North Risk Partners https://northriskpartners.com Mitigate Your Risk Tue, 03 Nov 2026 18:30:52 +0000 en-US hourly 1 https://wordpress.org/?v=7.1.4 https://northriskpartners.com/wp-content/uploads/2013/10/cropped-site-icon-1-32x32.png North Risk Partners https://northriskpartners.com 32 32 Legal Pitfalls in Multi-State Construction Projects https://northriskpartners.com/legal-pitfalls-in-multi-state-construction-projects/ Tue, 03 Nov 2026 16:10:41 +0000 https://northriskpartners.com/?p=28262

October 2026

As contractors expand into new states, differences in state laws can create unexpected risks affecting contracts, payment rights, dispute resolution, and project outcomes. Learn the key legal considerations that can help protect your business when working across state lines.

 

What you'll learn:

  • Key legal issues to evaluate before expanding work into a new state
  • What contractors should know about resolving disputes across state lines
  • Strategies for strengthening contracts to protect your business and project interests

 

Webinar presented by: 

Blake Nelson

Attorney

Hellmuth & Johnson

Looking for the webinar recording and slides?

Contact your North Risk Partners advisor. Don’t have an advisor? We’ll help you find one.

Find an Advisor
]]> Critical PHP Vulnerabilities: What Businesses Need to Know https://northriskpartners.com/critical-php-vulnerabilities/ Fri, 23 Oct 2026 17:32:27 +0000 https://northriskpartners.com/?p=31974

North Risk Partners is sharing this notice as a public service. It summarizes publicly available information from the PHP Security Team and the Cybersecurity and Infrastructure Security Agency (CISA).

What Happened

Two critical security vulnerabilities were recently discovered in PHP (Hypertext Preprocessor), a programming language used behind the scenes to run many websites and online applications. According to public advisories, these vulnerabilities could allow an attacker to take control of an affected web server without a password or login. The PHP Security Team released security updates on October 21, 2026.

Who May Be Affected

Your organization may use PHP without realizing it. It can be built into:

  • Business websites
  • Online stores and payment pages
  • Customer or vendor portals
  • Website platforms such as WordPress, Drupal, and Joomla
  • Software or online tools managed by outside vendors

Even if your website’s content and applications are current, the underlying PHP software may still need to be updated. This is why businesses should check with their website or technology provider rather than assume their systems are protected.

Why This Matters

If an attacker gains access to a vulnerable web server, the incident could lead to:

  • Theft of customer information, passwords, or other sensitive data
  • Installation of ransomware or other malicious software
  • Changes to website content, payment pages, or links
  • Phishing messages that appear to come from your organization
  • Website outages and business interruption

Because hosting companies, website agencies, and other vendors may manage this technology for you, your internal team may not see the issue.

What Your Business Should Do

Contact your Information Technology (IT) team, website developer, digital agency, Managed Service Provider (MSP), or hosting company and ask them to review the official guidance below. Your IT support team is best positioned to determine whether your organization is affected and what action to take.

Determine whether PHP is used. Ask them to check your primary website, secondary websites, customer and vendor portals, online payment pages, and other public-facing applications.

The PHP Security Team recommends that you install the security update and restart the affected services. Systems should be updated to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to a patched version supplied by the applicable hosting or software provider. Restarting the service is important for the update to take effect.

Plan for systems that cannot be updated right away. If an update cannot be applied promptly, ask your provider about taking the affected website or application offline until it is updated, as recommended by the Cybersecurity and Infrastructure Security Agency (CISA). Web application firewalls may offer limited, temporary protection but do not replace the update.

Check for suspicious activity. Ask your provider to review systems and server records for possible signs of unauthorized access.

Review older PHP versions. PHP 8.1 and earlier are no longer officially supported. If an older version is in use, ask the provider whether a vendor-supplied security update is available or whether the system should be upgraded.

Contact important technology vendors. Ask vendors that host websites, portals, or applications on your behalf whether they use PHP and whether the security update has been applied.

