North Risk Partners https://northriskpartners.com Mitigate Your Risk Mon, 12 Oct 2026 19:51:11 +0000 en-US hourly 1 https://wordpress.org/?v=7.1.3 https://northriskpartners.com/wp-content/uploads/2013/10/cropped-site-icon-1-32x32.png North Risk Partners https://northriskpartners.com 32 32 Navigating Cybersecurity Challenges in the Construction Industry https://northriskpartners.com/navigating-cybersecurity-challenges-in-the-construction-industry/ Mon, 12 Oct 2026 19:41:01 +0000 https://northriskpartners.com/?p=31929

The construction industry is continuously moving toward digitization, adopting advanced technology such as artificial intelligence, the Internet of Things (IoT), and Building Information Modeling software. These innovations help to automate tasks, reduce waste, and improve efficiency, productivity, and safety.

However, this shift also brings significant cybersecurity risks. As construction companies rely more on digital tools and store large amounts of sensitive data, cybercriminals increasingly see them as attractive targets. As a result, construction businesses must take action to protect sensitive information from data breaches and other cybersecurity incidents that can create financial hardship and reputational damage.

This article explains why cybercriminals target the construction industry, describes common cyberattacks and why they use them, and offers cybersecurity best practices. It also examines the role of cyber insurance in mitigating cyber risks.

Why Cybercriminals Target the Construction Industry

There are several reasons why the construction industry is an appealing target for cybercriminals, including:

  • High-value transactions—Construction projects often involve significant financial transactions, making them attractive targets for ransomware, phishing attacks, and financial fraud. The high value of these transactions can incentivize cybercriminals to attempt fraudulent payments or extortion.
  • An abundance of sensitive data—Construction companies manage sensitive data like blueprints, architectural designs, bids, contracts, and employee and client information. This data is valuable to cybercriminals, who can exploit it for financial gain through data breaches or sell it on the dark web.
  • Complex supply chains—With multiple stakeholders and subcontractors involved in construction industry supply chains, each with potentially varying levels of cybersecurity maturity, the odds of network vulnerabilities increase. Malicious actors may target these weak links in the supply chain, as they may serve as potential access points for cyberattacks.
  • Outdated cybersecurity measures—Many construction firms rely on legacy systems or outdated software that does not provide adequate protection against modern cyberthreats. These weaknesses present attractive opportunities for intrusion by hackers, who often seek out older systems that have known vulnerabilities and are easier to exploit.
  • Increasing adoption of digital technologies—The digital attack surface has expanded with the construction industry’s increasing use of digital technologies (e.g., IoT, remote project management, cloud storage). Although these technologies improve efficiency, they have also created more opportunities for malicious actors to infiltrate networks.

Common Cyberattacks and Why They Are Utilized

There are many types of cyberattacks. The following are commonly used against the construction industry for various reasons:

Cybersecurity Best Practices for the Construction Industry

Although cyberthreats are numerous and evolving, there are several measures construction businesses can take to safeguard computer systems and networks:

  • Employee training and awareness programs help employers educate workers about cyberthreats. They also allow discussion on combating cyber risks by following the organization’s cybersecurity policies and procedures.
  • Multifactor authentication can add additional layers of protection through authenticators, such as one-time passcodes or time sensitive links, before a user can access a company’s network or system.
  • Regular software updates and patch management can ensure software programs are best positioned to defend against the latest cyberthreats.
  • Network segmentation divides a network into smaller parts so that if it is infiltrated, there will be security barriers to prevent lateral movement across the network.
  • Access controls limit who can view or access sensitive information and the situations when they may do so.
  • Data encryption transforms data into an unreadable, encoded format so malicious actors cannot decipher it without the correct key.
  • Data backup and recovery systems allow businesses to quickly recuperate after cyberattacks (e.g., ransomware or DDoS attacks) because their data is stored in another place (e.g., external hard drives or a cloud) and can be quickly reloaded onto systems to minimize downtime.
  • Vendor and supply chain management ensures companies select and work with vendors with strong cybersecurity practices. By carefully vetting partners, construction companies can reduce the risk of supply chain attacks.
  • Incident response planning and testing allow construction companies to proactively build their cyber defenses by having policies and procedures to respond to cyberattacks and test their systems to find and repair weaknesses.

The Role of Cyber Insurance in Mitigating Risk

Even with a robust cybersecurity defense, no system is immune to attacks. Cyber insurance helps mitigate exposure to cyberrelated losses, filling gaps that may be left by other policies (e.g., commercial property insurance, general liability insurance, etc.), which typically do not cover cyber-related events. It is specifically designed to cover business interruption and other financial losses that result from cybersecurity incidents, such as data breaches and ransomware attacks.

Many cyber insurance policies provide access to a vendor panel that includes legal counsel, public relations firms, IT specialists, and other experts who are experienced in managing cyber incidents. This can help businesses respond quickly and effectively to mitigate the impact of a cyberattack on operations, reputation, and finances.

