Federal regulators have issued new guidance that will affect how employers manage health plan data sharing for the rest of 2026. The update comes in response to a rise in cybersecurity incidents involving third-party administrators, payroll vendors, and benefits platforms. While the rules do not create new penalties, they clarify that employers—not vendors—are ultimately responsible for protecting employee health information.

Mental health parity continues to be an important compliance obligation for employer-sponsored group health plans. While recent federal actions have created some confusion, employers should understand that the core requirements of the Mental Health Parity and Addiction Equity Act (MHPAEA) remain in effect.

Employee benefits managers are facing one of the busiest compliance years in more than a decade. Several major federal requirements are converging at the same time, and most of them carry real penalties for employers that miss deadlines or fail to document their efforts. The result is a mid-year “compliance crunch” that is catching many organizations off guard.