Keep written confirmation. Request documentation showing the PHP version, the date the update was applied, confirmation that services were restarted, and the results of the security review.

If Your IT Support Team Suspects an Incident

If your provider finds signs of unauthorized access, unusual website activity, or other suspicious changes:

  • Follow your IT or technology provider's guidance to contain the issue, including disconnecting affected systems from the internet if recommended.
  • Report the potential incident directly to your insurance carrier.*
  • Preserve system records and other evidence. Avoid wiping or rebuilding affected systems unless your incident response provider directs you to do so.
  • Document the actions taken and the associated dates.

*Cyber incidents and coverage circumstances vary. Review your specific policy requirements with your broker or insurance carrier before engaging outside response providers or incurring significant costs.

Takeaways

Businesses with a website, portal, or other internet-facing application should contact their technology provider as soon as possible. The most important step is to obtain written confirmation that PHP has been updated, the affected services have been restarted, and the environment has been reviewed for suspicious activity.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

North Risk Partners is sharing this notice as a public service. It summarizes publicly available information from the PHP Security Team and the Cybersecurity and Infrastructure Security Agency (CISA) and is provided for general awareness only. It is not technical, legal, or insurance coverage advice. North Risk Partners has not assessed and cannot confirm the status of your systems; your IT team or technology provider is responsible for determining whether you are affected and for any remediation. This situation is developing, so refer to the linked sources for current guidance. Nothing in this notice changes the terms, conditions, or coverage of any insurance policy. Information current as of October 23, 2026.

]]> North Risk’s Steve Tripp Named 2026 Agent of the Year by IIASD https://northriskpartners.com/agent-of-the-year-steve-tripp/ Fri, 23 Oct 2026 16:12:09 +0000 https://northriskpartners.com/?p=31968

October 23, 2026 - North Risk Partners is proud to announce that the Independent Insurance Agents of South Dakota (IIASD) named Steve Tripp the 2026 Agent of the Year. The organization recognized Tripp during its annual convention in October.

The award recognizes a career defined by leadership, service, and meaningful relationships. Throughout his career, Tripp has advocated for clients, mentored employees, and encouraged others to become involved in the insurance industry.

“Steve has built an exceptional career through his passion for serving clients, colleagues, and the insurance industry,” said Chris Meidt, President & CEO of North Risk Partners. “We’re happy to see his contributions recognized with this well-deserved honor.”

In addition to serving clients, Tripp has contributed to a culture rooted in professionalism, integrity, and service. His leadership and mentorship have shaped careers, built confidence, and set an example for others to follow.

“I’m grateful for this recognition and especially thankful for the people I’ve had the opportunity to work alongside throughout my career. I’ve been surrounded by great colleagues, clients, and industry partners who have made the experience incredibly rewarding,” Tripp said.

Steve Tripp posing with Brock Murphy after accepting 2026 Agent of the Year award.

Tripp was nominated for the award by Brock Murphy, Personal Lines Risk Advisor at North Risk Partners. The nomination highlighted the relationships Tripp developed, the reputation he earned, and the many people he influenced throughout his career.

In his nomination of Tripp, Murphy wrote, “One challenge our industry faces is attracting young talent. Steve has spent years investing in the next generation, mentoring not only me, but many others who have come through our agency.” Adding, “he played a role in hiring many of us, but his impact went far beyond recruiting. He helped shape the values, relationships, and culture that continue to define our organization.”

The IIASD supports agents in South Dakota with the tools, training, market access, and advocacy they need to grow their businesses and serve their communities. From fighting for agents on Capitol Hill to offering top-tier education and E&O coverage. Each year, the IIASD recognizes agents and carrier partners who go above and beyond for their clients and the insurance industry. The organization’s annual awards include Agent of the Year and other categories representing different areas of the independent insurance profession.

North Risk Partners congratulates Tripp on this recognition and thanks him for his leadership, mentorship, and service to his clients, colleagues, community, and the insurance industry.