Cyberattacks are a serious threat to the construction industry. Cybercriminals can utilize many methods to steal data or disrupt computer networks for financial gain. Strong cybersecurity practices and a proper cyber insurance policy are essential to address this risk. By being proactive, businesses can mitigate this exposure and safeguard their finances and reputations.

If you have questions, please contact a North Risk Partners Advisor.

This blog is not intended to be an exhaustive source of information nor should any discussion or opinions be construed as legal advice. Readers should consult legal counsel or a licensed insurance professional for appropriate advice. © 2026 Zywave, Inc. All rights reserved.

]]> The Importance of Fall Rescue Plans https://northriskpartners.com/the-importance-of-fall-rescue-plans/ Mon, 12 Oct 2026 19:04:41 +0000 https://northriskpartners.com/?p=31924

More than one-third of construction fatalities in 2024 were caused by slips, trips, and falls, according to the most recent data from the U.S. Bureau of Labor Statistics—and most of those deaths resulted from falls to a lower level. Even if a fall arrest system catches a worker, they can experience severe injury or death if not retrieved quickly. That’s why construction employers should implement and maintain comprehensive fall rescue plans (FRPs).

This article explains why FRPs matter and outlines key elements to include in these plans.

Why Do FRPs Matter?

FRPs provide detailed, jobsite-specific instructions for swiftly and safely retrieving a fallen worker. They’re a required part of an overall fall prevention plan, which identifies fall hazards and outlines how to reduce or eliminate them.

There is still a risk of serious injury or death even after a worker’s fall has been arrested by safety equipment. A worker suspended upright can develop suspension trauma—also called orthostatic intolerance or harness hang syndrome—when blood pools in the lower extremities instead of recirculating. This deprives the brain and vital organs of oxygenated blood and can cause unconsciousness, organ damage, or death within minutes. A prompt, well-rehearsed rescue is critical to avoiding these outcomes.

What to Include in an FRP

An FRP must cover a range of rescue scenarios and procedures. OSHA standards require employers to provide prompt rescue after a fall or ensure employees can self-rescue. Not every fall calls for the same response, so an FRP should clearly explain how to recognize and handle each scenario:

  • Self-rescue situations—A suspended worker can safely lower themself to the ground.
  • Assisted rescue situations—Trained personnel use equipment to retrieve a worker who cannot get down on their own, whether due to injury, unconsciousness, or lack of equipment.

In addition, FRPs should include:

  • Roles of authorized rescuers and site personnel
  • Types, location and use of rescue equipment (e.g., ladders, lifts, first-aid kits)
  • Guidance on post-rescue monitoring, since injuries aren’t always immediately apparent
  • Contact information for additional people who may need to respond to the rescue, such as site supervisors, safety managers, staff trained on first aid, nearby hospitals and first responders, and the local OSHA office

Employers should train employees on their FRP at least annually and any time the plan changes. Newly hired employees should be trained as part of onboarding, before they’re exposed to fall hazards. Keep the plan, equipment inventory, and training records current and easy to locate on-site.

FRPs are essential for creating a safe work environment. By providing clear, detailed instructions for a quick response after a fall, they help workers avoid severe consequences.

If you have questions, please contact a North Risk Partners Advisor.

This blog is not intended to be an exhaustive source of information nor should any discussion or opinions be construed as legal advice. Readers should consult legal counsel or a licensed insurance professional for appropriate advice. © 2026 Zywave, Inc. All rights reserved.

]]> Built on Growth: Milestones That Shaped North Risk Partners https://northriskpartners.com/built-on-growth/ Mon, 12 Oct 2026 18:22:15 +0000 https://northriskpartners.com/?p=31916

When Chris Meidt joined the organization in 2014, North Risk included approximately 80 employees across three Minnesota agencies. One of the earliest priorities was bringing them together under a shared name, culture, and commitment to becoming one team.

The Story Behind the Growth

What followed was more than a decade of purposeful growth. The milestones below highlight how North Risk evolved from three agencies into one of the Midwest's largest, privately owned independent insurance brokerages.

 

2013: North Risk Partners is formed

9 Minnesota locations | 80 team members

Apollo Insurance, C.O. Brown Agency, and Johnson McCann Benefits come together to create North Risk Partners.

 

2014–2018: A unified organization begins to take shape

21 locations across Minnesota, Iowa, and Nebraska | 300 team members

North Risk establishes its core values and mission of service while completing 16 acquisitions and one merger under CEO Chris Meidt's leadership. By the end of 2018, the organization had tripled in size and expanded beyond Minnesota.

 

2019–2022: “Face Risk Head On” Fuels the Next Chapter

Five-state footprint | 400+ team members

With the introduction of the "Face Risk Head On" brand promise, North Risk continues to build momentum through 14 acquisitions and expanded capabilities. By the end of 2022, the firm serves clients across five Midwestern states and employs more than 400 team members.

