it is waived or reduced.

Civil penalty amounts in effect for 2026

The Department of Labor cancelled its 2026 inflation adjustment because October 2025 CPI-U data was unavailable, and OMB instructed agencies to keep using the 2025 amounts, which include:

ERISA provision	Violation	Maximum penalty
Section 502(c)(2)	Failure or refusal to properly file the annual report (Form 5500)	$2,739 per day
Section 502(c)(6)	Administrator’s failure to furnish documents requested under section 104(a)(6) at the time and in the manner required; penalty calculated no earlier than the 30th day after service	$195 per day, up to $1,956 per request
Section 502(c)(9)(A)	Employer failure to give employees the CHIP premium assistance notice	$145 per day, per employee
Section 715	Willful failure to provide a Summary of Benefits and Coverage	$1,443 per failure, with each affected participant or beneficiary a separate failure

This guide is general information as of September 15, 2026 and is not legal advice for any specific plan.

How My Advisor helps

My Advisor keeps Alabama employers current on ERISA, ACA, HIPAA, and DOL requirements, and every compliance answer our clients get is backed by legal experts on retainer. Our Department of Labor audit guide covers preparing for and navigating an audit, with a checklist of requested documents and sample documents. If a DOL letter has already landed on your desk, our clients assemble the response with our team, and with the counsel we keep on retainer where the question turns legal. We also supply enrollment notices and election and waiver forms.