North Risk Partners specializes in strategic insurance solutions for people and business. Our team helps clients Face Risk Head On with right-fit insurance coverage and loss prevention resources. For businesses, we offer commercial insurance, surety bonds and employee benefits, as well as programming and compliance support in the areas of human resources, health and safety, and more. Our firm has over 475 employees and 28 locations across our five-state footprint.

Media Contact:
Kiley Westby, Communications Specialist, North Risk Partners
kiley.westby@northriskpartners.com | (763) 746-0950

]]> A Legacy of Leadership https://northriskpartners.com/a-legacy-of-leadership/ Tue, 20 Oct 2026 17:05:22 +0000 https://northriskpartners.com/?p=31907

When North Risk Partners CEO Chris Meidt talks about leadership, he often returns to the same themes: service, purpose, and helping others become the best version of themselves through mentorship. His father, Gerhard Meidt, a longtime educator, coach, and community leader, first modeled those values, and his influence continues to be felt throughout southwestern Minnesota today.

This September, the community of Minneota, Minn. honored that legacy by officially renaming its football facility Gerhard Meidt Stadium, recognizing the man who helped transform a small-town football program while impacting generations of students through education, music, athletics, and service.

North Risk CEO, Chris Meidt (center) and family pose with bust and plaque at the stadium dedication to his dad, Gerhard Meidt. Picture courtesy of Photos by Emma J Lipinski.

"Everybody had purpose," Chris recalled during a recent interview on Varsity Insiders. "He believed every young person should be involved."

He challenged students to discover their strengths and find a place to belong. Over the past year, Chris has heard countless stories from former students and players whose lives were shaped by his father's encouragement, guidance, and belief in their potential.

That philosophy continues to influence Chris today. Long before leading North Risk Partners, he spent years coaching football and investing in student-athletes. He remains passionate about the role coaches and mentors play in helping young people build confidence, character, and leadership skills.

As President & CEO of North Risk Partners, Chris is passionate about helping team members discover where they can make the greatest impact. He believes people do their best work when their talents and interests align with their roles. By encouraging growth, development, and new opportunities, Chris fosters a culture where team members are empowered to build meaningful careers while contributing to the success of #oneTEAM.

CM speaking
Central - CM (30)

North Risk CEO Chris Meidt speaking at the Minneota stadium dedication to his father, Gerhard Meidt. Picture courtesy of Photos by Emma J Lipinski.

Chris Meidt speaking at a North Risk Partners All-Company Meeting.

Community service is equally central to Chris's leadership philosophy and reflects the example his father set throughout his life. The pillars of North Risk's mission are service to clients, communities, and each other, and Chris challenges team members to live out those values every day. Whether through volunteerism, charitable giving, mentorship, or simply helping a colleague in need, he encourages every member of #oneTEAM to lean in and #LightTheWay for others, carrying forward a legacy of service that extends far beyond the workplace.

"There's more to winning than just winning. Bringing people along with you, cheering on your teammates more than you cheer for yourself, understanding that team has to come first at all times."

Those same values were reflected in the effort to renovate and rename the stadium. What started with replacing a malfunctioning scoreboard quickly became a community-wide project. One that involved former players, local families, school leaders, city officials, and donors who wanted to honor a man many credit with helping establish Minneota's culture of excellence. The project included upgraded lighting, new signage, a new scoreboard, and the official designation of Gerhard Meidt Stadium.

For Chris, the most meaningful part of the recognition is not the facility itself, but what it represents.

"I want everyone to feel like they contributed something to this. It should be a night where we get to rejoice in a great man and what he built, but even a greater community that has continued building it."

That legacy lives on today through the students, athletes, coaches, and community members he inspired, and through leaders like Chris, who continue to champion the importance of youth athletics, mentorship, and community involvement.

The 2026 Minneota football team entered the season tied with the program's historic 48-game winning streak established during Gerhard's coaching tenure in the 1980s. On September 18, they officially broke the record with their 65-14 victory over Canby, the same game celebrating the stadium dedication honoring Gerhard and his legacy. Yet Chris says his father never viewed success through the lens of records or recognition. He cared most about helping others succeed.

