Benefits Compliance Checklist for Small Employers

You’re busy running a team and keeping the lights on. But if your benefits compliance goes sideways—missing a notice, filing late, or skipping a document—you’re suddenly spending cash on penalties and time on cleanup. Let’s fix that. I’m going to lay out exactly what you need, when it’s due, who it applies to, and how to roll it out without wrecking your day.

This checklist covers most private employers (ERISA applies to private employers; not government or most church plans) and highlights the places where headcount and funding type change the rules. I’ll also give you links to official templates so you can act today.

Who this is for (and why headcount matters)

• Under 20 employees: Federal COBRA typically doesn’t apply, but your state may have “mini-COBRA.” Check state rules if you’re fully insured.

• 20+ employees (prior year): Federal COBRA applies; you must offer continuation coverage and provide specific notices.

• 50+ full-time equivalents (FTEs): You’re an ALE (Applicable Large Employer) under the ACA and must complete 1095-C/1094-C reporting (plus “pay-or-play” rules).

The must-have documents

1) Plan document + SPD (use a wrap if you’re insured)

ERISA requires a governing plan document and an employee-facing SPD. For insured plans, a “wrap” SPD ties your carrier certificates to ERISA’s disclosure rules. New participants must receive an SPD within 90 days of coverage start.

2) SBC (Summary of Benefits & Coverage)

Short, plain-English summary you must give at open enrollment and on request; if you change anything that affects the SBC mid-year, give 60-days’ advance notice. Carriers often create SBCs, but you are responsible for distribution.

3) HIPAA Notices (privacy + special enrollment)

• Special Enrollment Rights: provide at or before enrollment.

• Privacy Notice (NPP): for self-funded plans (or insured plans where the employer accesses PHI beyond enrollment/summaries). Provide at enrollment, update upon material changes, and remind every 3 years that it’s available.

The must-send notices (what, when, who)

• Marketplace (Exchange) Notice to all employees at hire (14 days). Model notices are on DOL’s site; there’s no fine for failing to provide historically, but it’s still required.

• COBRA Notices (if 20+ employees last year):

  • General Notice within 90 days of coverage.

  • Election Notice generally within 14 days after the plan admin is notified (up to 44 days if the employer is the plan admin). Limit premium to 102% of cost; election window is at least 60 days. Use DOL’s model notices.

• WHCRA (mastectomy reconstruction rights) notice—at enrollment and annually. Model language available.

• CHIPRA Premium Assistance notice—annually to employees in affected states (DOL provides a combined model).

• Medicare Part D Creditable Coverage—before Oct 15 to anyone eligible for Medicare; disclose status to CMS annually within 60 days after plan year start (and at other trigger events).

• Newborns’ and Mothers’ Health Protection Act—include notice in SPD/enrollment. Model language available.

Mental Health Parity tip: If your plan offers MH/SUD benefits, be prepared to produce a comparative analysis of any non-quantitative limits (prior auth, network admission criteria) upon request under CAA 2021. Small-group insured plans are effectively held to parity via essential health benefits. Ask your carrier/TPA to provide documentation.

Filings, fees, and new transparency rules

ACA information reporting

• ALEs (50+ FTEs): Furnish 1095-C to employees by early March (permanent 30-day extension from Jan 31) and file with IRS (e-file by Mar 31).

• Small, self-insured: File 1095-B/1094-B on the same timeline. Carriers file 1095-B for fully insured small employers.

RxDC (drug/health spend) – June 1

Submit annual prescription drug and health spending data to CMS. Carriers/TPAs often submit most elements, but employers may need to supply plan/finance data or attestments. Coordinate early.

Gag Clause Attestation – Dec 31

Confirm your plan contracts don’t prevent sharing cost/quality data or de-identified claims. The attestation is annual via the CMS portal (carriers often file for fully insured groups—get written confirmation).

PCORI fee – July 31 (self-insured, including HRAs)

Pay via Form 720 (2nd quarter). For plan years ending 10/1/2024–9/30/2025, the fee is $3.47 per covered life.

Form 5500 + SAR

• Who files: Generally, welfare plans with 100+ participants on day one of the plan year; trust-funded plans file regardless of size. Small insured/unfunded plans (<100) are typically exempt.

• When: Due by the last day of the 7th month after plan year end (e.g., July 31 for calendar plans), with possible extension. The Summary Annual Report (SAR) is due within 9 months of plan year end or 2 months after the Form 5500 deadline if extended.

