Self-Funded Health Plan Fiduciary Duties: What the CAA Requires of Mid-Market Employers

When a mid-market employer moves from a fully insured health plan to a self-funded one, it gains control over claims dollars and plan design. It also takes on a legal role most plan sponsors do not fully recognize: it becomes a fiduciary under federal law, personally responsible for running the plan in the sole interest of its employees. The Consolidated Appropriations Act of 2021 sharpened that responsibility and added concrete duties with hard deadlines.

This guide explains what fiduciary status means for a self-funded health plan, the specific obligations the CAA layered on top, the litigation trend that has made these duties more than theoretical, and the practical governance steps a 50 to 250 employee employer can put in place to manage the risk.

Why Self-Funding Creates Fiduciary Status

In a fully insured arrangement, the carrier bears the claims risk and handles most of the plan administration. The employer pays a premium and has comparatively limited discretionary control over plan assets. When an employer self-funds, it pays claims out of its own funds, often through a third-party administrator, and it makes the discretionary decisions about how the plan is run. That discretion is what triggers fiduciary status under the Employee Retirement Income Security Act.

ERISA defines a fiduciary functionally. Anyone who exercises discretionary authority over plan management, plan administration, or plan assets is a fiduciary regardless of title. For most self-funded mid-market plans, the named fiduciary is the plan sponsor, which is the company itself, and the people who make plan decisions act on its behalf. Hiring a third-party administrator does not transfer the core fiduciary responsibility. The administrator handles claims processing, but the duty to select and monitor that administrator, and to ensure the plan pays only reasonable fees, stays with the employer.

The Four Core Duties

ERISA fiduciary duties come down to a short, demanding list. The duty of loyalty requires acting solely in the interest of participants and beneficiaries, not in the interest of the company or any vendor. The duty of prudence requires acting with the care, skill, and diligence of a knowledgeable expert, which in practice means making informed decisions and documenting the basis for them. The duty to follow plan documents requires administering the plan according to its written terms. And the duty to pay only reasonable expenses requires that every dollar of plan money spent on administration, networks, and pharmacy management be justified as reasonable for the services received.

That last duty is the one the CAA and recent litigation have brought to the foreground. For years, health plan sponsors paid administrative and pharmacy fees without the visibility to judge whether those fees were reasonable. The CAA changed the information environment, and with better information comes a higher expectation that the employer will act on it.

What the CAA Added

The Consolidated Appropriations Act of 2021 included a set of group health plan transparency and oversight provisions that took effect over the following years. Several of them create direct, recurring obligations for self-funded plan sponsors.

The Gag Clause Prohibition and Annual Attestation

The CAA prohibits contracts between a plan and a provider, network, or administrator from containing gag clauses that would restrict the plan's access to its own cost and quality data. A gag clause is any provision that prevents the plan from seeing provider-specific price or quality information, or from sharing de-identified claims data with a business associate. Plans must confirm their contracts are free of these clauses and file an annual Gag Clause Prohibition Compliance Attestation. The attestation is due by December 31 each year and is submitted through the federal portal. Missing it is a visible, dated compliance failure, which makes it one of the first items a benefits review checks.

Compensation Disclosure for Brokers and Consultants

The CAA extended to group health plans a compensation disclosure rule that retirement plans had lived under for years. Service providers who reasonably expect to receive 1,000 dollars or more in connection with the plan must disclose their direct and indirect compensation to the plan fiduciary before the contract is entered or renewed. Indirect compensation includes amounts a broker or consultant receives from sources other than the employer, such as override payments tied to placing business with a particular vendor.

This disclosure is not paperwork for its own sake. It gives the fiduciary the raw material to evaluate whether the people advising the plan have conflicts and whether the total compensation is reasonable for the services delivered. A fiduciary that receives these disclosures and files them away without review has arguably not discharged the duty. The point is to read them, ask questions, and document the conclusion.