As generations of students walk through the gates of Gerhard Meidt Stadium, they will be reminded that leadership is not measured simply by wins and championships. It is measured by the lives changed along the way.

North Risk CEO Chris Meidt with his father, Gerhard Meidt.

 

]]> How to Handle Workplace Investigations https://northriskpartners.com/how-to-handle-workplace-investigations/ Fri, 16 Oct 2026 15:14:32 +0000 https://northriskpartners.com/?p=28266

October 2026

Employee concerns can quickly become complex situations with legal, cultural, and employee relations implications. Knowing how to respond appropriately is essential for protecting both your people and your organization. In this webinar, you'll learn practical strategies for conducting workplace investigations with confidence and handling sensitive situations effectively.

 

What you'll learn:

  • When a workplace concern requires a formal investigation
  • Best practices for interviews, documentation, and record retention
  • How to create clear, objective investigation reports that support decision-making

 

Webinar presented by: 

Jordan Cardenas

Attorney

Wagner, Falconer & Judd

 

Andy Johnson

Attorney

Wagner, Falconer & Judd

Looking for the webinar recording and slides?

Contact your North Risk Partners advisor. Don’t have an advisor? We’ll help you find one.

Find an Advisor
]]> Navigating Cybersecurity Challenges in the Construction Industry https://northriskpartners.com/navigating-cybersecurity-challenges-in-the-construction-industry/ Mon, 12 Oct 2026 19:41:01 +0000 https://northriskpartners.com/?p=31929

The construction industry is continuously moving toward digitization, adopting advanced technology such as artificial intelligence, the Internet of Things (IoT), and Building Information Modeling software. These innovations help to automate tasks, reduce waste, and improve efficiency, productivity, and safety.

However, this shift also brings significant cybersecurity risks. As construction companies rely more on digital tools and store large amounts of sensitive data, cybercriminals increasingly see them as attractive targets. As a result, construction businesses must take action to protect sensitive information from data breaches and other cybersecurity incidents that can create financial hardship and reputational damage.

This article explains why cybercriminals target the construction industry, describes common cyberattacks and why they use them, and offers cybersecurity best practices. It also examines the role of cyber insurance in mitigating cyber risks.

Why Cybercriminals Target the Construction Industry

There are several reasons why the construction industry is an appealing target for cybercriminals, including:

  • High-value transactions—Construction projects often involve significant financial transactions, making them attractive targets for ransomware, phishing attacks, and financial fraud. The high value of these transactions can incentivize cybercriminals to attempt fraudulent payments or extortion.
  • An abundance of sensitive data—Construction companies manage sensitive data like blueprints, architectural designs, bids, contracts, and employee and client information. This data is valuable to cybercriminals, who can exploit it for financial gain through data breaches or sell it on the dark web.
  • Complex supply chains—With multiple stakeholders and subcontractors involved in construction industry supply chains, each with potentially varying levels of cybersecurity maturity, the odds of network vulnerabilities increase. Malicious actors may target these weak links in the supply chain, as they may serve as potential access points for cyberattacks.
  • Outdated cybersecurity measures—Many construction firms rely on legacy systems or outdated software that does not provide adequate protection against modern cyberthreats. These weaknesses present attractive opportunities for intrusion by hackers, who often seek out older systems that have known vulnerabilities and are easier to exploit.
  • Increasing adoption of digital technologies—The digital attack surface has expanded with the construction industry’s increasing use of digital technologies (e.g., IoT, remote project management, cloud storage). Although these technologies improve efficiency, they have also created more opportunities for malicious actors to infiltrate networks.

