Mid-Year Legal Roundup: Key 2025 Developments Impacting Health & Welfare Benefits

The first half of 2025 has brought some interesting updates to the health and welfare benefits world, including developments in several fiduciary breach class action lawsuits, vacatur of final HIPAA regulations and legislation making some helpful changes and updates. Some of these developments may warrant plan changes by employers. Below is a brief review of these developments in no particular order.

Non-Enforcement Statement Regarding Final 2024 MHPAEA Regulations

On May 15, 2025, the Departments of Labor, Health and Human Services, and the Treasury (“Departments”) issued a non-enforcement statement regarding final regulations published in September 2024 under the Mental Health Parity and Addiction Equity Act (“MHPAEA”). The final regulations updated existing MHPAEA rules and added new provisions regarding the requirement for group health plans to perform and document a comparative analysis of the nonquantitative treatment limitations (“NQTLs”) under the plan.

The NQTL comparative analysis requirement was added to the law by the Consolidated Appropriations Act, 2021 (“CAA”). For employers with self-insured group health plans, the NQTL comparative analysis has proven difficult to prepare, in large part because it is highly dependent on information in the possession of the plan’s claims administrator and/or pharmacy benefit manager (“PBM”).  The final regulations made it even more difficult for employers to comply with the requirements, adding more detail to an already detailed statutory provision, adding a fiduciary certification requirement and imposing a requirement to consider “outcomes data” in performing the analysis.

In January 2025, the ERISA Industry Committee filed suit challenging the final regulations. On May 12, 2025, the District Court granted a stay (delay) of the lawsuit at the request of the Departments, which said that they were examining the final regulations to determine whether the regulations should be modified or rescinded and that the Departments would be issuing a non-enforcement statement. 

The May 15, 2025 non-enforcement statement says that it applies only to portions of the final rules that were new (as compared to the existing 2013 rules, which did not contain any requirements regarding the NQTL comparative analysis requirement, since that was not added to the law until the CAA was enacted).  The statement noted that the MHPAEA statutory requirements are still applicable, including the CAA-added requirement to perform and document a comparative analysis of the group health plan’s NQTLs.

The non-enforcement statement provides relief from the complicated detail of the final regulation, but it does not eliminate the requirement to perform and document a comparative analysis of a group health plan’s NQTLs or to provide a copy of the comparative analysis to the Department of Labor upon its request. Those requirements remain in the law (in some detail), so plan fiduciaries will need to prepare NQTL comparative analysis documents and be prepared to answer Department of Labor requests.

Vacatur of HIPAA Regulation on Reproductive Health Care

On June 18, 2025, in response to a lawsuit by a Texas health clinic, the Federal District Court for the Northern District of Texas vacated the provisions of a final HIPAA regulation published in April 2024 regarding protected health information (“PHI”) relating to reproductive health care. The Court held that the regulation exceeded HHS’s authority and unlawfully limited a Texas law that required health care providers to report suspected child abuse. The vacatur applies nationwide.

The regulation was published by the Department of Health and Human Services (“HHS”) in response to the U.S. Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Org. which overturned the Court’s 1973 decision in Roe v. Wade, which had held that there was a constitutional right to an abortion.  The regulation placed additional restrictions on disclosures of PHI relating to reproductive health care to prohibit disclosure of such PHI when the purpose for the disclosure is: (i) to conduct a criminal, civil, or administrative investigation into a person for the “mere act” of seeking, obtaining, providing, or facilitating reproductive health care; (ii) to impose criminal, civil, or administrative liability on any person for the “mere act” of seeking, obtaining, providing, or facilitating reproductive health care; or (iii) to identify any person for those purposes. In order for the prohibition to apply, the reproductive health care had to be lawful under the law of the state in which it was provided and under the circumstances it was provided, or be protected, required, or authorized by Federal law under the circumstances in which provided. The regulation would have required employers to update their group health plan’s HIPAA notice of privacy practices and HIPAA privacy policies. Although the restrictions on disclosure became applicable on December 23, 2024, the effective date of the requirement to update the notice of privacy practices was delayed until February 16, 2026, so many employers hadn’t yet updated their notice and will not need to do so unless the regulation is reinstated.  

Based on the District Court’s description of the defense offered by HHS in the lawsuit, it is unclear whether HHS will appeal the decision. Employers that updated their group health plan HIPAA notice of privacy practices and/or their HIPAA privacy policies should revise them to avoid creating confusion regarding the level of protection from disclosure that is available to PHI relating to reproductive health care.

Supreme Court Decision on ACA Preventive Care Coverage Requirement

On June 27, 2025, the U.S. Supreme Court overturned a Fifth Circuit Court of Appeals ruling that preventive care recommendations by the U.S. Preventive Service Task Force (“Task Force”) were invalid. In response to a lawsuit by individuals and health care providers in Texas challenging the enforceability of the preventive care recommendations made by the Task Force, a Texas Federal District Court ruled that recommendations made by the Task Force were not enforceable because the Task Force members were not validly appointed. The Fifth Circuit upheld that determination but put on hold the District Court’s nationwide injunction that would have prevented enforcement of the Affordable Care Act’s requirement that group health plans cover the recommended services without charge to covered individuals. 

