Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Home - Warner Norcross + Judd LLP

Since the mid-2000s, self-insured health plans have been subject to HIPAA security rules. These rules generally require a plan sponsor to protect data about those enrolled in its self-insured health plans, and when hiring a third-party administrator or other vendor who works with enrollee data, include provisions in the contracts governing the security of health plan enrollee data. But outside of the HIPAA context, it’s been unclear whether there’s a similar duty under ERISA.

contentpilot/introduction

The Department of Labor (DOL) recently issued guidance aimed to provide best cybersecurity practices for plan sponsors, plan fiduciaries, record keepers and plan participants with respect to retirement plans. The guidance comes in three parts: (1) tips for hiring a service provider; (2) cybersecurity program best practices; and (3) online security tips. Because retirement plans hold a significant amount of money and maintain personal participant information, retirement plans are often a desirable target for cybercriminals. Due to the wealth of money and information that retirement plans hold, the DOL states that plan fiduciaries have an obligation to ensure that proper cybersecurity precautions are in place.

core/paragraph

Tips for Hiring a Service Provider

core/heading

The DOL lists the following items for plan sponsors and fiduciaries to evaluate when selecting plan service providers and monitoring the performance of the selected provider: 

core/list

This guidance requires active vendor management on security issues, and a plan sponsor should involve its information security department in that process. The plan sponsor should also develop (with input from its information security department) contractual language for protection of plan participant data.

Cybersecurity Program Best Practices

With retirement plans being such a desirable cybersecurity target, the DOL provides the following list of best practices for responsible plan fiduciaries to follow to ensure the proper mitigation of cybersecurity risks: 

A plan sponsor may already have many of these practices in place, but may not have applied them to retirement plans. Thus, a plan sponsor should review its current cybersecurity policies and procedures to see if they need to be revised to address these issues with respect to retirement plans.

Online Security Tips

As part of the guidance, the DOL also provided tips for plan participants in order to reduce the risk of fraud and loss to a retirement account by:

Retirement plan funds are increasingly a target of cybercriminals, so plan sponsors should communicate these tips to plan participants to reduce the incidence of fraud.

Warner Can Help!

At Warner, we’ve been working with clients for years to address privacy and security issues, both with internal policies and procedures and in contracting with vendors. If you need assistance in implementing this guidance, please contact Norbert Kugele, Brianna Richardson or a member of Warner’s Employee Benefits/Executive Compensation Practice Group.

Associate

Brianna Richardson

Cybersecurity and Privacy

Employee Benefits

DOL Issues Cybersecurity Guidance For Retirement Plans

The Warner Norcross + Judd LLP lawyer responsible for the contents of our advertising and this website is managing partner <a href="/people/mark-j-wassink/" aria-label="Mark Wassink">Mark Wassink</a> who can be reached at <a href="mailto:mwassink@wnj.com" aria-label="email Mark Wassink">mwassink@wnj.com</a> or 616.752.2189. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website.

DOL Issues Cybersecurity Guidance For Retirement Plans

professionals