As we head toward the end of 2024, we would like to point out a few year-end items for retirement plan sponsors and health plan sponsors that require action before the end of the year.

Safe Harbor Notices

2025 safe harbor notices are generally due to be provided to retirement plan participants no later than December 2, 2024 (for calendar year plans). After the SECURE Act, safe harbor notices are still required for safe harbor plans with safe harbor matching contributions and are generally no longer required for safe harbor plans with non-elective safe harbor contributions with some exceptions. “Maybe” safe harbor plans that utilize a “supplemental” safe harbor non-elective contribution notice are still required to provide the applicable safe harbor notice. Safe harbor plans with non-elective safe harbor contributions that also provide for additional discretionary matching contributions intended to satisfy the ACP safe harbor requirements are still required to provide a safe harbor notice. Please note that under a “maybe” safe harbor non-elective contribution plan, the supplemental safe harbor notice informing participants that the plan sponsor has decided to make the safe harbor non-elective contribution for the 2024 plan year is required to be provided to participants no later than December 1, 2024 (for a calendar year plan).

SECURE 2.0 Act New Plan Automatic Enrollment Requirements Begin January 1, 2025

Under the SECURE 2.0 Act, 401(k) and 403(b) plans established on or after December 29, 2022, must provide for automatic enrollment beginning with the 2025 plan year (January 1, 2025 for calendar year plans), with certain exceptions. The initial automatic enrollment rate must be at least 3%, and no more than 10%, of compensation. These plans must also provide for an automatic escalation of 1% to be applied to an automatically enrolled participant's deferral rate each year up to a total deferral rate of at least 10%, but no more than 15%. The automatic enrollment feature must be set up as an eligible automatic contribution arrangement (EACA) and permit participants who are automatically enrolled to elect to have their automatic deferral contributions distributed from the plan to them within 90 days of the first automatic deferral.

Generally, retirement plans in existence prior to December 29, 2022, and plans that are spun off from such plans, are exempt from the new automatic enrollment and escalation requirement. In addition, there are certain exemptions from the requirement for employers that have been in existence less than 3 years or that have fewer than 10 employees and for church plans and governmental plans. However, employers that adopt an existing multiple employer plan after January 29, 2022, generally are not exempt from the requirements.

Compliance with the HIPAA Privacy Rule to Support Reproductive Health Care Privacy

Earlier this year, the U.S. Department of Health and Human Services (“HHS”) issued the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Final Rule”). The Final Rule strengthens HIPAA by prohibiting the disclosure of protected health information (“PHI”) related to lawful reproductive health care in certain circumstances. Health plans and their providers must comply with most of the new requirements under the Final Rule by December 23, 2024. Generally, the Final Rule:

1. Prohibits the use or disclosure of PHI when it is sought to investigate or impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided, or to identify persons for such activities.
2. Requires a regulated health care provider, health plan, clearinghouse, or their business associates, to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not for these prohibited purposes.
3. Requires regulated health care providers, health plans, and clearinghouses to modify their Notice of Privacy Practices to support reproductive health care privacy. Note – The deadline for updating Notices of Privacy Practices for the Final Rule is February 16, 2026.

The summary above is a very broad description of the ramifications of the Final Rule. Heath plan sponsors and providers should review the Final Rule in detail and have a plan for complying with the Final Rule by December 23, 2024. Actions that may need to be taken by plan sponsors and providers to comply with the Final Rule include:

1. Updating, as appropriate, HIPAA policies and procedures, privacy notices, plan documents and communications, and business associate agreements
2. Preparation of a new separate attestation document (model attestation from HHS is available)
3. Identification and tracking of PHI related to reproductive health
4. . Workforce training