The Supreme Court held, in a lengthy if not fascinating opinion analyzing the question of whether the Task Force members are “inferior officers” or “principal officers,” that the Task Force members are “inferior officers” and that they were validly appointed, meaning that their preventive care recommendations are valid.  The result is that employer group health plans continue to be required to cover Task Force preventive care recommendations at no cost to individuals covered by the plan. On July 25, 2025, the Wall Street Journal reported that the Secretary of HHS will dismiss the current Task Force members. Presumably, replacement members could issue revised preventive care recommendations, so employers should stay tuned for potential changes to preventive care coverage requirements for their group health plans.

H.R. 1 Legislation (“One Big Beautiful Bill Act”)

H.R. 1 (the “Act”), signed by the President on July 4, 2025, included several provisions relating to health and welfare benefits.

• The Act retroactively reinstated and made permanent the safe harbor allowing telehealth services to be provided under a high deductible health plan (“HDHP”) before satisfaction of the deductible without disqualifying plan participants from eligibility to contribute to a health savings account (“HSA”).  The safe harbor is retroactive back to January 1, 2025 (plan years beginning after December 31, 2024).  The safe harbor was initially added to Internal Revenue Code section 223 at the start of the pandemic and had expired and been reinstated several times, with the most recent effective period applying for plan years beginning before January 1, 2025.
• The Act increases the maximum dependent care exclusion amount from $5,000 to $7,500 per taxable year (from $2,500 to $3,750 for married individuals filing separate tax returns). This increase may prove to be less beneficial than it would appear to be, since most employer dependent care assistance plans (generally in the form of dependent care flexible spending account plans) have traditionally had to limit the exclusion for (or contributions made by) highly-compensated employees to an amount below $5,000 in order to satisfy the 55%  average benefits nondiscrimination test.
• The Act adds a provision stating that “direct primary care service arrangements” are not treated as “health plans” for purposes of determining whether an individual who is covered under an HDHP is covered under any non-HDHP health plan that would disqualify the individual from being eligible to contribute to an HSA.  In other words, an employer can provide employees enrolled in an HDHP with a “direct primary care service arrangement” at no cost without disqualifying the employees from being eligible to contribute to an HSA.
  
  A “direct primary care service arrangement” is defined as an arrangement under which an individual is provided with medical care consisting solely of primary care services provided by primary care practitioners if the sole compensation to the practitioners for the care is a fixed periodic fee that does not exceed $150 per month (for individual coverage) or $300 per month for two-or-more person coverage.  All direct primary care service arrangements are aggregated for purposes of these dollar limits and the dollar limits are periodically increased for cost-of-living adjustments.  The Act refers to the Social Security Act definition of “primary care practitioner” which is (i) a physician who has a primary specialty designation of family medicine, internal medicine, geriatric medicine, or pediatric medicine or (ii) a nurse practitioner, clinical nurse specialist, or physician assistant (as those terms are defined in the Social Security Act). The Act does not refer to the Social Security Act definition of primary care services (which consists of specified Healthcare Common Procedure Coding System Codes) but does specifically provide that primary care services do not include procedures that require general anesthesia, prescription drugs (other than vaccines), or laboratory services not typically administered in an ambulatory primary care setting.  Presumably, regulatory guidance will be published to provide additional details on direct primary care service arrangements.

Notably, the Act did not include a provision that was in earlier proposed versions of the legislation, which would have permitted employers to provide specific items at onsite health clinics free of charge without causing the health clinic to be considered a “health plan” that disqualifies an individual enrolled in an HDHP from making HSA contributions.  Longstanding IRS guidance on the topic is not particularly helpful regarding the scope of services that can be provided at no charge at an onsite clinic without causing HSA eligibility concerns—essentially describing examples at opposite ends of the spectrum: a manufacturing plant that provides physicals and immunizations, allergy injections, aspirin, and treatment of injuries caused by accidents at the plant is not considered to provide significant benefits in the nature of medical care, so employees are HSA eligible, while a hospital that permits employees to receive care for “all their medical needs” at no charge is considered to provide significant benefits in the nature of medical care, so employees are not HSA eligible. The fact that telehealth services and qualifying “direct primary care service arrangements” are permissible for employees enrolled in an HSA may help to more accurately define the types of services that can be provided without charge at onsite clinics without causing HSA eligibility issues. 

Update on Fiduciary Breach Class Actions

In 2024, class action lawsuits were filed against Johnson & Johnson and Wells Fargo, along with the employee benefits committees that serve as the named plan administrators of their self-insured health plans and individually named committee members, alleging breach of ERISA fiduciary duty in connection with their selection of pharmacy benefit manager (“PBM”) for their self-insured health plans.  In the case of Johnson & Johnson and Wells Fargo, the PBM was Express Scripts.  In March of 2025, a similar class action lawsuit was filed against JPMorgan Chase and its plan fiduciary committee over its selection of Caremark as PBM for its self-insured health plan.  In each case, the plaintiffs allege that the defendants breached their ERISA fiduciary duty of prudence by selecting the PBM and agreeing to “spread” pricing arrangements. 

