The landscape of American employee benefits is undergoing a significant transformation as businesses seek alternatives to the rising costs and administrative complexities of traditional group health insurance. Health Reimbursement Arrangements (HRAs) have emerged as a cornerstone of this shift, offering a "defined contribution" model that provides employers with budget predictability and employees with personalized healthcare choices. However, as of August 2026, the regulatory environment governing these benefits has become increasingly intricate, requiring a deep understanding of the Internal Revenue Service (IRS), the Employee Retirement Income Security Act (ERISA), the Health Insurance Portability and Accountability Act (HIPAA), and the Affordable Care Act (ACA). For employers, brokers, and human resources leaders, maintaining HRA compliance is no longer a peripheral task but a core fiduciary responsibility, as the penalties for non-compliance can reach hundreds of dollars per employee per day.
The Evolution of the HRA: A Chronology of Regulatory Change
The journey toward the modern HRA began decades ago under Section 105 of the Internal Revenue Code, which allowed for the reimbursement of medical expenses. However, the most significant shifts occurred following the passage of the Affordable Care Act in 2010. Initially, the ACA restricted many types of HRAs, viewing them as "non-integrated" plans that failed to meet market reforms.
The tide began to turn in December 2016 with the passage of the 21st Century Cures Act, which established the Qualified Small Employer Health Reimbursement Arrangement (QSEHRA). This allowed small businesses with fewer than 50 full-time employees to offer tax-free reimbursements for individual health insurance premiums and medical expenses. Recognizing the success of this model, federal agencies issued final rules in June 2019 to create the Individual Coverage HRA (ICHRA) and the Excepted Benefit HRA (EBHRA), effective January 1, 2020. By 2026, these arrangements have matured into a primary vehicle for health coverage, particularly as the "employer mandate" affordability thresholds are adjusted annually to reflect the shifting economic climate.
Defining the Modern HRA Ecosystem
An HRA is an employer-funded, tax-advantaged health benefit that reimburses employees for out-of-pocket medical expenses and, in many cases, individual insurance premiums. Unlike a Health Savings Account (HSA), which is owned by the employee, the HRA is owned by the employer, and funds generally stay with the company if they are not utilized.
There are three primary types of HRAs currently dominating the market:
- The Individual Coverage HRA (ICHRA): Available to employers of any size, the ICHRA allows for varying allowance amounts based on legitimate employee classes, such as hourly vs. salaried or geographic location. It requires employees to be enrolled in individual health insurance that meets Minimum Essential Coverage (MEC).
- The Qualified Small Employer HRA (QSEHRA): Limited to businesses with fewer than 50 full-time equivalent employees (FTEs) who do not offer a group health plan. It has strict annual contribution limits set by the IRS.
- The Group Coverage HRA (GCHRA): Also known as an integrated HRA, this is offered alongside a traditional group health insurance plan—usually a high-deductible health plan (HDHP)—to help employees cover deductibles and other out-of-pocket costs.
The Pillar of Documentation: ERISA and Plan Requirements
The foundation of HRA compliance lies in formal documentation. Under ERISA, an HRA is considered an "employee welfare benefit plan." This designation triggers several mandatory requirements. Employers must have a formal Plan Document that outlines the legal structure of the benefit, and a Summary Plan Description (SPD), which must be distributed to all participants.
Failure to maintain or provide these documents upon request can result in severe financial consequences. In 2026, the Department of Labor (DOL) maintains civil penalties of up to $110 per day for failing to provide an SPD within 30 days of a written request. Furthermore, if the IRS deems an HRA invalid due to a lack of proper documentation, it may reclassify all reimbursements as taxable income. This would subject the employer to back payroll taxes, interest, and penalties, while employees would face unexpected income tax liabilities.
A compliant Plan Document must detail the effective date of the plan, eligibility requirements (such as waiting periods), the named fiduciary, the procedures for amending the plan, and a comprehensive list of what the HRA will and will not reimburse based on IRS Section 213(d).
