DPC + HSA: What Plan Sponsors Need to Know

DPC + HSA: What Plan Sponsors Need to Know

A significant regulatory shift is reshaping how employers can design consumer-directed health strategies. Starting January 1 of this year, employees were able to enroll in Direct Primary Care (DPC) arrangements alongside a High Deductible Health Plan (HDHP) and still maintain Health Savings Account (HSA) eligibility—provided specific IRS criteria are met. (more…)

Lessons for Employer-Sponsored Health Plans After Ransomware Settlement

Lessons for Employer-Sponsored Health Plans After Ransomware Settlement

On April 23, 2026, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a notable HIPAA enforcement action against a self-funded employer-sponsored group health plan following a ransomware attack that compromised electronic protected health information (ePHI). The settlement required the plan’s sponsor to pay $245,000 and adopt a two-year corrective action plan (CAP). Although OCR frequently enforces HIPAA against healthcare providers and insurers, actions directly targeting employer-sponsored group health plans are relatively uncommon, underscoring the significance of this case for plan sponsors. (more…)