ERISA’s Record Retention Requirements for Health and Welfare Benefit Plans
April 1, 2021
Employers often wonder how long they are required to retain certain records relating to their employee health and welfare benefit plans. For plans subject to the Employee Retirement Income Security Act of 1974 (ERISA), these rules are detailed in ERISA §107. To ensure compliance, employers should be aware of the requirements set forth in ERISA §107, including who is responsible for retaining records, timeframes required to keep records, which records need to be retained, and acceptable methods for retaining records.
Record Retention Responsibility
The record retention obligation falls on the plan administrator who is, or who would be, responsible for filing the health and welfare benefit plan’s annual Form 5500 filing. Generally, the plan administrator is the employer who is sponsoring the plan. Notably, plans exempted from the Form 5500 reporting requirements are still required to comply with ERISA §107’s record retention rules. Furthermore, the plan administrator’s recordkeeping responsibilities cannot be delegated, even when contracting with a third party for recordkeeping services.
Types of Records to Retain
ERISA §107 requires maintenance of all records that document the accuracy of information that is included in, or would be included in, the plan’s Form 5500 filing. The records that a plan must retain will vary depending on numerous factors, such as the size and type of plan. Some records that might be required to be maintained include:
- copies of filed Form 5500s;
- summary annual reports (SARs);
- plan documents;
- insurance policies, booklets and certificates;
- third-party service provider contracts;
- summary plan descriptions (SPDs);
- summaries of material modifications (SMMs);
- open enrollment materials;
- summary of benefits and coverage (SBCs);
- required participant disclosures;
- COBRA notices, forms, and premium schedules;
- evidence of nondiscrimination compliance;
- qualified medical child support order procedure and documentation;
- HIPAA materials and correspondence; and
- copies of filed Forms 1094 and 1095 along with substantiating records, if applicable.
This list isn’t meant to be exhaustive and may not apply to each plan, but is a good starting point for recordkeeping compliance. Also, in order to remain compliant with ERISA §107, the actual records must be kept. Summaries of these documents would not suffice for record retention purposes.
Length of Record Retention
Under ERISA §107, records are required to be retained for at least six years after the filing date of the Form 5500 (whether or not the plan was actually required to file a Form 5500). For example, records for a 2020 calendar year plan would need to be kept until July 31, 2027 (i.e., seven years and seven months from the beginning of the plan year). For plans that may need to file an extension for their 5500 filing using Form 5558, the records must be kept from the date of the extension. Therefore, to avoid any mistakes in record retention timeframe requirements, a practical compliance solution for employers is to retain any required records for eight years. This will account for any Form 5500 extensions filed.
Methods of Record Retention
Records can be kept in paper or electronic form. However, employers that maintain their records in electronic form must ensure their electronic recordkeeping system complies with standards imposed by the Department of Labor (DOL). Some of these standards include the necessity that electronic records be easily accessed, inspected and converted into paper copy if requested. If employers keep their records electronically, they should carefully review each document to ensure that the document in electronic form would suffice over the “original” paper copy. Also, employers should consider any HIPAA rules applicable to their documents. If both regulations pertain to the documents, the records should be maintained by the stricter of the two rules.
While there are no statutory penalties related to ERISA’s record retention requirements, there may be potential criminal penalties for any person who willfully violates these requirements. Furthermore, civil actions may be available for any plan participant, beneficiary or plan fiduciary who seeks compliance with ERISA §107 upon any recordkeeping failure or breach of fiduciary duty.
Employer Next Steps
In order to establish compliance with ERISA’s record retention rules, employers should take the following steps:
- Determine which records must be retained according to ERISA §107, along with any other applicable laws, rules or statutes of limitations;
- Implement a hard-copy or electronic recordkeeping system, and if electronic, ensure the system complies with the DOL’s regulations regarding electronic record retention; and
- Keep all required records together in an organized manner to ensure records are able to accessed easily and efficiently.
This Benefits Brief is not intended to be exhaustive, it is for informational purposes only and should not be considered legal or tax advice. A qualified attorney or other appropriate professional should be consulted on all legal compliance matters.