Under a “spread” (sometimes called “traditional”) pricing arrangement, the contract with the PBM typically guarantees that the aggregate pricing paid by the plan for specified categories of drugs will satisfy specified discount levels. For example, a spread pricing guarantee may state that the aggregate pricing paid by the plan for generic drugs will be “average wholesale price” minus 85%, with “average wholesale price” being determined based on an independent third-party publication.  The price for any particular drug is not guaranteed. As long as the aggregate price paid by the plan over the specified time period satisfies the pricing guarantee, the plan is not entitled to any reimbursement from the PBM.  Spread pricing arrangements may result in the price paid by a plan for a drug being higher (sometimes significantly) than the price at which the drug could be purchased by an individual without using insurance and higher than the amount actually paid to the pharmacy by the PBM. Where the amount paid by the plan to the PBM is greater than what the PBM pays the pharmacy, the PBM retains the excess (the “spread”) as part of its compensation for providing services. The class action complaints allege numerous examples of drugs for which the price paid by the employer health plan was significantly greater than what other pharmacies would have charged to an individual without insurance.

In each case, the defendants have argued that the plaintiffs do not have standing to sue, because they have not suffered harm due to the alleged fiduciary breaches. The early court rulings have been favorable to the plan fiduciaries:

• In January 2025, the U.S. District Court for the District of New Jersey dismissed the fiduciary breach claims in the Johnson & Johnson case on the basis that the named plaintiff did not have standing to sue, in part because the named plaintiff had reached the health plan’s out-of-pocket spending limit in each of the years in question, after which point the health plan paid 100% for covered services and drugs. The court allowed the plaintiffs to file an amended complaint. The amended complaint was filed in March and included a new named plaintiff who hadn’t reached the out-of-pocket spending limit.  Johnson and Johnson filed a new motion to dismiss in April.
• In March 2025, the U.S. District Court for the District of Minnesota dismissed the fiduciary breach claims in the Wells Fargo case on similar grounds, with somewhat more helpful reasoning that a health plan is more similar to a traditional defined benefit pension plan, where a fiduciary’s behavior doesn’t impact the benefit that is provided to the participants, and by noting that the plaintiffs’ alleged price “comparisons” of what the health plan paid for some 260 drugs versus the price at which an uninsured person could obtain the drugs related only to a relatively narrow subset of the thousands of drugs covered under the plan. The court allowed the plaintiffs to file an amended complaint, which was filed in May, adding additional details about alleged financial injuries suffered by the plaintiffs.  Wells Fargo filed a new motion to dismiss in June.
• In June 2025, JP Morgan Chase filed a motion to dismiss the complaint.

If any of the complaints survive the defendants’ motions to dismiss for lack of standing, the defendants presumably will present evidence that the plan fiduciaries conducted robust requests for proposal (RFP) and rigorous negotiation of their service agreement with the selected PBM and that the aggregate pricing paid by the plan was reasonable for the level of services provided.

In reaction to the lawsuits, many employers are taking steps to bolster the formal processes followed by their plan fiduciary for the selection and monitoring of the service providers to their health and welfare benefit plans.

Lawsuits Regarding Tobacco Surcharge Wellness Programs

Many employers maintain wellness programs in connection with their group health plans that charge tobacco-users more to participate in the group health plan. Longstanding HIPAA wellness program regulations permit such “tobacco surcharges” if the wellness program complies with regulatory requirements. The first half of 2025 saw a continuation of the trend of the past few years of lawsuits being filed against employers alleging that the employers’ wellness programs do not comply with the wellness program regulations. In addition, the first half of 2025 saw the continuation of Macy’s defense against a 2017 lawsuit by the U.S. Department of Labor regarding (among other things) its tobacco surcharge program.  The Macy’s case is of interest to all employers that maintain wellness programs because Macy’s latest argument challenges the validity of the wellness program regulations and argues the Federal District Court hearing the case should not give deference to the regulations, citing the Supreme Court’s 2024 decision in the Loper Bright case.  In Loper Bright, the Supreme Court overturned the “Chevron deference” principle, under which courts deferred to agency regulations as the controlling interpretation of a statutory requirement.  If Macy’s succeeds in its defense, all or some of the regulatory requirements for wellness programs may become inapplicable.

In most of the tobacco surcharge cases, the plaintiffs allege that the employer didn’t offer a reasonable alternative method (such as completing a tobacco cessation program) for employees to avoid the premium surcharge or didn’t properly administer the reasonable alternative method, either because the reasonable alternative method was not properly communicated or administered or because the relief from the surcharge for individuals who completed the reasonable alternative was provided only prospectively after completion, rather than applying for the full coverage period.

Employers that operate a wellness program, particularly a tobacco-user surcharge, should examine the operation of their program to confirm that it satisfies the regulatory requirements. 

Contact any member of our Employee Benefits and Executive Compensation team if you would like to discuss these developments.