Division VI · Corrections, Audits, and Disputes

Part 24. Benefits Cybersecurity and Data Incidents

This Part covers benefit-plan cybersecurity and data incidents across retirement and health and welfare plans: DOL/EBSA's cybersecurity guidance (the April 2021 Best Practices / Tips for Hiring a Service Provider / Online Security Tips package, confirmed by Compliance Assistance Release No. 2024-01 (Sept. 6, 2024) to apply to all ERISA plans including health and welfare plans) and its sub-regulatory authority level; cybersecurity fiduciary process and committee governance; service-provider cyber diligence, SOC 2 review, and contract allocation of security obligations and loss; fraudulent distributions and account takeover (theories, the district-court case law, and who bears the loss); loss allocation, recordkeeper customer guarantees, and restorative payments under Rev. Rul. 2002-45; plan incident response; the notification analysis (no ERISA breach-notification rule; state law including A.R.S. §18-552; HIPAA for health plans); participant-data use and monetization; and the fidelity bond / fiduciary liability / cyber / crime insurance stack.

Chapters

Also in this Part

• Issues to watchSubscribers
• Practice toolsSubscribers
• Authorities cited in this PartSubscribers

Related Parts

• Part 3. Fiduciary Duties and Prohibited Transactions — for §404 prudence and loyalty, the Tibble duty to monitor, §405 co-fiduciary liability, §410 insurance structures, the §412 bond, and VFCP
• Part 13. COBRA, HIPAA, and Welfare Benefits — for the HIPAA Security Rule risk analysis, breach notification and the four-factor assessment, BAAs, and the plan-sponsor firewall
• Part 22. Government Audits and Investigations — for the EBSA investigation process behind a cybersecurity document request, and the HHS OCR investigation process on a health-plan incident
• Part 23. ERISA Disputes, Enforcement, Preemption, and Remedies — for litigation holds and preservation, the fiduciary exception to privilege, and litigation posture (strategy reserved for litigation counsel)
• Part 21. Plan Corrections: EPCRS, VFCP, and DFVCP — for VFCP correction of a fiduciary breach identified in an incident
• Part 4. Reporting, Disclosure, Recordkeeping, and Claims — for §503 claims procedure on a participant restoration demand, electronic disclosure, and §107/§209 recordkeeping
• Part 6. Distributions, Loans, Rollovers, and RMDs — for the underlying distribution and rollover mechanics behind a fraudulent distribution
• Part 15. Health Plan Parity, CAA, and Transparency — for health-plan vendor fee and data arrangements