Federal regulators have issued new guidance that will affect how employers manage health plan data sharing for the rest of 2026. The update comes in response to a rise in cybersecurity incidents involving third-party administrators, payroll vendors, and benefits platforms. While the rules do not create new penalties, they clarify that employers—not vendors—are ultimately responsible for protecting employee health information.

The guidance focuses on three areas where regulators say employers need stronger oversight. First, employers must be able to show that they understand what data their vendors collect, how it is stored, and who has access to it. Regulators emphasized that “set-and-forget” vendor relationships are no longer acceptable. Second, employers must document how they review vendor security practices, including encryption standards and breach response procedures. Third, regulators want employers to limit unnecessary data transfers, especially large eligibility files that include fields not required for plan administration.

For benefits managers, the message is clear: cybersecurity is now a core compliance responsibility. Regulators are encouraging employers to take three immediate steps:

• Review vendor contracts to confirm security and breach-notification requirements
• Reduce unnecessary data sharing by limiting eligibility file fields
• Create a benefits-specific incident plan so HR teams know what to do if a vendor is compromised

The new guidance reflects a broader shift toward protecting employee data across all benefits programs. Employers that act now will be better prepared for audits and better positioned to maintain employee trust.

For more Employee Benefits resources, contact INSURICA today.

Copyright © 2026 Smarts Publishing. This is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel or an insurance professional for appropriate advice.