 

2023–Today: Continued Investment, Growth, and Industry Recognition

450+ team members across Minnesota, Iowa, Nebraska, North Dakota, and South Dakota

In 2024, North Risk surpassed $100 million in revenue, more than tripling its 2013 revenue. The milestone capped a decade of growth that included more than 50 acquisitions, expansion across the Midwest, and recognition as one of the nation's Top 50 insurance brokerages.

This is North Risk Partners

This story is part of This Is North Risk Partners—an ongoing series highlighting the people, moments, achievements, and milestones that shape who we are.

]]> Medicare Part D Creditable Coverage https://northriskpartners.com/2026-medicare-part-d-creditable-coverage/ Thu, 01 Oct 2026 19:25:30 +0000 https://northriskpartners.com/?p=31894

Employers are not required to offer creditable prescription drug coverage, but they are required to determine and communicate creditable (or non-creditable) status to eligible individuals. This information helps Medicare Part D eligible individuals make informed decisions about enrolling in Medicare Part D and avoid late enrollment penalties.

Determining Creditable Coverage Status

Prescription drug coverage is creditable if the actuarial value of the coverage equals or exceeds the actuarial value of Medicare Part D prescription drug coverage. Employers often rely on insurance carriers or third-party administrators (TPAs) to provide credible determinations. If such information is not provided, the employer must make the determination on their own.

Employers who do not apply for the retiree drug subsidy generally use the “simplified method” for determining whether prescription drug coverage is creditable. If a plan does not meet the criteria under the simplified determination method, the employer may assume the plan is non-creditable, or they may obtain an actuarial determination to confirm.

 

Simplified Method for Determining Creditable Status

For 2026 plan years, employers may choose to use either the existing simplified method per CMS 2009 instructions or the newly revised simplified method for determining creditable status. Beginning in 2027, only the revised simplified method may be used.

Revised Simplified Method (Available Beginning in 2026)

To be deemed creditable, the plan must meet the following criteria:

  1. Provide reasonable coverage for brand name and generic prescription drugs and biological products;
  2. Provide reasonable access to retail pharmacies; and
  3. Pay on average at least 72% (73% for 2027 plan years) of participants' prescription drug expenses.
Existing Simplified Method

To be deemed creditable, the plan must meet the following criteria:

  1. Provide reasonable coverage for brand name and generic prescription drugs;
  2. Provide reasonable access to retail pharmacies;
  3. Pay on average at least 60% of participants' prescription drug expenses; and
  4. Depending upon whether the plan is integrated (most plans are non-integrated):
    • A non-integrated drug plan must have either no annual benefit maximum or a minimum annual benefit of $25,000; OR have an actuarial expectation that the amount payable by the plan will be at least $2,000 annually per Medicare-eligible individual.
    • An integrated plan must: have a maximum annual deductible of $250; have either no annual benefit maximum or a minimum annual benefit of $25,000; AND  have a lifetime combined benefit maximum of at least $1 million.

Disclosure of Creditable Status to Eligible Participants

The creditable status of the plan must be disclosed to Medicare Part D eligible individuals who are eligible to enroll in the plan sponsor’s prescription drug plan. This includes employees, COBRA participants, retirees, as well as their spouses and dependents. Individuals are eligible for Medicare Part D if they are enrolled in either Medicare Part A or Part B and live in the service area of a Medicare Part D plan. Due to difficulties in identifying eligible individuals, many employers choose to provide the disclosure notice to everyone eligible for their prescription drug plan.

 

Timing

Employers can satisfy the annual disclosure requirement by providing the notice each year during the employer’s open enrollment period or in the fall to coincide with the Medicare Part D open enrollment period. The notice must also be provided when individuals are first eligible for prescription drug coverage (e.g., new hires). Additionally, employers must provide notice whenever the employer no longer offers prescription drug coverage, when the creditable status changes, and upon request.

 

Delivery Methods

CMS recommends employers mail paper copies. However, notices may be provided electronically if the DOL’s electronic delivery safe harbor is satisfied. Employers may provide a single notice to eligible individuals and their dependents residing at the same address. If the notice is incorporated with other information or notices (e.g., benefits booklet or enrollment packet), the disclosure should be on its own page, and a prominent reference (in 14-point font) should be included on the first page of the materials listing the notice’s specific page number.

Reporting to CMS

In addition to individual disclosures, employers must report the creditable status of their coverage to CMS annually, within 60 days of the start of the plan year. This reporting is typically completed by the employer, rather than the insurance carrier or TPA. Information necessary to complete the reporting includes employer identification number, type of coverage, number of plan options, estimated number of Medicare-eligible individuals covered, and the date the notice was distributed to participants.

CMS has provided detailed reporting instructions available here.

 

If you have questions, please contact your North Risk Partners Risk Advisor. Don’t have an advisor? No problem. We’ll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]> Gag Clause Attestations https://northriskpartners.com/gag-clause-attestations/ Thu, 01 Oct 2026 16:43:44 +0000 https://northriskpartners.com/?p=31874

Group health plans are prohibited from entering into agreements containing contractual 'gag clauses' which operate to restrict access to provider cost, quality, or de-identified claims data. Most employer-sponsored group health plans must annually attest to compliance with these requirements via the Gag Clause Prohibition Compliance Attestation portal hosted by the Centers for Medicare and Medicaid Services (CMS).

