Cybersecurity Risk Assessment and Employee Benefit Plans: Fiduciaries' Duty to Protect Plan Information

Description

Data breach prevention and response is an increasingly pressing issue for many industries, including employee benefit plans. The 2015 data breach of Anthem impacted employers and health plans nationwide, and the DOL has been warning plan administrators to take measures to protect ERISA plan information. However, plan sponsors and fiduciaries face complex and sometimes contradictory regulations that differ based on the type of plan involved.

Unlike the liability for breaches of healthcare plans where the standards and liability are more certain (e.g., HIPAA, HITECH), the standards and liability under ERISA for retirement benefits plans are inconclusive. The ERISA Advisory Council recently provided DOL with limited guidance on cybersecurity risks. However, the guidance fails to address the scope of ERISA fiduciary obligations regarding cybersecurity.

Audit advisers of ERISA plans are responsible for identifying scenarios where a data breach or risk may materially impact a plan's financial statements or plan assets, but are not explicitly required to address cybersecurity in a financial statement audit. Where the plan utilizes third parties for records and transaction documentation, a SOC 2 examination of the service organization involved requires auditors to address the cybersecurity controls and risks present in the third-party provider's systems.

Listen as our expert panel provides guidance to benefits counsel on trends in data breaches of ERISA healthcare and retirement plans. The group will review the recent BCBS/Anthem litigation, discuss the scope of fiduciary obligations to prevent breaches, ERISA preemption of state data breach laws, and contractual risk mitigation with TPAs.