Privacy and Data Security: The HIPAA Mandate
Because HRAs involve the reimbursement of medical claims, employers often come into contact with Protected Health Information (PHI). HIPAA privacy rules dictate that any employer offering an HRA must adopt written procedures to safeguard this data. This is particularly challenging for small businesses that "self-administer" their plans.
To remain compliant, an employer must establish a "firewall" between the individuals administering the HRA and those making employment decisions. Using PHI to influence hiring, firing, or promotions is a direct violation of federal law. Journalistic analysis of recent DOL audits suggests that the government is increasingly scrutinizing how sensitive health data is stored. Employers are encouraged to use third-party administrators (TPAs) or specialized HRA software to ensure that specific medical details—such as the nature of a surgery or the name of a prescription—are never visible to the company’s executive leadership.
The Affordability Standard and the Employer Mandate
For Applicable Large Employers (ALEs)—those with 50 or more FTEs—the ICHRA has become a vital tool for satisfying the ACA’s employer mandate. However, for an ICHRA to count as a valid offer of coverage, it must meet the "affordability" standard.
In 2026, the affordability threshold is set at 9.96% of an employee’s monthly household income. The IRS provides "safe harbors" to help employers calculate this, using the employee’s W-2 wages or the federal poverty line. If an employer’s ICHRA contribution is too low, and an employee receives a premium tax credit (PTC) through the Exchange, the employer faces significant penalties.
There are two primary penalties under Section 4980H:
- Penalty A (The "Sledgehammer" Penalty): Applies if an ALE fails to offer MEC to at least 95% of its full-time employees and their dependents. In 2026, this penalty is calculated at approximately $3,060 per full-time employee (minus the first 30).
- Penalty B (The "Tack" Penalty): Applies if the employer offers coverage, but it is either unaffordable or fails to provide minimum value. This penalty is approximately $4,590 for each full-time employee who receives a PTC on the Exchange.
Substantiation and the IRS Audit Trail
One of the most common pitfalls in HRA administration is the failure to properly "substantiate" claims. The IRS requires that every reimbursement be backed by third-party documentation. An employee’s word or a simple credit card receipt is insufficient. Documentation must include the date of service, the name of the provider, and a description of the service or product.
Under current guidelines, these records must be maintained for at least seven years. In the event of an IRS audit, the employer must be able to prove that every dollar paid out was for a qualified medical expense as defined by IRS Publication 502 or the CARES Act (which expanded eligibility to over-the-counter medications and menstrual care products).
Strategic Analysis: The Shift Toward Third-Party Administration
The complexity of these requirements has led to a significant decline in self-administered HRAs. Industry data from 2025 and 2026 indicates that over 85% of firms offering an ICHRA or QSEHRA now utilize a dedicated HRA administrator. This shift is driven by the need for automated "notice" fulfillment—such as the mandatory 90-day notice that must be sent to employees before the start of a plan year—and the technical difficulty of managing COBRA requirements.
While QSEHRAs are exempt from COBRA, ICHRAs and GCHRAs are not. This means that when an employee leaves a company, the employer must offer them the chance to continue their HRA coverage at their own expense for a set period. Managing these notices and the subsequent premium collections is a logistical hurdle that many HR departments are ill-equipped to handle internally.
Conclusion and Broader Implications
The rise of HRAs represents a fundamental change in the social contract between employers and employees regarding healthcare. By moving away from the "one-size-fits-all" group plan, companies are empowering their workforce to select insurance that fits their specific doctors and prescriptions. However, this freedom comes with a heavy regulatory burden.
As we move through the 2026 plan year, the emphasis for employers must remain on the "three pillars" of HRA success: meticulous documentation, rigorous privacy standards, and accurate affordability calculations. Those who master these compliance tasks will find that HRAs are an exceptionally efficient way to control costs and attract talent. Conversely, those who ignore the fine print of the IRS and ERISA regulations may find that the "cost savings" of an HRA are quickly erased by federal penalties and legal fees. In the modern era of benefits, compliance is not just a checkbox—it is the very foundation of a sustainable corporate health strategy.