CMS created a webpage with information about how to comply with the gag clause prohibition as well as how to attest to compliance, which you can find here.

Which Plans Must Comply?

The gag clause prohibition and attestation requirements apply to most employer-sponsored health plans, but not excepted benefits (e.g., stand-alone dental or vision, health FSA), retiree-only plans, or account-based plans (e.g., HRAs). The employer should consider all contracts with service providers in connection with its health plan(s). Beyond the carriers and TPAs, there may be additional service providers that need to be considered. For example, provider contracts with and coordinated by PBMs, behavioral health vendors (e.g., network agreements for mental health providers), telehealth arrangements, direct primary care arrangements, and other medical providers (e.g., access to preferred pricing for certain procedures if using particular providers) are also prohibited from having gag clauses and should be considered by the employer when attesting to compliance.

Who Must Complete the Attestation?

Service providers (e.g., carriers or TPAs) may attest for the group health plan on behalf of sponsoring employers, but carriers and TPAs have taken a varied approach to this. If the carrier (on behalf of a fully-insured plan) or TPA (on behalf of a self-funded plan) agrees to attest on behalf of the plan, the employer can rely on that attestation. However, if the carrier, TPA or any other service providers will not attest to compliance on the plan’s behalf, the employer needs to confirm no gag clauses are present in the contracts they have entered into on behalf of the plan and will then need to attest accordingly.

Employer Responsibilities

Employers should establish procedures to identify all provider-related contracts, verify vendor compliance, and complete the annual CMS attestation when necessary, maintaining all documentation that supports the compliance process. Although carriers and TPAs frequently assist with filing obligations, the sponsoring employer remains legally responsible for performance of the attestation requirement. Therefore, the gag clause attestation requirement gives rise to the following responsibilities:

Identify all service providers that contract with plan providers (e.g., carrier, TPA, PBM, behavioral health, telehealth, etc.).

Determine which vendors agree to submit the attestation on behalf of the underlying plan and, if possible, obtain written verification of the vendor’s agreement to perform the attestation requirement.

If a particular vendor does not agree to submit the attestation, obtain written confirmation of actual compliance with the requirement from the vendor.

Complete and submit the CMS attestation annually by December 31 (to the extent required).

Maintain documentation of the vendor confirmation process and archive all CMS submission and acknowledgement receipts.

Attestation Process

The attestation process itself is a fairly straightforward, requiring only some plan identifying information, employer contact information, and a checked box and signature to indicate compliance. This is done through a web portal. The attestation process can be broken down into four general steps.

1. Confirm compliance. Review any group health plan contracts to confirm there are no prohibited gag clauses. Alternatively, reach out to all carriers, TPAs and any other service providers and ask for written confirmation that contracts they handle on behalf of the group health plan do not contain any prohibited gag clauses. Such documents should be kept in the employer’s files. 

2. Obtain website access. Go to CMS’ portal link above, enter in an email address, and get a unique code to access the attestation form. The website for submitting the attestation can be found here.

3. Complete the attestation form. Fill out the required information in five short sections of the form and then sign off on compliance with the gag clause prohibition requirements.

4. Confirm submission. Upon completion and submission of the form, download the submission receipt and file it away in case of future audit or questions.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]> Clarification for DCAP Nondiscrimination Rules https://northriskpartners.com/clarification-for-dcap-nondiscrimination-rules/ Thu, 01 Oct 2026 16:33:34 +0000 https://northriskpartners.com/?p=31870

On August 11, 2026, the Department of the Treasury and Internal Revenue Service issued proposed regulations addressing nondiscrimination rules for Dependent Care Assistance Programs (DCAPs), as well as related rules for employer contributions to Trump Accounts. For DCAP sponsors, the most significant development is proposed clarification of the §129 nondiscrimination tests, including a more workable approach to the 55% average benefits test. Although the regulations are only proposed, the preamble permits taxpayers to rely on the proposed regulations until final regulations are published.

For DCAP sponsors, the proposal is significant because there were not previously implementing regulations for how Code §129 requirements should operate. The proposal confirms the four existing tests and, in several respects, formalizes testing approaches already used in practice. It also provides useful new clarification regarding the eligibility test and the 55% average benefits test and the consequences of a testing failure.

DCAP Nondiscrimination Framework

§129 rules allow DCAPs to provide up to $7,500 each calendar year in tax-favored qualifying daycare assistance, but §129 rules also prohibit DCAPs from favoring highly compensated employees (HCEs) on a tax-favored basis. A difference in eligibility rules, waiting periods, employer contributions or benefit coverage can all potentially cause issues under §129 nondiscrimination rules if the more generous offering or coverage favors HCEs.

For this purpose, HCEs include >5% owners and employees whose compensation exceeds a certain threshold (e.g., for 2026, employees who received $160,000 or more in 2025). To determine compliance, §129 requires a DCAP to satisfy four nondiscrimination tests. A DCAP must pass all four tests; if any of the four tests are failed and timely corrections are not made, all DCAP benefits elected by HCEs must be included in their taxable income.

