Regulatory updates to watch in Q1 2025

UnitedHealthcare is required to provide 1095-B forms for fully insured groups.

The 1095-B form supports the Affordable Care Act (ACA) requirement for groups to offer minimum essential coverage (MEC). It is also a requirement for the Individual Mandate states which require all residents to have health insurance.

Anticipated timing: UnitedHealthcare plans to post 1095-B forms on member portals (e.g., myuhc.com®) for fully insured subscribers prior to the Jan. 31, 2025, filing deadline. Resident subscribers in states with the Individual Mandate (California, Washington, D.C., New Jersey and Rhode Island) will have forms mailed unless the member has requested paperless communications.

UnitedHealthcare will submit the 1095-B via the 1094 transmittal form to the Internal Revenue Service (IRS) and to the Individual Mandate states (California, Washington, D.C., New Jersey and Rhode Island) by the March 31, 2025, deadline for fully insured groups.

Who it impacts: Fully insured groups

The employer is required to submit the 1095-C for fully insured groups with 50+ full-time employees (FTEs) and self-funded groups.

The 1095-C form supports the ACA employer mandate and confirms the group offered a plan with MEC, minimum value (MV) and a plan that is affordable as defined under the ACA.

It’s critical to note that creating the 1095-C and submitting via the 1094-C transmittal form is the responsibility of the employer — not UnitedHealthcare. If a customer does not submit the 1095-C (with the 1094-C transmittal form) and the customer is audited, there are penalties.

Anticipated timing: Fully insured groups with 50 or more FTEs and self-funded groups must furnish the subscribers a 1095-C form by the Jan. 31, 2025, deadline and submit the 1095-C with the 1094-C to the IRS and the tax revenue departments for the Individual Mandate states by the March 31, 2025, deadline. 

Who it impacts: Fully insured groups with 50 or more FTEs and self-funded groups

The 2026 out-of-pocket maximum (OOPM) represents a 10.3% increase from the 2025 OOPM parameters. It is effective beginning on or after Jan. 1, 2026. The OOPM includes copayments, deductibles and coinsurance amounts associated with both medical and pharmacy covered benefits.

The 2026 OOPM for group health plans is outlined below:

The annual OOPM requirement applies to most non-grandfathered group health plans, regardless of whether the plan is fully insured or self-funded (ASO). It does not apply to grandfathered, transitional relief or retiree-only plans.

High deductible health plans (HDHPs) with health savings accounts (HSAs) have limits that are different, including OOPM, deductible and contribution limits. These HDHP HSA limits are historically released in May, and the 2026 out-of-pocket, deductible and contribution limits will be communicated once available.

Anticipated timing: 2026 OOPM effective on or after Jan. 1, 2026

Who it impacts: Most health plans with some exceptions outlined above

Under the Consolidated Appropriations Act (CAA), health insurers offering group or individual health coverage, and self-funded group health plans are required to report data annually regarding prescription drugs and health care spending to the Departments of Health and Human Services, Labor, and Treasury (Tri-Agencies).

To support our customers with this important filing, UnitedHealthcare will be submitting the required data for business administered by UnitedHealthcare for all employers who had active coverage during the 2024 reference year. However, like last year, completion of the submission requires gathering some information not currently maintained in our system using a request for information (UHC RFI) in the employer/broker portal.

Anticipated timing: The required submission date to report 2024 data through a web portal set up by the Centers for Medicare & Medicaid Services (CMS) is June 1, 2025. To access the RFI tool, the employer or their broker or consultant must go to the employer portal beginning Feb. 3, 2025, and enter the requested data by the March 31, 2025, deadline. Employers, brokers and consultants can look for a communication the week of Feb. 3, 2025.

Who it impacts: Employers with fully insured, level funded and self-funded group health plans (brokers and consultants supporting employers with self-funded group health plans)

The District Court for the Northern District of Texas vacated key components of the HIPAA Privacy Rule to Support Reproductive Health Care in Purl v. U.S. Department of Health & Human Services.  The initial result is that HIPAA Covered Entities and Business Associates (“regulated entities”) are no longer:

Required to obtain attestations from requestors for certain disclosures of PHI potentially related to reproductive health care.

Prohibited from disclosing PHI for purposes of a requestor investigating or imposing liability related to lawfully provided reproductive health care (as long as the disclosure is otherwise permitted under HIPAA’s Privacy Rule).

Required to update their Notices of Privacy Practices with related reproductive health care content. 

Note that updates for substance use disorder information are still required.

Because there is no longer a federal requirement to seek attestations (for the purposes of health oversight activities; law enforcement; judicial or administrative proceedings; and disclosures regarding decedents to coroners and medical examiners), UnitedHealth Group Covered Entities and Business Associate are not required to obtain an attestation for such requests.  Regulated entities will need to continue to ensure that uses and disclosures of PHI are otherwise permitted under the HIPAA Privacy Rule and applicable state law and be prepared to obtain attestations again should the District Court’s opinion be overturned. 

 We will continue to monitor developments and distribute updated information as it becomes available.

The Department of Health and Human Services’ Office for Civil Rights recently amended the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to strengthen privacy protections related to reproductive health care information. 

As of Dec. 23, 2024, these amendments now (1) prohibit the use or disclosure of Protected Health Information (PHI) for purposes of investigating lawful reproductive health care in certain circumstances; and (2) introduce a new requirement to obtain a signed attestation before sharing PHI potentially related to reproductive health care for certain purposes, including health oversight activities, judicial or administrative proceedings, law enforcement activities, and disclosures to coroners and medical examiners.

Timing: Dec. 23, 2024

Who it impacts: All employers

On Dec. 20, UnitedHealthcare submitted its gag clause attestation to CMS as required under the CAA. UnitedHealthcare attestation applied to fully insured, level funded and to self-funded customers that signed a letter of direction and provided the necessary data.

The gag clause attestation submission confirmation Submission ID is 66375.

Note: Customers that did not request UnitedHealthcare to attest have a Confirmation of Compliance from UnitedHealthcare to support their own attestation submission.

Timing: Dec. 20, 2024

Who it impacts: All employers that signed a letter of direction and provided the necessary data