← Back to Playbook

OPS-SOP-023 — Participating Employer Compliance Checklist
(ACA, HIPAA, COBRA, NSA)

Document IDOPS-SOP-023 Version1.0 Effective Date[TBD — upon adoption] Next ReviewAnnually OwnerCompliance / Operations
Prepared ByOperations

1. Purpose

This SOP defines the compliance checklist that each participating employer must complete before their plan effective date (go-live) and the ongoing compliance obligations they must maintain annually as a participating employer in the Unity Care Member Plan Master Trust. Completion of this checklist is a condition of participation.

2. Scope

Applies to all new and existing participating employer groups. Each employer is the ERISA Plan Administrator for its own employees. This checklist covers ACA, HIPAA, COBRA, No Surprises Act (NSA), and related federal notice requirements. Operations coordinates completion; employers and their HR representatives are responsible for execution.

3. Roles & Responsibilities

Role Responsibility
Operations Issue checklist to new employers; track completion; block go-live until all items confirmed; maintain employer compliance files.
Compliance Advise on regulatory requirements; confirm BAA list completeness; confirm annual filing status.
Employer HR / Plan Administrator Complete all checklist items; provide documentation confirming completion; distribute required notices to employees.
COBRA Administrator (Varipro) Confirm COBRA setup for each new employer group upon notification from Operations.
Legal Counsel (Dickinson Wright PLLC) Available for employer escalations on ACA status determination, MHPAEA analysis, or NSA obligations.

4. New Employer Onboarding Compliance Checklist

Go-Live Hold: No employer group may be activated on the plan until all items in Section 4 are marked COMPLETE. Operations will not submit enrollment files to Allied until this checklist is signed off.
Compliance Item Owner Required By Status / Notes
ACA — ALE Status Determination
Employer determines whether it is an Applicable Large Employer (50+ FTEs, including FTE equivalents). ALE status determines ACA employer mandate obligations (Form 1094-C / 1095-C). If not ALE, document the determination. If ALE, confirm ACA reporting vendor in place.
Employer HR / Benefits Consultant Before go-live ___________
HIPAA — Privacy Notice Distributed
HIPAA Notice of Privacy Practices (NPP) distributed to all employees at enrollment. Employer retains proof of distribution. NPP must identify the plan's privacy contact and describe employee rights under HIPAA.
Employer HR At enrollment ___________
COBRA — Varipro Setup Complete
Operations notifies Varipro of new employer group. Varipro confirms employer is registered, COBRA premium schedules are set, and qualifying event notification procedures are established. General COBRA notice must be distributed to newly covered employees and spouses within 90 days of coverage start.
Operations / Varipro Before go-live; General Notice within 90 days ___________
NSA — Patient Protection Notice Posted
No Surprises Act patient protection notice (balance billing protections) posted on employer's plan website or in SPD. Confirms employees' right to a cost estimate and protection from surprise bills.
Employer HR / Operations Before go-live ___________
ACA — Exchange / Marketplace Notice at Hire
Written notice of Health Insurance Marketplace coverage options provided to all new hires within 14 days of hire date (FLSA §18B requirement). Employer uses DOL model notice.
Employer HR Within 14 days of each hire ___________
CHIP Notice — State Children's Health Insurance Program
Annual CHIP notice provided to employees describing premium assistance programs available in the employer's state. Distribute at enrollment and annually thereafter.
Employer HR At enrollment; annually ___________
WHCRA Notice — Women's Health and Cancer Rights Act
Annual notice of rights under WHCRA (mastectomy reconstructive benefits) provided to plan participants. Must be included in or distributed with the SPD and annually thereafter.
Employer HR / Operations (via SPD) At enrollment; annually ___________
BAA List — Business Associate Agreements Complete
Compliance confirms that all vendors handling PHI on behalf of the plan have an executed BAA on file (Allied Benefit Systems, ProAct, HealthEquity, Varipro, Gradient AI, and any employer-level vendors with PHI access). No PHI may be shared with a vendor absent a BAA.
Compliance / Operations Before go-live ___________
SPD / SBC Distributed to All Enrollees
Employer confirms SPD and SBC have been distributed to all enrolled employees per OPS-SOP-022 requirements.
Employer HR Within 90 days of plan start ___________
Enrollment Data Submitted to Allied
Complete and accurate enrollment data submitted to Allied Benefit Systems. Operations confirms Allied enrollment reflects the employer's census.
Operations / Allied Before go-live ___________

5. Ongoing Annual Compliance Checklist

Each participating employer must maintain the following compliance items on an ongoing and annual basis. Operations tracks these items through the compliance calendar (OPS-SOP-021).

Compliance Item Owner Frequency / Deadline Status / Notes
ACA Reporting — Forms 1094-C / 1095-C (ALEs only)
ALE employers file Forms 1094-C and 1095-C with IRS and distribute 1095-C to employees. Operations confirms employer has ACA reporting vendor in place. Tracked in compliance calendar.
Employer / ACA Reporting Vendor March 31 (IRS filing); January 31 (employee copies) ___________
Annual Compliance Calendar Items Tracked
All employer-level compliance deadlines (CHIP notice, WHCRA notice, HIPAA NPP renewal, NSA notice review) are entered in the compliance calendar. Operations confirms with employer HR annually.
Compliance / Operations Annually (plan year start) ___________
Broker Compensation Disclosure Received
Broker/consultant compensation disclosure (CAA §202, ERISA §408(b)(2)) received from each broker or consultant receiving $1,000+ in compensation. Operations retains on file. Plan fiduciaries must review for reasonableness.
Operations / Broker Annually; within 60 days of contract execution or renewal ___________
Gag Clause Attestation — Confirmed and Filed
Annual gag clause prohibition compliance attestation submitted to CMS confirming the plan has no contracts that prevent sharing cost, quality, or claims data. Due December 31 annually.
Operations / Compliance December 31 annually ___________
MHPAEA Comparative Analysis on File
Non-Quantitative Treatment Limitations (NQTL) comparative analysis completed for the plan year, documenting that mental health / substance use disorder benefits are not more restrictive than medical / surgical equivalents. Available upon request by participants or regulators.
Operations / Legal Counsel / Allied Annually; updated on plan design change ___________
HIPAA Privacy Notice — Annual Review
HIPAA NPP reviewed and updated as needed. If revised, redistributed to all plan participants. No revision needed: document review date on file.
Compliance / Employer HR Annually ___________
CHIP Notice — Annual Distribution
CHIP premium assistance notice redistributed to all employees annually.
Employer HR Annually ___________
BAA List — Annual Review
Compliance reviews the BAA list for all active plan vendors. Confirms executed BAAs are current and cover all data flows. Any new vendor with PHI access added to the list before data sharing begins.
Compliance Annually ___________

6. Checklist Completion & Documentation

Operations maintains a completed, signed copy of the onboarding checklist for each employer in the employer compliance file. The employer HR contact or Plan Administrator must sign the completed checklist confirming all items are satisfied before go-live approval is granted.

File Retention: Completed checklists and supporting documentation must be retained for a minimum of 6 years. Checklists are stored in the employer's compliance folder in the document management system.

7. Related Documents