Four Nondiscrimination Tests

The four §129 nondiscrimination tests are outlined below. The proposed regulations clarify how several of them should be applied, particularly the eligibility and 55% average benefits tests.

*For nondiscrimination testing, an employee or owner who was eligible or participated at any time during the year but terminated employment prior to year-end should generally be included in the testing. For purposes of the eligibility test and the average benefits test, the testing may exclude employees who are under age 21, employees who have <1 year of service, and employees who were not included in the DCAP and were covered by a collective bargaining agreement under which dependent care benefits were the subject of good faith bargaining.

Testing Failures

The proposed rules clarify that a testing failure does not disqualify all DCAP benefits. Instead, the correction generally focuses on the discriminatory portion of benefits provided to HCEs. HCEs must include the applicable taxable amount in income, and the employer should reflect that amount through appropriate Form W-2 reporting by the otherwise applicable deadline.

To avoid having to include all DCAP benefits in an HCE’s taxable income for a plan that otherwise fails any of the §129 discrimination tests, the employer can include only the discriminatory/excess benefit so long as it is done on the HCEs’ Form W-2 no later than January 31st following the end of the applicable plan year. This clarification is significant because prior guidance did not clearly provide this correction mechanism, and many practitioners interpreted the rules as requiring correction before the end of the plan year.

Summary

Employers sponsoring DCAPs should consider whether the proposed rules create an opportunity to revisit plan design, participation strategy, and testing assumptions for the current or next plan year. In particular, employers that previously limited DCAP availability because of 55% average benefits testing concerns may have more flexibility if they can rely on the participant-only averaging approach.

Employers should also coordinate with their third-party administrators and payroll teams to confirm how testing will be performed, how excludable employees will be identified, and how any HCE income inclusion will be reported if a test fails. Because the preamble permits reliance on the proposed regulations before they are finalized, employers may begin applying the clarified testing rules now.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]> Trump Account Contribution Programs https://northriskpartners.com/trump-account-contribution-programs/ Thu, 01 Oct 2026 16:30:10 +0000 https://northriskpartners.com/?p=31866

The One Big Beautiful Bill Act (OBBBA) created a new employer-sponsored benefit opportunity through Internal Revenue Code §128. Employers may now make tax-favored contributions of up to $2,500 annually to the Trump Account of an employee or an employee's dependent through a Trump Account Contribution Program (TACP). For employers seeking family-focused benefits, TACPs provide a way to help employees save for a child's future while receiving favorable federal income tax treatment. Proposed regulations issued in August 2026 provide the initial administrative framework and may be relied upon immediately, even before final regulations are published.

Trump Accounts

Trump Accounts are a type of IRA designed to help families save for a child's future. Accounts generally may be established for children under age 18 with a valid Social Security number. During the account's growth period, contributions are subject to special rules, annual limits, and investment restrictions. The growth period generally ends on December 31 of the year the beneficiary turns 17, after which traditional IRA rules generally apply.

In general, contributions made during the growth period from sources such as employers, parents, children, or other individuals are subject to an aggregate annual contribution limit of $5,000 for 2026 and 2027, indexed thereafter. Certain contributions, including federal pilot contributions, qualified general contributions, and qualified rollover contributions, are not counted toward that limit. Children born between January 1, 2025, and December 31, 2028, may also qualify for a one-time federal pilot contribution of $1,000.

Trump Account Contribution Programs (TACPs)

A TACP is an employer-sponsored program established under Internal Revenue Code §128 that permits employers to make tax-favored contributions to the Trump Account of an employee or an employee’s dependent. A TACP must be established through a separate written plan maintained for the exclusive benefit of employees and must satisfy specified requirements relating to eligibility, contributions and benefits, employee notification, reporting, and nondiscrimination.

Under the proposed regulations, a TACP may also be coordinated with a §125 cafeteria plan to permit employees to fund contributions through salary reduction on a tax-favored basis. However, salary reduction contributions may only be made to a dependent’s Trump Account, not to an employee’s own Trump Account.

TACP Contributions

TACP contributions may be made only to the Trump Account of an employee or an employee's dependent (as defined under §152) while the account beneficiary remains in the account's growth period, which generally ends on December 31 of the year the beneficiary turns 17. For purposes of §128, eligibility is limited to common-law employees. As a result, self-employed individuals, including sole proprietors, partners, and 2% S corporation shareholders, cannot participate in a TACP, but they can sponsor a TACP for their employees.

Qualifying employer contributions are excluded from an employee's gross income up to $2,500 annually for 2026 and 2027, with the limit indexed thereafter. However, unlike many employer-provided benefits, the contributions remain subject to FICA, FUTA, and RRTA taxes.

The exclusion applies on a per-employee basis rather than per Trump Account or dependent. Contributions from multiple employers are aggregated when determining the annual limit. Although an employer may divide contributions among the Trump Accounts of multiple dependents, the total amount attributable to a single employee remains subject to the annual exclusion cap.

