Employee Welfare Benefit Plan: ERISA Filings, COBRA, and HIPAA

An employee welfare benefit plan carries a defined set of ERISA requirements: the plan must be in writing, hold any assets in trust, run under fiduciary standards, give participants a Summary Plan Description, file a Form 5500 with the Department of Labor each year, and follow federal rules for handling benefit claims and appeals. Group health plans layer on COBRA continuation coverage and HIPAA privacy obligations. These duties apply to almost every private-sector plan that provides medical, disability, life, or similar non-retirement benefits, regardless of employer size.

What Counts as a Welfare Plan

Federal statute defines an employee welfare benefit plan as any plan, fund, or program an employer, a union, or both establish or maintain to provide certain listed benefits to participants or beneficiaries.¹ Those benefits include medical, surgical, and hospital care; protection against sickness, accidents, disability, death, or unemployment; vacation benefits; apprenticeship and training programs; day care centers; scholarship funds; and prepaid legal services. Benefits can be delivered through an insurance policy or a self-funded arrangement where the employer pays claims directly.

A boundary worth knowing: ordinary “payroll practices” are not welfare plans. If your employer pays your normal wages from general funds while you’re out sick, on vacation, or in training, ERISA doesn’t apply to that payment.² A separately funded disability policy, by contrast, does.

Which Plans Are Covered

ERISA applies to welfare plans established by private-sector employers of any size and structure. A five-person business with a group health plan faces the same core obligations as a large corporation. Several categories sit outside ERISA entirely:

Plans established by federal, state, or local government entities for their employees.
Plans maintained by churches or religious organizations, unless they elect ERISA coverage.
Plans maintained solely to comply with state workers’ compensation, unemployment compensation, or disability insurance laws.
Plans maintained outside the United States primarily for nonresident workers.

If a plan falls into an exempt category, the ERISA requirements described below don’t apply, though other federal or state laws may.³

Unlike pension plans, welfare plans are not subject to ERISA’s minimum funding rules, vesting schedules, or participation standards. Benefits are not “vested.” An employer can generally modify or terminate a welfare plan as long as it follows the plan’s own terms and gives proper notice. The federal protections that do apply focus on transparency, fair claims handling, and honest management of plan assets.

Written Plan Document and Fiduciary Duties

Every ERISA welfare plan must operate under a written plan document, and any plan assets must be held in trust under a written trust instrument. Anyone who exercises discretion over the plan’s management or assets is a fiduciary, whether or not that label appears on their job description. The role follows the function.

Fiduciaries must act solely in the interest of participants and beneficiaries, for the exclusive purpose of providing benefits and paying reasonable administrative costs, and must exercise the care and diligence of a prudent person familiar with such matters.⁴ A fiduciary who breaches those duties and causes losses to the plan can be required to restore them from personal assets. Participants can bring a civil action to recover losses, obtain equitable relief, or enjoin ongoing violations, and the Department of Labor can bring its own enforcement action.⁵

Summary Plan Description and Participant Disclosures

Every ERISA-covered welfare plan must provide participants with a Summary Plan Description explaining in plain language how the plan works, what benefits it provides, how to file claims, and what participant rights are available.⁶

The distribution deadlines are specific. New participants must receive the SPD within 90 days of becoming covered. A brand-new plan has 120 days after becoming subject to ERISA to distribute it. If the plan is amended, an updated SPD must go out every five years; a plan that hasn’t changed still must redistribute the SPD every ten years.⁷

When a plan makes a significant change between full SPD updates, participants must receive a Summary of Material Modification within 210 days after the end of the plan year in which the change was adopted.⁷ If a participant requests plan documents and the administrator doesn’t mail them within 30 days, a court can impose personal liability on the administrator of up to $100 per day for the delay.⁵

Form 5500 Annual Filing

Most welfare plans must file a Form 5500 each year with the Department of Labor, reporting on the plan’s financial condition and operations.⁸ Plans with 100 or more participants at the beginning of the plan year file the full Form 5500 as a large plan. Smaller plans may be eligible to file the shorter Form 5500-SF.⁹ Certain small welfare plans that are unfunded or fully insured may qualify for limited filing exemptions, though the exemption doesn’t relieve the plan of its SPD or other ERISA obligations.¹⁰

Late or incomplete filings are expensive. The DOL can assess up to $2,739 per day for each day a plan administrator fails to file a complete and accurate report, with no cap, and the figure is inflation-adjusted each year.⁹

Claims and Appeals Procedures

ERISA requires every welfare plan to run a structured claims and appeals process. Plans cannot charge fees for filing a claim or appeal, and a participant can designate someone else to act on their behalf.¹¹

Deadlines for initial decisions depend on the type of claim:

Urgent care claims under a group health plan: 72 hours. If more information is needed, the plan must ask within 24 hours and give the claimant at least 48 hours to respond.
Pre-service group health claims: 15 days, with one possible 15-day extension.
Post-service group health claims: 30 days, with one possible 15-day extension.
Disability claims: 45 days, with up to two 30-day extensions.
All other welfare benefit claims: 90 days, with one possible 90-day extension.