Mental Health Parity Analysis and Drug Data Reporting

Two further CAA obligations round out the picture. The first is the comparative analysis requirement under the mental health parity rules. A plan must be able to produce a written analysis showing that its non-quantitative treatment limitations, such as prior authorization or network admission standards, are applied no more stringently to mental health and substance use disorder benefits than to medical and surgical benefits. Regulators can request this analysis, and the plan sponsor is responsible for having it.

The second is prescription drug data collection reporting, an annual submission of plan-level data on drug spending, premiums, and the rebates flowing back from drug manufacturers. The reporting is generally due each June. While administrators often assist with the filing, the obligation rests with the plan, and the data it surfaces is exactly the kind of information a prudent fiduciary should be reviewing as part of managing pharmacy cost.

The Litigation Trend That Changed the Stakes

For most of ERISA's history, fee litigation focused on retirement plans. Employees argued that plan sponsors breached their duty by allowing recordkeepers and investment managers to charge excessive fees, and a long line of cases established that fiduciaries must monitor and benchmark those fees. That body of law is now being applied to health plans.

A wave of recent lawsuits has alleged that self-funded plan sponsors breached their fiduciary duty by failing to control the cost of prescription drugs and administrative services, pointing to plans that paid many times the market price for common medications. Whether or not any individual case succeeds, the trend is the warning. The legal theory is straightforward: the same duty of prudence that requires monitoring retirement plan fees requires monitoring health plan fees, and the CAA disclosures removed the excuse that the data was unavailable.

The practical consequence is that documentation matters more than ever. A plan sponsor that can show it reviewed compensation disclosures, benchmarked its administrative and pharmacy arrangements, and made decisions based on that review is in a defensible position. A sponsor that cannot show any of that is exposed, even if its costs happen to be reasonable, because the duty is about process as much as outcome.

Building a Defensible Governance Process

The good news is that managing fiduciary risk does not require a large staff or a legal department. It requires a process that a mid-market employer can run with discipline and document along the way.

Form a Benefits Committee

The first step is to name who is responsible. A small benefits committee, often the finance lead, a human resources lead, and an executive sponsor, gives the plan a clear set of decision-makers and a forum for documented decisions. The committee should meet on a regular cadence, keep minutes, and treat plan oversight as a recurring governance function rather than an annual scramble at renewal.

Benchmark and Document

The committee's core work is to review the plan's costs and confirm they are reasonable. That means reading the compensation disclosures from brokers and consultants, benchmarking administrative and pharmacy fees against the market, periodically testing the market through a request for proposals, and recording the rationale for each major decision. The written record is what demonstrates prudence. A decision to retain an existing administrator is perfectly defensible if there is documentation showing the committee considered alternatives and concluded the arrangement was reasonable.

Meet the Hard Deadlines

Some obligations are simply calendar items that must not slip. The gag clause attestation is due by December 31. The drug data reporting is due in the spring. The plan's Form 5500, where required, has its own filing window. Putting these on a compliance calendar with named owners turns a set of scattered risks into a routine. Each one is straightforward on its own; the failure mode is forgetting, not difficulty.

Common Misconceptions That Create Exposure

Several beliefs lead capable employers into avoidable risk. The first is the assumption that the broker or administrator is the fiduciary. Vendors can agree to take on specific fiduciary roles, and some do, but the default is that the plan sponsor holds the core responsibility. Reading the service agreement to see exactly what each party has and has not agreed to be responsible for is part of the duty, not optional diligence.

The second misconception is that reasonable cost is a defense by itself. ERISA prudence is evaluated on process. A plan can have genuinely competitive fees and still face a credible claim if the sponsor cannot show how it knew the fees were competitive. Conversely, a plan that documents its review, benchmarking, and decision rationale is well positioned even when a competitor later offers a lower price, because the duty is to act prudently with the information available at the time, not to guarantee the lowest possible cost in hindsight.