Common Cyberattacks and Why They Are Utilized

There are many types of cyberattacks. The following are commonly used against the construction industry for various reasons:

Cybersecurity Best Practices for the Construction Industry

Although cyberthreats are numerous and evolving, there are several measures construction businesses can take to safeguard computer systems and networks:

  • Employee training and awareness programs help employers educate workers about cyberthreats. They also allow discussion on combating cyber risks by following the organization’s cybersecurity policies and procedures.
  • Multifactor authentication can add additional layers of protection through authenticators, such as one-time passcodes or time sensitive links, before a user can access a company’s network or system.
  • Regular software updates and patch management can ensure software programs are best positioned to defend against the latest cyberthreats.
  • Network segmentation divides a network into smaller parts so that if it is infiltrated, there will be security barriers to prevent lateral movement across the network.
  • Access controls limit who can view or access sensitive information and the situations when they may do so.
  • Data encryption transforms data into an unreadable, encoded format so malicious actors cannot decipher it without the correct key.
  • Data backup and recovery systems allow businesses to quickly recuperate after cyberattacks (e.g., ransomware or DDoS attacks) because their data is stored in another place (e.g., external hard drives or a cloud) and can be quickly reloaded onto systems to minimize downtime.
  • Vendor and supply chain management ensures companies select and work with vendors with strong cybersecurity practices. By carefully vetting partners, construction companies can reduce the risk of supply chain attacks.
  • Incident response planning and testing allow construction companies to proactively build their cyber defenses by having policies and procedures to respond to cyberattacks and test their systems to find and repair weaknesses.

The Role of Cyber Insurance in Mitigating Risk

Even with a robust cybersecurity defense, no system is immune to attacks. Cyber insurance helps mitigate exposure to cyber-related losses, filling gaps that may be left by other policies (e.g., commercial property insurance, general liability insurance, etc.), which typically do not cover cyber-related events. It is specifically designed to cover business interruption and other financial losses that result from cybersecurity incidents, such as data breaches and ransomware attacks.

Many cyber insurance policies provide access to a vendor panel that includes legal counsel, public relations firms, IT specialists, and other experts who are experienced in managing cyber incidents. This can help businesses respond quickly and effectively to mitigate the impact of a cyberattack on operations, reputation, and finances.

Cyberattacks are a serious threat to the construction industry. Cybercriminals can utilize many methods to steal data or disrupt computer networks for financial gain. Strong cybersecurity practices and a proper cyber insurance policy are essential to address this risk. By being proactive, businesses can mitigate this exposure and safeguard their finances and reputations.

If you have questions, please contact a North Risk Partners Advisor.

This blog is not intended to be an exhaustive source of information nor should any discussion or opinions be construed as legal advice. Readers should consult legal counsel or a licensed insurance professional for appropriate advice. © 2026 Zywave, Inc. All rights reserved.

]]> The Importance of Fall Rescue Plans https://northriskpartners.com/the-importance-of-fall-rescue-plans/ Mon, 12 Oct 2026 19:04:41 +0000 https://northriskpartners.com/?p=31924

More than one-third of construction fatalities in 2024 were caused by slips, trips, and falls, according to the most recent data from the U.S. Bureau of Labor Statistics—and most of those deaths resulted from falls to a lower level. Even if a fall arrest system catches a worker, they can experience severe injury or death if not retrieved quickly. That’s why construction employers should implement and maintain comprehensive fall rescue plans (FRPs).

This article explains why FRPs matter and outlines key elements to include in these plans.

Why Do FRPs Matter?

FRPs provide detailed, jobsite-specific instructions for swiftly and safely retrieving a fallen worker. They’re a required part of an overall fall prevention plan, which identifies fall hazards and outlines how to reduce or eliminate them.

There is still a risk of serious injury or death even after a worker’s fall has been arrested by safety equipment. A worker suspended upright can develop suspension trauma—also called orthostatic intolerance or harness hang syndrome—when blood pools in the lower extremities instead of recirculating. This deprives the brain and vital organs of oxygenated blood and can cause unconsciousness, organ damage, or death within minutes. A prompt, well-rehearsed rescue is critical to avoiding these outcomes.

