Cybersecurity and ERISA

/in

MZQ Logo

Prefer to listen instead of read? No problem! Listen to the blog post at any time by clicking here.

 

On September 6th, 2024, the Department of Labor (DOL) issued a press release reminding ERISA plan fiduciaries that it considers cybersecurity to be an area of “great concern.” Due to a rash of cybersecurity incidents, the DOL has increased its investigations of violations in this area. The DOL also published updated cybersecurity guidance that builds on documents the Department released in 2021. Most importantly, these new publications clarify that the DOL’s cybersecurity guidelines apply to all types of ERISA plans, including health and welfare plans.

Overview of 2021 DOL Cybersecurity guidance 

The guidance the DOL released in 2021 consists of three documents: 

  • Cybersecurity Program Best Practices, which includes a detailed set of twelve best practices that organizations should adopt to mitigate cybersecurity risks; 
  • Tips for Hiring a Service Provider with Strong Cybersecurity Practices, which offers six tips to help organizations select service providers with strong cybersecurity practices; and 
  • Online Security Tips, which lists nine online security tips to help individuals protect their accounts against fraud and loss. 

Clarification and notable enhancements in 2024 guidance 

Some service providers interpreted that this guidance only applied to retirement plans, prompting the DOL to affirm in the 2024 iteration of their guidance that the cybersecurity recommendations apply to all plans subject to ERISA. Aside from new language to this effect, the 2024 versions of the documents listed above remain largely the same. One notable enhancement is the inclusion of additional language specifying that plan sponsors should ensure their vendors’ insurance covers cybersecurity breaches and incidents involving the plan. The updated guidance now also reflects specific multifactor authentication process recommendations, a participant notification requirement if a cybersecurity breach occurs, and a list of additional cybersecurity resources. 

Given the DOL’s clarification that their cybersecurity guidelines apply to all plans subject to ERISA and that they find this topic to be of great concern, we would encourage employers as plan sponsors to audit their existing cybersecurity protocols for any plan data that is stored or accessed internally against these updated requirements and recommendations and to take reasonable steps to address any gaps. In addition, the employer should confirm that their vendors/service providers are separately implementing these requirements for any plan data they handle. Doing so will help employers fulfill their fiduciary duties towards participants, highlight potential areas of improvement, and reaffirm which of their cybersecurity practices are already in alignment with DOL guidance. 

HIPAA’s role in cybersecurity compliance 

Of note, while HIPAA privacy and security compliance efforts for group health plans may not address all ERISA plans sponsored by an employer, they will provide a meaningful framework to apply to any plans that fall outside HIPAA’s scope. Employers that have not yet addressed HIPAA’s privacy and security requirements, including developing written policies and procedures and conducting a HIPAA security risk analysis, may want to prioritize this in light of the updated cybersecurity guidance. 

Read more

DEI Done Right: How Balance and Kindness Lead to Lasting Inclusion

/in

Prefer to listen instead of read? No problem! Listen to the blog post at any time by clicking here. 

 

Diversity, Equity, and Inclusion (DEI) initiatives have become a major focus for organizations seeking to create more inclusive and equitable workplaces.

While some companies, like Salesforce and PayPal, have embraced efforts to drive positive change, others, like Tractor Supply and John Deere, are backing away from DEI altogether. In contrast, companies like Meta, Google, and Microsoft have quietly dialed back their DEI efforts. Microsoft, for instance, claims its commitment to Diversity and Inclusion (D&I) remains unchanged, yet this ignores the broader concept of Equity.

This raises concerns about the future of workplace culture—and, more broadly, about humanity. Moving away from DEI may signal to others that the company is moving away from kindness, respect, and inclusion. Without these guiding principles, organizations can struggle to connect with team members and balance the needs of diverse groups while maintaining their values and integrity. Read more

Lifestyle Benefit Accounts: A Flexible Benefit for Your Employees

/in

Prefer to listen instead of read? No problem! Listen to the blog post at any time by clicking here. 

 

Offering and providing flexible, customizable employee benefits can enhance employee satisfaction with your benefit plan, and allows employees to tailor their benefits so they can get the most out of your investment—which is great for both them and you. That’s where Lifestyle Spending Accounts (LSAs) come in. LSAs help companies support employee wellness, work-life balance, and job satisfaction. Let’s delve into the whats and whys of LSAs. 

Read more

Pause, Reflect, Succeed: The Key to High-Performing Teams

/in

Prefer to listen instead of read? No problem! Listen to the blog post at any time by clicking here. 

 

In today’s fast-paced work environment, it’s easy for teams to get caught up in the grind, constantly pushing forward without pausing to consider how they’re performing. However, without taking time to reflect, teams can fall into habits that slow growth and prevent them from reaching their full potential. The highest-performing teams don’t just react—they regularly reflect on their actions, decisions, and dynamics.

Self-reflection doesn’t always get the attention it deserves, but it’s a game-changer for teams looking to improve. When teams make space to analyze what’s working and what isn’t, they gain clarity on how to move forward, make sharper decisions, and collaborate with more purpose. Teams that practice self-reflection become more resilient, emotionally intelligent, and aligned with their long-term goals.

Here’s how self-reflection can strengthen your team’s resilience, emotional intelligence, and continuous growth. Read more