Plan Documentation

A TACP must be established and maintained under a separate written plan. The document should describe the plan year, eligibility, contributions, whether salary reductions through a cafeteria plan are permitted, Trump Account designation procedures, employee certifications, notice and reporting obligations, and correction procedures. Employers must operate the program consistently with the written terms to preserve §128 tax-favored treatment.

§125 Integration

Employers may integrate a TACP with a §125 cafeteria plan, allowing employees to fund contributions to a dependent's Trump Account through salary reduction. Salary reduction contributions to an employee's own Trump Account are not permitted. The combination of employer contributions, if any, and employee salary reductions cannot exceed the §128 contribution limits (e.g., $2,500 for 2026 and 2027).

A cafeteria plan offering this benefit must be amended to include and describe the TACP offering. In regard to employee elections, unlike many cafeteria plan benefits, TACP elections may generally be made, changed, or revoked prospectively throughout the year, provided changes become effective before the related compensation is currently available, similar to the flexibility generally available for HSA elections.

Administrative Requirements

Employee Notice

A TACP must provide reasonable notification of the program's availability and terms to all eligible employees, so they have a meaningful opportunity to participate and understand the basic rules governing eligibility, elections, and contributions. The proposed regulations do not prescribe a specific format or delivery method.

Annual Reporting

Employers must furnish each participating employee with an annual written statement showing the amount of §128 contributions made with respect to the employee during the preceding calendar year. The annual statement requirement may be satisfied through Form W-2 reporting in accordance with IRS instructions. For 2026 reporting, §128 contributions should be reported in Box 12 using Code TA.

Trustee Selection Not Permitted

The proposed regulations prohibit employers from limiting TACP contributions to Trump Accounts maintained by selected trustees or financial institutions. Because only one Trump Account may exist for a beneficiary, employers must permit contributions to any valid Trump Account designated by an eligible employee.

Verification and Correction

Employers generally may rely on specified written employee certifications unless they have actual knowledge that the information is incorrect. The certification may be provided on paper or electronically and must include representations that:

  • the beneficiary is or will be the employee’s dependent for the applicable taxable year;
  • the beneficiary’s date of birth; and
  • the employee knows of no facts that would make the beneficiary ineligible to receive the contribution.

Employee certification alone, however, is not sufficient to establish that the receiving account is a valid Trump Account. Employers must use reasonable verification procedures, directly or through vendors, payroll providers, or trustees. In addition, when an employer transmits a qualifying contribution to a trustee, the employer must affirmatively identify the amount in writing as a §128 contribution.

If an employer later determines that an amount previously treated as a §128 contribution was ineligible, the employer must notify the trustee and provide corrective information. The proposed regulations include a 21-day safe harbor for providing corrective notice after the employer identifies the error.

Nondiscrimination Requirements

Because of the favorable tax treatment, TACPs are subject to nondiscrimination testing modeled after the rules applicable to §129 dependent care assistance program (DCAPs). A TACP must satisfy three tests: (i) the eligibility test; (ii) the contributions and benefits test; and (iii) the 55% average benefits test. Unlike a DCAP, a TACP has no separate owner concentration test because self-employed individuals cannot participate.

The nondiscrimination rules prohibit plans from favoring highly compensated employees (HCEs). For 2026 testing purposes, HCEs generally include certain owners and employees who earned at least $160,000 during 2025. A nondiscrimination failure generally affects the tax treatment of HCEs rather than causing the entire arrangement to lose TACP status. Related employers that constitute a controlled group or affiliated service group are treated as a single employer for purposes of these testing requirements.

Special Safe Harbor for Employer Pilot Matches

The proposed regulations include a safe harbor for employers that want to match the federal government's $1,000 pilot contribution for eligible children born from 2025 through 2028. If a qualifying pilot-match contribution is made available on the same terms and conditions to all non-excluded employees with qualifying dependents, the matching contributions are disregarded for the contributions and benefits test and the 55% average benefits test, but not for the eligibility test.

Effective Date and Reliance

Although the regulations would apply prospectively to plan years beginning on or after publication of final regulations, the IRS expressly permits taxpayers to rely on the proposed regulations before finalization. Employers therefore have a framework for implementing TACPs while final guidance remains pending.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]> Third Quarter Benefit News Highlights https://northriskpartners.com/q3-2026-benefit-news-highlights/ Thu, 01 Oct 2026 16:18:23 +0000 https://northriskpartners.com/?p=31862

This quarter’s benefits news highlights several important developments affecting employer-sponsored health and welfare plans, including proposed changes to ERISA electronic disclosure rules, new guidance on mental health parity enforcement, and updated compliance resources for CHIP and HIPAA. We’re also monitoring growing adoption of ICHRAs, cautionary trends involving wellness-related tax strategies, medical loss ratio (MLR) rebates, and new IRS guidance on wearable devices as eligible medical expenses. Read on for timely updates and practical reminders to help employers navigate evolving compliance obligations, benefit plan administration, and strategic benefits decision-making.