The third misconception is that small size exempts the plan. The CAA obligations and ERISA fiduciary duties apply to self-funded plans well within the mid-market range. There is no headcount threshold below which the gag clause attestation or the compensation disclosure rules disappear. A 60-employee self-funded plan carries the same core duties as a 600-employee one, scaled to its circumstances.

What Changes for an Employer New to Self-Funding

For an employer moving from fully insured to self-funded for the first time, the fiduciary dimension should be part of the decision, not a surprise discovered afterward. The cost control and design flexibility of self-funding are real, and for many mid-market groups the economics are compelling, particularly when claims are stable and stop-loss coverage caps the downside. The point is to enter with eyes open about the responsibility that comes attached.

In practice, that means standing up the governance process at the same time the plan goes live, rather than bolting it on later. The benefits committee should be named before the first plan year, the compliance calendar should be built before the first deadline, and the compensation disclosures should be requested and reviewed as part of selecting the initial administrator and advisors. An employer that builds the oversight structure from day one rarely has to play catch-up, and it carries a clean documentation trail from the start.

The stop-loss decision deserves particular attention in this context, because it is both a financial control and a fiduciary one. Selecting appropriate specific and aggregate thresholds protects the plan's assets, which is squarely within the duty to act prudently. Documenting why the chosen attachment points fit the group's risk profile is part of the same record that demonstrates the plan was managed with care.

Related Reading

For additional context on this topic, explore these related Benefitra articles:

• Stop-Loss Insurance for Self-Funded Health Plans: Specific and Aggregate Coverage Thresholds Explained
• Pharmacy Benefit Manager Transparency: What Mid-Market Employers Should Demand From Their Drug Plan
• Form 5500 Filing for Employer Health and Welfare Plans
• Minimum Group Size for Self-Funded and Level-Funded Health Plans

Frequently Asked Questions

Are we a fiduciary if a third-party administrator handles our claims?

Yes. Hiring an administrator to process claims does not transfer the core fiduciary responsibility. The administrator performs a service, but the plan sponsor retains the duty to prudently select and monitor that administrator and to ensure the plan pays only reasonable fees. The discretionary control that defines fiduciary status stays with the employer.

What is the gag clause attestation and when is it due?

It is an annual confirmation that the plan's contracts with administrators, networks, and providers do not contain clauses restricting the plan's access to its own cost and quality data. It is filed through the federal portal and is due by December 31 each year. Because it is dated and visible, a missed attestation is one of the clearest compliance gaps a review will find.

Does fiduciary status apply to a level-funded plan?

It can. The analysis turns on how much discretionary control the employer exercises over the plan and its assets, not on the label of the funding arrangement. Many level-funded structures involve enough sponsor discretion to create fiduciary obligations, so an employer should treat the governance steps in this article as relevant unless counsel advises otherwise for its specific structure.

What does the broker compensation disclosure actually require?

Service providers expecting 1,000 dollars or more must tell the plan fiduciary, in writing and before the contract is signed or renewed, what direct and indirect compensation they expect to receive. The fiduciary's job is to review that disclosure, evaluate any conflicts, and judge whether the total compensation is reasonable for the services. Receiving the disclosure and never reading it does not satisfy the duty.

How often should the benefits committee meet and review fees?

A practical cadence for most mid-market plans is quarterly, with at least one meeting tied to the renewal cycle where the committee reviews administrative and pharmacy costs in depth. The frequency matters less than the consistency and the record. Regular meetings with minutes that capture what was reviewed and why decisions were made create the documented, ongoing process that the duty of prudence is built around. Benchmarking fees against the market every year or two, and testing the market through a request for proposals periodically, keeps the review grounded rather than routine.

How do we limit our fiduciary liability?

Through process and documentation. Form a benefits committee, meet on a regular cadence, review the compensation disclosures, benchmark fees, test the market periodically, and keep written records of the reasoning behind decisions. Prudence under ERISA is judged largely on process, so a documented, consistent governance routine is the strongest protection available to a mid-market plan sponsor.