What to Include in an FRP

An FRP must cover a range of rescue scenarios and procedures. OSHA standards require employers to provide prompt rescue after a fall or ensure employees can self-rescue. Not every fall calls for the same response, so an FRP should clearly explain how to recognize and handle each scenario:

  • Self-rescue situations—A suspended worker can safely lower themself to the ground.
  • Assisted rescue situations—Trained personnel use equipment to retrieve a worker who cannot get down on their own, whether due to injury, unconsciousness, or lack of equipment.

In addition, FRPs should include:

  • Roles of authorized rescuers and site personnel
  • Types, location and use of rescue equipment (e.g., ladders, lifts, first-aid kits)
  • Guidance on post-rescue monitoring, since injuries aren’t always immediately apparent
  • Contact information for additional people who may need to respond to the rescue, such as site supervisors, safety managers, staff trained on first aid, nearby hospitals and first responders, and the local OSHA office

Employers should train employees on their FRP at least annually and any time the plan changes. Newly hired employees should be trained as part of onboarding, before they’re exposed to fall hazards. Keep the plan, equipment inventory, and training records current and easy to locate on-site.

FRPs are essential for creating a safe work environment. By providing clear, detailed instructions for a quick response after a fall, they help workers avoid severe consequences.

If you have questions, please contact a North Risk Partners Advisor.

This blog is not intended to be an exhaustive source of information nor should any discussion or opinions be construed as legal advice. Readers should consult legal counsel or a licensed insurance professional for appropriate advice. © 2026 Zywave, Inc. All rights reserved.

]]> Built on Growth: Milestones That Shaped North Risk Partners https://northriskpartners.com/built-on-growth/ Mon, 12 Oct 2026 18:22:15 +0000 https://northriskpartners.com/?p=31916

When Chris Meidt joined the organization in 2014, North Risk included approximately 80 employees across three Minnesota agencies. One of the earliest priorities was bringing them together under a shared name, culture, and commitment to becoming one team.

The Story Behind the Growth

What followed was more than a decade of purposeful growth. The milestones below highlight how North Risk evolved from three agencies into one of the Midwest's largest, privately owned independent insurance brokerages.

 

2013: North Risk Partners is formed

9 Minnesota locations | 80 team members

Apollo Insurance, C.O. Brown Agency, and Johnson McCann Benefits come together to create North Risk Partners.

 

2014–2018: A unified organization begins to take shape

21 locations across Minnesota, Iowa, and Nebraska | 300 team members

North Risk establishes its core values and mission of service while completing 16 acquisitions and one merger under CEO Chris Meidt's leadership. By the end of 2018, the organization had tripled in size and expanded beyond Minnesota.

 

2019–2022: “Face Risk Head On” Fuels the Next Chapter

Five-state footprint | 400+ team members

With the introduction of the "Face Risk Head On" brand promise, North Risk continues to build momentum through 14 acquisitions and expanded capabilities. By the end of 2022, the firm serves clients across five Midwestern states and employs more than 400 team members.

 

2023–Today: Continued Investment, Growth, and Industry Recognition

450+ team members across Minnesota, Iowa, Nebraska, North Dakota, and South Dakota

In 2024, North Risk surpassed $100 million in revenue, more than tripling its 2013 revenue. The milestone capped a decade of growth that included more than 50 acquisitions, expansion across the Midwest, and recognition as one of the nation's Top 50 insurance brokerages.

This is North Risk Partners

This story is part of This Is North Risk Partners—an ongoing series highlighting the people, moments, achievements, and milestones that shape who we are.

]]> Medicare Part D Creditable Coverage https://northriskpartners.com/2026-medicare-part-d-creditable-coverage/ Thu, 01 Oct 2026 19:25:30 +0000 https://northriskpartners.com/?p=31894

Employers are not required to offer creditable prescription drug coverage, but they are required to determine and communicate creditable (or non-creditable) status to eligible individuals. This information helps Medicare Part D eligible individuals make informed decisions about enrolling in Medicare Part D and avoid late enrollment penalties.

