Back to all blog posts
If you're heading into open enrollment, several of the numbers in your benefits guide have probably changed. The IRS has already set 2027 HSA limits at $4,500 for self-only coverage and $9,000 for family coverage, and the ACA affordability threshold rises to 10.22% for 2027 plan years. The One Big Beautiful Bill Act (OBBBA) also raised the dependent care FSA limit to $7,500 starting in 2026 and made individual-market bronze and catastrophic plans HSA-compatible.
Each of those changes touches plan documents, payroll deductions, and employee communications. Miss one, and the consequences go well beyond a single penalty notice. This guide covers the rules HR and benefits leaders need to know, with the current figures, forms, and deadlines for each.
Employee benefits compliance means your benefit plans and practices meet every applicable federal, state, and local law. It sits within the broader set of HR compliance laws employers follow, but it carries its own filings, notices, and testing requirements.
Getting it wrong creates real legal and financial exposure. Non-compliance can lead to IRS excise taxes and DOL penalties, lost tax advantages for employees, participant lawsuits under ERISA, and back taxes when a plan fails testing. It also erodes employee trust in benefits they rely on.
These nine areas deserve a permanent spot in your benefits administration calendar. Figures below reflect the current IRS guidance for 2026, with 2027 figures noted where the IRS has published them.
The ACA's employer shared responsibility provisions apply to applicable large employers (ALEs): organizations with 50 or more full-time employees, including full-time equivalents, in the prior year. ALEs must offer affordable, minimum value coverage to at least 95% of full-time employees and their dependents.
Coverage counts as affordable if the employee's share of self-only premiums doesn't exceed 9.96% of household income for 2026 plan years, per Rev. Proc. 2025-25, and 10.22% for 2027 plan years, per Rev. Proc. 2026-26. Under Rev. Proc. 2025-26, the 2026 penalty for failing to offer coverage is $3,340 per full-time employee, and the penalty for offering unaffordable coverage is $5,010 per employee who receives a Marketplace subsidy.
ALEs report coverage on Forms 1094-C and 1095-C. Under IRS Notice 2025-15, employers can now post a notice offering Form 1095-C on request instead of mailing it to every employee, as long as they meet the notice requirements.
COBRA requires employers with 20 or more employees on more than half of their typical business days in the prior year to offer continuation of group health coverage after a qualifying event, such as job loss, reduced hours, divorce, or death.
The DOL's COBRA guide for employers sets the key timelines:
Coverage typically lasts 18 months, extending to 29 or 36 months in certain cases. Plans can charge up to 102% of the premium, or 150% during a disability extension.
HIPAA's Privacy, Security, and Breach Notification Rules protect individuals' health information. Company health plans are covered entities under HIPAA, so group health plans, including health FSAs and HRAs, must safeguard protected health information (with a narrow exception for self-administered plans with fewer than 50 participants).
Obligations are heaviest for self-insured plans, where the employer handles more health data directly. Keep plan data separate from employment records, limit access to staff who need it, train those staff, and run regular risk assessments.
ERISA sets standards for most private-sector retirement and welfare benefit plans, including health plans and health FSAs. It requires a written plan document, a summary plan description for participants, and fiduciaries who act solely in participants' interest.
Two obligations come up every year:
Employers that offer group health coverage to Medicare-eligible employees must follow Medicare Secondary Payer rules, which determine whether the group plan or Medicare pays first. Payroll also withholds the 1.45% Medicare tax from wages, and employers match it.
Plans with prescription drug coverage have two Part D deadlines, per CMS:
HSAs pair with high-deductible health plans (HDHPs), and employers must confirm their plans meet HDHP rules before offering contributions. Rev. Proc. 2025-19 and Rev. Proc. 2026-24 set these figures:
IRS Notice 2026-5 also covers two OBBBA changes: bronze and catastrophic plans sold through the Marketplace count as HDHPs starting in 2026, and HDHPs can now permanently cover telehealth before the deductible. Our breakdown of 2027 HSA contribution limits covers what to update. Report employer contributions on Form W-2 (box 12, code W).
Employers can offer three types of FSAs, each with its own rules:
The IRS hasn't yet published 2027 health FSA or commuter limits, which typically arrive in late October or early November, according to the Benepass 2026 Benchmarking Report. The new dependent care limit also deserves extra attention in enrollment materials: the median dependent care FSA contribution on Benepass is $3,600, less than half of what employees can now set aside.
Keep your health care FSA plan documents current, run nondiscrimination tests each year, and handle forfeitures correctly. Most employees spend their full balance (79% of health FSA participants on Benepass did by year-end), but when funds are forfeited, they can offset plan admin costs, reduce next year's contributions, or fund a uniform taxable refund. ERISA's exclusive benefit rule bars keeping them as employer profit.
Pre-tax commuter benefits let employees pay for transit and parking with tax-free dollars. For 2026, the monthly limit is $340 for transit and vanpooling and a separate $340 for qualified parking, per Rev. Proc. 2025-32.
Commuter benefits are optional under federal law, but several states and cities require covered employers to offer them. Check the commuter benefits requirements by state and city for every location where employees work.
According to the DOL's FMLA fact sheet, private employers with 50 or more employees in 20 or more workweeks must provide eligible employees up to 12 workweeks of unpaid, job-protected leave a year, or 26 workweeks for military caregiver leave. Employees qualify after 12 months of employment and 1,250 hours of service at a site with 50 or more employees within 75 miles.
Employers must keep group health coverage in place during leave on the same terms and reinstate employees to the same or an equivalent job. Relevant DOL forms include WH-381 (eligibility notice), WH-382 (designation notice), and the WH-380 certification forms.
Each of these rules is easier to follow when compliance is built into how you administer benefits, not handled as a separate project each year. Benepass builds compliance into its employee benefits platform for pre-tax and lifestyle benefits:
For quick answers to tricky questions between filings, try Benepass's Benefits Compliance GPT.
Book a demo to see how Benepass builds nondiscrimination testing, plan documentation, and imputed income reporting into everyday benefits administration, so compliance stays current without becoming a separate project every year.
Consequences depend on the rule. ACA violations trigger IRS penalties assessed per employee, and late Form 5500 filings carry DOL penalties that accrue daily. A failed nondiscrimination test can make benefits taxable for highly compensated employees, and missed COBRA notices can lead to participant claims and statutory penalties. Many issues can be corrected through IRS or DOL correction programs if you catch them early, so work with benefits counsel or your benefits broker as soon as you spot a problem.
Some do, and some don't. The ACA employer mandate and FMLA apply at 50 employees, and federal COBRA applies at 20, though many states have mini-COBRA laws for smaller groups. ERISA, HIPAA, and IRS contribution limits apply regardless of size, but welfare plans with fewer than 100 participants that are fully insured or unfunded generally don't have to file Form 5500. Confirm which thresholds you meet each year as headcount changes.
Review at least once a year, ideally before open enrollment, when new IRS limits land and plan documents need updating. Also review whenever you add a benefit, cross a headcount threshold, or hire in a new state. An HR compliance checklist keeps recurring deadlines like Part D notices, Form 5500, and ACA reporting from slipping.
