As summarized in our prior article on this topic, individual coverage health reimbursement arrangements (ICHRAs) are gaining popularity and constituting a larger part of the overall employer-provided health coverage market. As service providers, ICHRA vendors are tasked with assisting their employer-clients with the regulatory requirements imposed on the ICHRA plan, as well as focusing on their own compliance responsibilities as a third-party administrator and insurance agency, where applicable. Our last article summarized some of the compliance challenges facing ICHRA vendors; this article constitutes round two. 

• Payroll Deductions for Excess Premium – POP Document. If an ICHRA allowance does not cover the entire individual health plan premium, the ICHRA vendor may assist the employer with facilitating employee payroll deductions to pay for the excess premium. This can generally be done on a pre-tax basis if the individual health plan is purchased outside of the government Exchange (off-Exchange) and the employer maintains what is known as a “cafeteria plan” or “premium only plan” (POP) written document. While technically the obligation of the employer, ICHRA vendors may assist in the creation of a template POP document. 
• HIPAA Privacy and Security Requirements. An ICHRA plan is a “covered entity” under HIPAA. As a service provider to the ICHRA Plan, an ICHRA vendor will generally be acting as a “business associate” under HIPAA and must meet specific compliance obligations. These include, but are not limited to, entering into HIPAA business associate agreements with downstream contractors who access protected health information and helping to mitigate any breach of protected health information.
• Insurance Agency Licensing Issues. If an ICHRA vendor is helping with the placement of or enrollment in the individual insurance policies for which employees are reimbursed through the ICHRA plan, the ICHRA vendor likely needs to be licensed as an insurance agency or brokerage. Recently, Centers for Medicare & Medicaid Services (CMS) and state regulators have been taking the position that wherever the enrollment activity is performed a license is needed, even if enrollment is occurring remotely.
• Carrier Appointment. Once a licensed insurance agency, an ICHRA vendor commonly needs to be appointed by a carrier to use the carrier’s online portals, assist individuals in completing enrollment forms, receive commissions, and use direct pay options.
• Enrollee Consent for Plan Selection. A current CMS enforcement priority is addressing enrollment in individual health plans by “rogue insurance agents” without the permission of the policyholder. ICHRA vendors may want to consider addressing their enrollment activities in any agreements, terms of use or similar documents that the employee is required to consent to or sign as part of the ICHRA enrollment process. 
• Medicare Part D Notice. Medicare Part D reporting and the Medicare Part D creditable coverage notice obligation apply to health reimbursement arrangements (HRAs). While the Part D notice does not smoothly apply to the ICHRA concept, employers sponsoring ICHRA plans are technically required to report to CMS and provide a notice to participants in the same manner as if they were sponsoring a traditional group medical plan.
• Electronic Communications to ICHRA Members. If the ICHRA plan sponsor is subject to ERISA, most notices and communications related to the ICHRA plan will be subject to ERISA’s electronic distribution rules (though a few notices like HIPAA notices are subject to their own rules). At a high level, the ERISA electronic distribution rules have a safe harbor that allows the plan sponsor to send documents electronically if the employee has workplace access to a computer and accessing the computer system is an essential part of their job duties, and if certain content and other requirements are met. If an employee does not have workplace access to a computer, then an employer needs consent from the employee to send documents electronically to meet the safe harbor. Outside of the safe harbor, the employer must be able to show that they have shared the notices and communications in a manner reasonably calculated to lead to actual receipt.
• Independent Contractors, PEOs & Multiple Employer Groups. On a high level, an ICHRA plan should cover just a single employer’s employees but can also cover employees of any subsidiaries or affiliates of that employer. Generally, one ICHRA plan cannot cover employees from unrelated employers. Setting up an ICHRA as a multiple employer welfare arrangement (MEWA) triggers significant regulatory scrutiny. This poses issues with special situations such as professional employer organizations (PEOs), staffing firms, independent contractors, associations, and companies who do not have sufficient shared ownership, although certain strategies can be leveraged to try to achieve the same goal of economies of scale. 
• Family Glitch & ICHRAs. In 2022, the IRS issued guidance aimed at fixing what was known as the “family glitch.” This 2022 rule generally eliminated the previous rule that looked solely at the cost of employee only coverage to determine if a family member could qualify for a premium subsidy on the federal Exchange. The 2022 rule looks at the cost of family coverage in this scenario. However, this new rule does not address ICHRAs and did not adjust how ICHRA affordability is calculated. If dependents are allowed to participate and their expenses are reimbursable under the ICHRA, the affordability determination is still based solely on the employee only cost.
• Flex Cards & HRAs. While the industry commonly associates “flex cards” as being used with health care flexible spending accounts, IRS guidance allows flex cards to be used for health reimbursement arrangements. The ICHRA world may be moving eventually towards use of flex cards. Before getting into the flex card world, ICHRA vendors should familiarize themselves with substantiation and auto substantiation guidance for flex cards and should perform due diligence on any FinTech or PayFac responsibilities they might have.