1. Proposed Rules – Electronic Distribution

Current Rule: Under the Department of Labor's 2002 electronic disclosure safe harbor, ERISA-covered group health plans generally may furnish required disclosures electronically only if the participant either (1) has regular access to the employer's electronic information system as an integral part of their job duties ("wired at work"); or (2) affirmatively consents to electronic delivery. As a result, many employers continue to rely on paper distribution for employees who do not meet one of these two requirements.

Proposed Rule: The DOL has proposed a new electronic disclosure safe harbor that would extend the electronic delivery framework adopted for retirement plans in 2020 to ERISA-covered group health plans. Rather than requiring employees to be "wired at work" or affirmatively consent to electronic delivery, employers could default participants into electronic delivery by obtaining an email address or smartphone number, providing an initial paper notice explaining the electronic delivery process and participants' rights, and allowing participants to opt out and receive paper copies free of charge. The proposal was published on July 23, 2026, with comments due by September 21, 2026. If finalized, the new safe harbor would become effective 60 days after publication of the final rule.

2. Wellness Tax Schemes

We continue to encounter vendors aggressively marketing programs that promise substantial tax savings for both employers and employees by offering a variety of tax-favored benefits and reimbursement arrangements. While many of these programs include legitimate benefits (e.g., preventive care, telehealth services, counseling, etc.) that may be excluded from employees' taxable income in appropriate circumstances, the tax savings often appear to be driven by the volume of payroll dollars being redirected into these arrangements rather than by the value of the qualifying benefits themselves. As a result, the amount withheld from employees' pay and later reimbursed on a purportedly tax-free basis may significantly exceed what can reasonably be treated as tax-favored under existing tax rules, creating a risk that employees are underpaying income taxes and employers are underpaying payroll taxes.

Employers proceeding with such programs should understand the potential tax risks to employees and themselves if the IRS decides to get more aggressive with enforcement around these types of programs.

3. Updated CHIP Notice

The U.S. Department of Labor has updated its Model CHIP Notice, with the latest version dated July 31, 2026. Employers that are subject to the CHIP notice requirement should use the updated model notice when providing information to employees about potential premium assistance opportunities available through Medicaid or the Children’s Health Insurance Program (CHIP). The notice is required to be provided upon initial eligibility and during open enrollment for group health plan coverage.

4. HRA Council’s 2026 ICHRA Report

The HRA Council’s 2026 “Growth Trends for ICHRA & QSEHRA” report finds continued strong growth in employer use of Individual Coverage HRAs (ICHRAs) and Qualified Small Employer HRAs (QSEHRAs), with applicable large employers representing the fastest-growing ICHRA segment. The report also finds that ICHRA enrollees tend to be younger than the existing ACA individual-market population, with more than half of enrollments involving employees under age 45, potentially strengthening the ACA marketplace risk pool. Despite 2026 individual market changes, including the expiration of enhanced premium tax credits, the HRA Council describes ICHRA adoption as growing and playing an important role in benefit strategy for employers.

5. DOL Guidance on MHPAEA Enforcement

The Department of Labor's Employee Benefits Security Administration (EBSA) recently issued Field Assistance Bulletin 2026-03 (FAB 2026-03), providing new guidance on how it intends to enforce the Mental Health Parity and Addiction Equity Act's (MHPAEA) non-quantitative treatment limitation (NQTL) requirements. While the Departments previously announced non-enforcement relief for certain provisions of the 2024 Final Rule during ongoing litigation, the underlying statutory requirement to perform and document NQTL comparative analyses remains in effect. Plan sponsors should not interpret the enforcement relief as a suspension of MHPAEA compliance obligations.

Under the new guidance, EBSA will focus its enforcement efforts on three NQTL categories that it believes present the greatest potential for participant harm: (1) separate treatment limitations and exclusions affecting mental health and substance use disorder (MH/SUD) benefits, (2) medical necessity standards and utilization management practices, and (3) network adequacy, provider admission standards, and reimbursement methodologies. EBSA also emphasized that it will review not only plan language, but also how plan provisions operate in practice, including the use of operational data and participant complaints.

For employers, the guidance provides a useful opportunity to reassess existing comparative analyses against a clearer enforcement framework. Plan sponsors should review current NQTL documentation, evaluate vendor-provided analyses, consider relevant operational data, and ensure that plan administration aligns with written plan terms. Although FAB 2026-03 refines DOL's enforcement priorities, it does not eliminate MHPAEA obligations or relieve plan fiduciaries of responsibility for compliance.

6. ICHRAs Rebranded as CHOICE Arrangements

CMS now refers to Individual Coverage Health Reimbursement Arrangements (ICHRAs) as CHOICE Arrangements (Custom Health Option and Individual Care Expense). While the underlying arrangement remains the same, the new branding is intended to make these options easier to understand. See CMS’ page on how these arrangements work here.