A written denial must explain the specific reasons, identify the plan provisions relied on, describe any additional information that could strengthen the claim, and lay out the participant’s appeal rights, including the right to file a lawsuit under ERISA if the appeal fails.¹¹ For disability denials, the notice must also explain why the plan disagreed with any treating physicians or with a Social Security Administration disability determination, if applicable.

Participants have at least 60 days after a denial to file an internal appeal, and 180 days for group health plan claims. During the appeal, the participant can submit new documents and written arguments and is entitled to free copies of all records relevant to the claim. The reviewer must consider everything submitted, even material the initial decision-maker never saw. Once the internal process is exhausted, a participant can bring a civil action in federal court to recover benefits due under the plan.⁵

COBRA Continuation Coverage

Group health plans sponsored by employers with 20 or more employees must offer COBRA continuation coverage when a qualifying event would otherwise end someone’s coverage.¹² The former employee or family member typically pays the full premium plus a small administrative fee.

Duration turns on the qualifying event:

18 months, when the qualifying event is termination of employment for any reason other than gross misconduct, or a reduction in work hours.
36 months, when the qualifying event is the covered employee’s death, divorce or legal separation, the employee becoming eligible for Medicare, or a dependent child aging out of coverage under the plan.

When the covered employee becomes Medicare-eligible less than 18 months before a termination or hours reduction, the employee’s spouse and dependents may be entitled to COBRA coverage lasting up to 36 months from the Medicare entitlement date. Federal COBRA doesn’t reach employers with fewer than 20 employees, though many states have “mini-COBRA” laws that do.

HIPAA Privacy for Group Health Plans

Welfare plans that qualify as group health plans must generally comply with HIPAA’s privacy and security rules governing how individually identifiable health information is used, stored, and shared. A self-administered plan with fewer than 50 participants is excluded.¹³

Covered plans must use and disclose protected health information only as the rules permit, apply a minimum-necessary standard, provide each enrollee with a notice of privacy practices, and designate a privacy official responsible for compliance. Plans must also send a reminder at least once every three years that the privacy notice is available on request. Any outside vendor handling health information must be governed by a written business associate contract with specific safeguards.

Federal Preemption of State Law

ERISA supersedes any state law that “relates to” a covered employee benefit plan.¹⁴ States generally cannot impose their own reporting requirements, mandate specific plan benefits, or create causes of action that conflict with ERISA. Courts have read “relates to” broadly, which is why most benefit disputes proceed in federal court.

One important carve-out: states retain the power to regulate insurance companies, banks, and securities firms. A state cannot directly regulate the terms of a self-funded health plan, but it can regulate the insurance company underwriting a fully insured plan. That “insurance savings clause” is why self-funded and fully insured plans sometimes operate under different rules in practice.

1
Office of the Law Revision Counsel. 29 USC 1002 – Definitions
2
eCFR. 29 CFR 2510.3-1 Employee Welfare Benefit Plan
3
U.S. Department of Labor. Employment Law Guide – Employee Benefit Plans
4
eCFR. 29 CFR Part 2550 – Rules and Regulations for Fiduciary Responsibility
5
Office of the Law Revision Counsel. 29 USC 1132 – Civil Enforcement
6
eCFR. 29 CFR Part 2520 Subpart B – Contents of Plan Descriptions and Summary Plan Descriptions
7
U.S. Department of Labor. Reporting and Disclosure Guide for Employee Benefit Plans
8
U.S. Department of Labor. Form 5500 Series
9
Department of Labor Employee Benefits Security Administration. 2025 Instructions for Form 5500 Annual Return/Report of Employee Benefit Plan
10
eCFR. 29 CFR 2520.104-21 – Limited Exemption for Certain Group Insurance Arrangements
11
eCFR. 29 CFR 2560.503-1 – Claims Procedure
12
U.S. Department of Labor. FAQs on COBRA Continuation Health Coverage for Workers
13
U.S. Department of Health and Human Services (HHS). Summary of the HIPAA Privacy Rule
14
Office of the Law Revision Counsel. 29 USC 1144 – Other Laws