From Mailroom to Inbox: Five Things Plan Sponsors Should Know About the Proposed Electronic Disclosure Safe Harbor for Group Health Plans

By Allison B. Bans and Libby M. Brown

On July 23, 2026, the Department of Labor (DOL) published a Proposed Rule establishing a new safe harbor that would permit group health plan administrators to furnish documents required by the Employee Retirement Income Security Act of 1974, as amended (ERISA), electronically. The Proposed Rule extends to group health plans the “notice-and-access” model, previously available only to pension benefit plans under a 2020 safe harbor, with several important modifications.

If finalized, the Proposed Rule would permit electronic delivery by default, potentially saving group health plans significant money each year in printing and mailing costs. Below are five key takeaways for plan sponsors.

1. The Proposed Rule Would Provide an Optional Alternative to DOL’s 2002 e-Delivery Safe Harbor.

The Proposed Rule offers an alternative to the 2002 electronic delivery safe harbor, which restricts electronic delivery to participants who are “wired at work” or who affirmatively consent. The new safe harbor is optional; plan administrators may continue to rely on the 2002 safe harbor or use traditional paper delivery.

Under the Proposed Rule’s “notice-and-access” model, a plan administrator may deliver “covered documents” to “covered individuals” by furnishing a Notice of Internet Availability (NOIA) and posting the covered documents on a secure website.

A “covered individual” includes any participant, beneficiary, or other person entitled to receive disclosures who provides an electronic address, such as an email address or smartphone number. Notably, an employer-assigned electronic address used for employment-related purposes also qualifies. Dependent children who are beneficiaries, have attained age 18, and have provided an electronic address are also eligible.

A “covered document” includes any document or information that the plan administrator must furnish to participants and beneficiaries under Title I of ERISA, including summary plan descriptions (SPDs), summaries of material modifications (SMMs), COBRA notices, and summaries of benefits and coverage (SBCs), among others. Unlike the 2020 pension safe harbor, the Proposed Rule does not exempt documents that must be furnished only upon request; all documents required under Title I are eligible for electronic delivery.

Before relying on the new safe harbor, a plan administrator generally must provide an initial paper notification describing the default electronic delivery method and the individual’s opt-out rights. For covered individuals already receiving electronic disclosures under the 2002 safe harbor, the initial notification may be sent electronically.

2. The Proposed Rule Would Establish Detailed Content Requirements for the NOIA.

The Proposed Rule prescribes detailed NOIA content requirements. The NOIA generally must be furnished separately from other documents, except where the Proposed Rule permits a combined NOIA, as discussed below.

Each NOIA must contain a prominent statement, suitable for use as a title, legend, or subject line, reading: “Disclosure About Your Health Plan.” It must also include the statement: “Important information about your health plan is now available. Please review this information.”

The NOIA must identify each covered document by name and provide a brief description if the document’s name alone would not reasonably convey its nature. It must also include the internet website address or hyperlink where the covered document is available.

The NOIA must inform the covered individual of the right to request and obtain a paper version of the covered document free of charge and separately state the right to opt out of electronic delivery entirely, also free of charge. A cautionary statement must advise that the covered document is not required to remain available on the website for more than one year or, if later, until superseded by a subsequent version.

Finally, the NOIA must provide a telephone number for contacting the plan administrator or a designated representative. The NOIA may indicate whether action by the covered individual is invited or required, provided the statement is not inaccurate or misleading.

3. The Proposed Rule Would Specify the Standards for the Internet Website.

Plan administrators must maintain an internet website where covered individuals can access covered documents. For this purpose, a “website” includes an internet website, mobile application, or other electronic-based information repository to which covered individuals have reasonable access. To ensure compliance with the reasonable access standard, the website must also be accessible to covered individuals outside the workplace (e.g., former employees or beneficiaries entitled to receive disclosures).

The plan administrator is responsible for establishing and maintaining the website but may delegate website-related activities to service providers, subject to the fiduciary obligations imposed by Section 404 of ERISA.

Covered documents must be available on the website no later than the date they are required to be furnished under ERISA and must remain accessible for at least one year or until superseded by a subsequent version, whichever is later.

Documents must be presented in a widely available format suitable for both reading online and printing on paper. They must be electronically searchable and retainable in an electronic format that a covered individual can keep for personal records. The plan administrator must take measures reasonably calculated to protect the confidentiality of personal information on the website.

4. The Proposed Rule Would Permit Combined NOIAs but Prohibit Email-Only Delivery.

The Proposed Rule permits a plan administrator to furnish a single annual NOIA incorporating the content required for one or more of the following:

Unlike the 2020 pension safe harbor, the Proposed Rule does not permit group health plans to use email-only delivery. The DOL expressed particular concern that protected health information (PHI) transmitted through employer-assigned email addresses could be subject to employer monitoring, potentially compromising employee privacy.

For this reason, plan administrators must direct covered individuals to a secure website rather than attaching documents containing PHI directly to an email. The Proposed Rule also reminds plans that compliance with this safe harbor does not establish compliance with HIPAA, applicable state privacy laws, or other applicable federal or state laws.

5. The Proposed Rule Would Protect Paper Delivery Rights and Participant Preferences

Covered individuals may request and receive paper copies of any covered document free of charge at any time. Unlike the 2020 pension safe harbor, the Proposed Rule does not limit the number of free paper copies available for each covered document. Covered individuals may also opt out of electronic delivery entirely and receive all covered documents in paper form.

Plans must establish and maintain reasonable procedures for processing these requests. Procedures that unduly inhibit or delay the exercise of these rights are prohibited.

The Proposed Rule also addresses situations in which an electronic address becomes invalid or inoperable. For example, if a NOIA is returned as undeliverable, the plan administrator must either cure the problem or treat the individual as having opted out of electronic delivery and promptly provide paper copies.

If finalized, the notice-and-access safe harbor would become available on the first day of the first calendar year following publication of the final rule. Plan sponsors should evaluate their current disclosure practices and consider whether and how to transition to the notice-and-access model.