Special rules that trip up small employers

Section 125 cafeteria plan (pre-tax payroll deductions)

If you take pre-tax deductions for medical, dental, vision, FSA, or HSA contributions you must have a written Section 125 plan document in place before the first pre-tax deduction and you must follow nondiscrimination rules.

HIPAA privacy/security for self-funded plans

If you self-fund any component (e.g., an HRA) or handle PHI beyond enrollment/summaries, you need HIPAA policies, BAAs with vendors, workforce training, a Privacy Notice at enrollment, and breach-response procedures.

Actionable 12-step compliance checklist

1. Name a plan administrator and fiduciary in your plan document (usually the company). Keep signed copies handy. (ERISA plan doc/SPD.)

2. Adopt a wrap SPD (if insured) to consolidate carriers and ERISA disclosures; calendar a 90-day distribution for new enrollees.

3. Embed the Marketplace Notice in onboarding (I-9/handbook packet) so every new hire gets it within 14 days.

4. Map your annual notices (WHCRA, CHIPRA, Part D) to open enrollment communications; automate lists for Medicare-eligible folks. Confirm SBC delivery at OE and for any mid-year material modifications (60-day advance). Keep receipts if sent electronically.

5. Stand up HIPAA basics (if self-funded/access PHI): NPP at enrollment; 3-year reminders; BAAs; training; breach playbook.

6. Lock in ACA reporting support (payroll/ben-admin): determine ALE status each year; schedule 1095-C/B production (early March delivery; Mar 31 e-file).

7. Coordinate RxDC by Feb–Mar with your carrier/TPA (they’ll ask for plan-level data); verify June 1 submission is covered.

8. Verify Gag Clause attestation responsibilities with your carrier/TPA; calendar Dec 31 and save their written confirmation.

9. If self-insured/HRA: set a reminder for PCORI (Form 720) by July 31; confirm the current per-life rate.

10. Check Form 5500 trigger: if you hit 100+ participants on day one of the plan year (or fund via trust), file 5500 and then furnish the SAR.

11. Create a change-management SOP: when you alter benefits, decide if it’s an SBC 60-day change or an ERISA SMM (210/60-day rules).

Handy official resources (save these)

• DOL COBRA model notices & employer guide (start here). DOL

• Marketplace (Exchange) Notice—models (EN/ES, updated Feb 2024). DOL

• SBC templates & 60-day change rule (CMS). Centers for Medicare & Medicaid Services

• CHIPRA model premium assistance notice (DOL). DOL

• WHCRA & NMHPA model notices (DOL). Centers for Medicare & Medicaid Services+1

• HIPAA privacy notice rules (HHS). HHS.gov

• PCORI fee (Form 720) & current rate. IRS+1

• Form 5500 instructions (who files/when). DOL

• RxDC reporting overview (CMS). Centers for Medicare & Medicaid Services

• Gag Clause Attestation page (CMS). Centers for Medicare & Medicaid Services

Roll-out plan you can execute this week

1. Inventory what you offer (medical, dental, vision, FSA, HSA, HRA, life, disability) and whether any part is self-funded.

2. Adopt/refresh your wrap plan document + SPD; centralize all model notices in one PDF “employee benefits guide.”

3. Automate distribution: Put the Marketplace Notice, SBCs, HIPAA special enrollment, and SPD into your onboarding and annual OE emails/portal. Track receipt.

4. Calendar the year:

   • Mar: 1095s to employees/IRS (if applicable).

   • Jun 1: RxDC (coordinate with carrier).

   • Jul 31: PCORI via Form 720 (self-insured).

   • Sept/Oct: 5500/SAR if required.

   • Oct 15: Medicare Part D notices.

   • Dec 31: Gag Clause Attestation.

5. Assign owners: HR for notices, Payroll/Benefits Admin for ACA/RxDC, Finance for PCORI, Broker/TPA for parity analysis and carrier attestations.

6. Document everything: Keep PDFs, mailing proofs, portal logs, and carrier confirmations in a dated folder per plan year.

Straight talk before you go

Compliance is not about perfection; it’s about process. When you lock in the documents, automate the notices, and calendar the few real deadlines, this stops being scary and starts being a boring, repeatable rhythm. And boring is beautiful when regulators come knocking.

Book a Black Mammoth Power Hour. We’ll sit down with your current setup, build your one-page compliance calendar, plug gaps (SPD/wrap, notices), and map who files RxDC, Gag Clause, 1095s, PCORI, and 5500—so you leave knowing exactly what’s next and when.

Ready to be audit-proof without burning a weekend? Let’s go.