Determining Creditable Coverage Status

Prescription drug coverage is creditable if the actuarial value of the coverage equals or exceeds the actuarial value of Medicare Part D prescription drug coverage. Employers often rely on insurance carriers or third-party administrators (TPAs) to provide credible determinations. If such information is not provided, the employer must make the determination on their own.

Employers who do not apply for the retiree drug subsidy generally use the “simplified method” for determining whether prescription drug coverage is creditable. If a plan does not meet the criteria under the simplified determination method, the employer may assume the plan is non-creditable, or they may obtain an actuarial determination to confirm.

 

Simplified Method for Determining Creditable Status

For 2026 plan years, employers may choose to use either the existing simplified method per CMS 2009 instructions or the newly revised simplified method for determining creditable status. Beginning in 2027, only the revised simplified method may be used.

Revised Simplified Method (Available Beginning in 2026)

To be deemed creditable, the plan must meet the following criteria:

  1. Provide reasonable coverage for brand name and generic prescription drugs and biological products;
  2. Provide reasonable access to retail pharmacies; and
  3. Pay on average at least 72% (73% for 2027 plan years) of participants' prescription drug expenses.
Existing Simplified Method

To be deemed creditable, the plan must meet the following criteria:

  1. Provide reasonable coverage for brand name and generic prescription drugs;
  2. Provide reasonable access to retail pharmacies;
  3. Pay on average at least 60% of participants' prescription drug expenses; and
  4. Depending upon whether the plan is integrated (most plans are non-integrated):
    • A non-integrated drug plan must have either no annual benefit maximum or a minimum annual benefit of $25,000; OR have an actuarial expectation that the amount payable by the plan will be at least $2,000 annually per Medicare-eligible individual.
    • An integrated plan must: have a maximum annual deductible of $250; have either no annual benefit maximum or a minimum annual benefit of $25,000; AND  have a lifetime combined benefit maximum of at least $1 million.

Disclosure of Creditable Status to Eligible Participants

The creditable status of the plan must be disclosed to Medicare Part D eligible individuals who are eligible to enroll in the plan sponsor’s prescription drug plan. This includes employees, COBRA participants, retirees, as well as their spouses and dependents. Individuals are eligible for Medicare Part D if they are enrolled in either Medicare Part A or Part B and live in the service area of a Medicare Part D plan. Due to difficulties in identifying eligible individuals, many employers choose to provide the disclosure notice to everyone eligible for their prescription drug plan.

 

Timing

Employers can satisfy the annual disclosure requirement by providing the notice each year during the employer’s open enrollment period or in the fall to coincide with the Medicare Part D open enrollment period. The notice must also be provided when individuals are first eligible for prescription drug coverage (e.g., new hires). Additionally, employers must provide notice whenever the employer no longer offers prescription drug coverage, when the creditable status changes, and upon request.

 

Delivery Methods

CMS recommends employers mail paper copies. However, notices may be provided electronically if the DOL’s electronic delivery safe harbor is satisfied. Employers may provide a single notice to eligible individuals and their dependents residing at the same address. If the notice is incorporated with other information or notices (e.g., benefits booklet or enrollment packet), the disclosure should be on its own page, and a prominent reference (in 14-point font) should be included on the first page of the materials listing the notice’s specific page number.

Reporting to CMS

In addition to individual disclosures, employers must report the creditable status of their coverage to CMS annually, within 60 days of the start of the plan year. This reporting is typically completed by the employer, rather than the insurance carrier or TPA. Information necessary to complete the reporting includes employer identification number, type of coverage, number of plan options, estimated number of Medicare-eligible individuals covered, and the date the notice was distributed to participants.

CMS has provided detailed reporting instructions available here.

 

If you have questions, please contact your North Risk Partners Risk Advisor. Don’t have an advisor? No problem. We’ll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]> Gag Clause Attestations https://northriskpartners.com/gag-clause-attestations/ Thu, 01 Oct 2026 16:43:44 +0000 https://northriskpartners.com/?p=31874

Group health plans are prohibited from entering into agreements containing contractual 'gag clauses' which operate to restrict access to provider cost, quality, or de-identified claims data. Most employer-sponsored group health plans must annually attest to compliance with these requirements via the Gag Clause Prohibition Compliance Attestation portal hosted by the Centers for Medicare and Medicaid Services (CMS).