7. MLR Rebate Season

Employers sponsoring a fully-insured group health plan may soon be getting a check from their insurance company. This check is a medical loss ratio (MLR) rebate that insurers are required to distribute to their plans when too much of the premiums charged in the previous year go toward the insurer’s administration, marketing, and profit, rather than going toward paying claims and quality improvement initiatives. Insurance companies are required to distribute this check annually by September 30. How an employer may use the rebate amount will depend on plan documentation and how coverage premiums are paid.

8. Updated HIPAA Security Risk Assessment Tool Available

A new Version 3.7 of the Security Risk Assessment (SRA) Tool is available to help organizations evaluate compliance with the HIPAA Security Rule. The update includes new questions addressing assessment scope, remote access and telework risks, asset inventory management, system activity logging, and other cybersecurity considerations reflecting today's evolving threat landscape.

The updated tool is intended to help identify potential risks to electronic protected health information (ePHI) and documenting security risk assessment efforts. While use of the tool does not guarantee HIPAA compliance, and the tool was developed primarily for healthcare providers, it may also serve as a useful resource for employers sponsoring HIPAA-covered group health plans that create, receive, maintain, or transmit ePHI when evaluating their administrative, physical, and technical safeguards.

9. Wearables – Sometimes Qualifying Medical Expenses

The IRS recently added new FAQ guidance (Q&A #15) addressing when the cost of wearable devices, such as smart watches, rings, patches, sensors, and similar technology, may qualify as a reimbursable medical expense under an HSA, FSA, HRA, or Archer MSA. The IRS explained that wearable devices are not eligible simply because they track health-related information; rather, the device must be purchased and used primarily to diagnose, treat, mitigate, or prevent a specific medical condition, based on the individual's facts and circumstances. Factors such as a medical practitioner's recommendation, a diagnosed condition, abnormal test results, or how the collected data is used may support eligibility, while a general desire to improve health or monitor wellness is insufficient. The same standard applies to related accessories, add-ons, and software subscriptions.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]> Hours of Service Compliance Strategies for Regulated Fleets https://northriskpartners.com/hours-of-service-compliance-strategies-for-regulated-fleets/ Thu, 24 Sep 2026 15:16:43 +0000 https://northriskpartners.com/?p=28290

September 2026

Navigating Hours of Service (HOS) regulations requires employers to understand which drivers must comply, what records must be maintained, and how exemptions apply to different operations. In this webinar, you’ll gain insight into HOS requirements, manage documentation and auditing procedures, and learn strategies for addressing violations while supporting ongoing compliance efforts.

 

What you'll learn:

  • Which HOS rules apply to different drivers and operations 
  • Key exemptions, including the 150 air-mile exception 
  • Electronic Logging Device (ELD) compliance requirements 

 

Webinar presented by: 

Marc Nault
Compliance Director
Patron Compliance Solutions

Kevin Honz
Compliance Manager
Patron Compliance Solutions

Looking for the webinar recording and slides?

Contact your North Risk Partners advisor. Don’t have an advisor? We’ll help you find one.

Find an Advisor
]]> North Risk Partners Named a 2026 Mployer Top Consultant https://northriskpartners.com/2026-mployer-top-employee-benefits-consultant/ Wed, 23 Sep 2026 20:00:34 +0000 https://northriskpartners.com/?p=31849

September 23, 2026 – North Risk Partners' Plymouth and St. Cloud offices named 2026 Mployer's Top Employee Benefits Consultant. 

 

Mployer's Top Employee Benefits Consultant Award Program evaluates benefits broker and consultant offices based on depth of experience across employer industries, sizes, and plan design features, as well as client ratings and reviews. 

“We are grateful to be recognized by Mployer and proud of the team members who serve our clients every day,” said Lisa Daniels, Senior Vice President, Employee Benefits Risk Advisor and Partner. “This award reflects the trust our clients place in us and the dedication our team brings to helping employers make informed decisions for their businesses and their people.” 

This recognition reflects North Risk Partners' commitment to serving our clients and helping them build benefits strategies that support their people and organizations for the future.

 

-----------------------------------------------------------------------------------------------------------------------------

 

About North Risk Partners

North Risk Partners specializes in strategic insurance solutions for people and business. Our team helps clients Face Risk Head On with right-fit insurance coverage and loss prevention resources. For businesses, we offer commercial insurance, surety bonds, employee benefits, as well as programming and compliance support in the areas of human resources, health and safety, and more. Our firm has more than 475 employees and 28 locations across Minnesota, Iowa, Nebraska, North Dakota, and South Dakota.

 

About Mployer 

Mployer is the industry leader in employee benefits analytics and research. The company empowers employers, employees, and benefit consultants to assess, rate, and communicate the value of employee benefits, helping organizations optimize employer costs and strengthen employee-employer relationships. Learn more at mployeradvisor.com. 

Disclaimer: Rankings are dynamic, and this report may not reflect the rankings currently listed on Mployer's website. 

 

Media Contact 

Ali Souza, Communications Manager, Partner, North Risk Partners
ali.souza@northriskpartners.com | (651) 486-2187 

 

]]>