CMS created a webpage with information about how to comply with the gag clause prohibition as well as how to attest to compliance, which you can find here.

Which Plans Must Comply?

The gag clause prohibition and attestation requirements apply to most employer-sponsored health plans, but not excepted benefits (e.g., stand-alone dental or vision, health FSA), retiree-only plans, or account-based plans (e.g., HRAs). The employer should consider all contracts with service providers in connection with its health plan(s). Beyond the carriers and TPAs, there may be additional service providers that need to be considered. For example, provider contracts with and coordinated by PBMs, behavioral health vendors (e.g., network agreements for mental health providers), telehealth arrangements, direct primary care arrangements, and other medical providers (e.g., access to preferred pricing for certain procedures if using particular providers) are also prohibited from having gag clauses and should be considered by the employer when attesting to compliance.

Who Must Complete the Attestation?

Service providers (e.g., carriers or TPAs) may attest for the group health plan on behalf of sponsoring employers, but carriers and TPAs have taken a varied approach to this. If the carrier (on behalf of a fully-insured plan) or TPA (on behalf of a self-funded plan) agrees to attest on behalf of the plan, the employer can rely on that attestation. However, if the carrier, TPA or any other service providers will not attest to compliance on the plan’s behalf, the employer needs to confirm no gag clauses are present in the contracts they have entered into on behalf of the plan and will then need to attest accordingly.

Employer Responsibilities

Employers should establish procedures to identify all provider-related contracts, verify vendor compliance, and complete the annual CMS attestation when necessary, maintaining all documentation that supports the compliance process. Although carriers and TPAs frequently assist with filing obligations, the sponsoring employer remains legally responsible for performance of the attestation requirement. Therefore, the gag clause attestation requirement gives rise to the following responsibilities:

Identify all service providers that contract with plan providers (e.g., carrier, TPA, PBM, behavioral health, telehealth, etc.).

Determine which vendors agree to submit the attestation on behalf of the underlying plan and, if possible, obtain written verification of the vendor’s agreement to perform the attestation requirement.

If a particular vendor does not agree to submit the attestation, obtain written confirmation of actual compliance with the requirement from the vendor.

Complete and submit the CMS attestation annually by December 31 (to the extent required).

Maintain documentation of the vendor confirmation process and archive all CMS submission and acknowledgement receipts.

Attestation Process

The attestation process itself is a fairly straightforward, requiring only some plan identifying information, employer contact information, and a checked box and signature to indicate compliance. This is done through a web portal. The attestation process can be broken down into four general steps.

1. Confirm compliance. Review any group health plan contracts to confirm there are no prohibited gag clauses. Alternatively, reach out to all carriers, TPAs and any other service providers and ask for written confirmation that contracts they handle on behalf of the group health plan do not contain any prohibited gag clauses. Such documents should be kept in the employer’s files. 

2. Obtain website access. Go to CMS’ portal link above, enter in an email address, and get a unique code to access the attestation form. The website for submitting the attestation can be found here.

3. Complete the attestation form. Fill out the required information in five short sections of the form and then sign off on compliance with the gag clause prohibition requirements.

4. Confirm submission. Upon completion and submission of the form, download the submission receipt and file it away in case of future audit or questions.

If you have questions, please contact your North Risk Partners Risk Advisor. Don't have an advisor? No problem. We'll help you find one.

Find an Advisor

While every effort has been taken in compiling this information to ensure that its contents are totally accurate, neither the publisher nor the author can accept liability for any inaccuracies or changed circumstances of any information herein or for the consequences of any reliance placed upon it. This publication is distributed on the understanding that the publisher is not engaged in rendering legal, accounting, or other professional advice or services. Readers should always seek professional advice before entering into any commitments.

]]>