What are ERISA fiduciary duties for employer health plan sponsors?

Under ERISA, employer health plan sponsors are fiduciaries with four core duties: acting solely in the interest of plan participants and beneficiaries, acting for the exclusive purpose of providing benefits, acting prudently (the "prudent expert" standard), and following the plan documents. The 2023 Johnson & Johnson lawsuit and subsequent cases have expanded fiduciary liability to include pharmacy benefit management decisions, vendor selection, and failure to act on known overcharges.

What is the prudent expert standard under ERISA?

The prudent expert standard requires plan fiduciaries to act with the care, skill, prudence, and diligence that a knowledgeable person familiar with such matters would use in similar circumstances. This is a higher standard than the "prudent person" standard — it requires expertise, not just good intentions. Fiduciaries who lack expertise must hire qualified advisors. Documenting the process of vendor selection and benefit decisions is essential to demonstrating prudent expert compliance.

Can employers be personally liable for ERISA fiduciary breaches?

Yes — ERISA fiduciaries can be held personally liable for losses resulting from fiduciary breaches. Personal liability is not limited to the employer entity; individual plan committee members, HR executives, and CFOs who exercise discretionary authority over plan assets can be personally sued. ERISA fiduciary liability insurance (separate from D&O insurance) is available and strongly recommended for plan committee members.

What ERISA fiduciary obligations apply to PBM and vendor selection?

Recent court decisions (Johnson & Johnson, Kraft Heinz, others) have established that ERISA fiduciary duties apply to pharmacy benefit management decisions. Fiduciaries must: conduct a prudent process for PBM selection and monitoring, document the basis for vendor decisions, act on known overcharges or conflicts of interest, and benchmark costs against market rates. Failing to audit a PBM or ignoring known spread pricing may constitute a fiduciary breach.

What documents must ERISA health plan sponsors maintain?

ERISA requires health plan sponsors to maintain: a written plan document, a summary plan description (SPD) distributed to participants, a summary of material modifications (SMM) for plan changes, annual Form 5500 filings (for plans with 100+ participants), and records of fiduciary decision-making processes. Plan documents must be available to participants within 30 days of request. Failure to maintain and distribute required documents can result in penalties of up to $110 per day.

ERISA compliance

ERISA Fiduciary Duty for Health Plan Sponsors

Every employer that sponsors a health plan subject to ERISA is a fiduciary. That is not a technicality — it is a personal legal obligation that can result in individual liability, plan restoration orders, and civil penalties. Most employers who sponsor health plans do not fully understand what fiduciary duty requires of them. This page covers the five core duties, who is a fiduciary, prohibited transactions, and the practical steps that protect plan sponsors.

What it means to be an ERISA fiduciary

Under ERISA, a person is a fiduciary to the extent they exercise discretionary authority or control over plan management, plan assets, or plan administration — or render investment advice for compensation. The definition is functional, not title-based. An HR director who makes benefit decisions without a formal "fiduciary" designation is still a fiduciary. A committee member who rubber-stamps vendor selections without independent review is still a fiduciary.

ERISA fiduciary liability is personal. The employer entity may be liable, but so are the individual officers, directors, and employees who exercised fiduciary functions. Fiduciary liability insurance covers defense costs but does not eliminate the underlying obligation. The DOL actively investigates and litigates fiduciary breaches — and the volume of health plan fiduciary litigation has increased significantly since the CAA's broker compensation disclosure requirements took effect.

The most important thing to understand about ERISA fiduciary duty is that it requires process, not just outcomes. A fiduciary who follows a prudent process and reaches a reasonable decision is protected even if the outcome is bad. A fiduciary who reaches a good outcome through an undocumented, ad hoc process is not protected. Documentation of the decision-making process is the primary defense against fiduciary claims.

Who is a fiduciary for a health plan?

The employer (as plan sponsor) is a named fiduciary by default

HR and benefits staff who exercise discretionary authority over plan administration

Benefits committees and their individual members

Trustees of plan assets

Investment managers (for retirement plans; less common for health plans)

Service providers who exercise discretionary authority — including some TPAs

The five ERISA fiduciary duties

ERISA codifies five core fiduciary duties. Each applies to health plan sponsors, though the practical implications differ from retirement plan fiduciary obligations.

Prudent expert standard

Fiduciaries must act with the care, skill, prudence, and diligence that a knowledgeable person familiar with such matters would use. This is not a "reasonable person" standard — it is a "knowledgeable expert" standard. Ignorance of benefits law is not a defense; the standard requires fiduciaries to either develop the expertise or hire advisors who have it.

Duty of loyalty (exclusive benefit rule)

Fiduciaries must act solely in the interest of plan participants and beneficiaries. Decisions must be made for the exclusive purpose of providing benefits and defraying reasonable plan expenses. Decisions that benefit the employer at the expense of participants — even inadvertently — can constitute a fiduciary breach.

Duty to diversify

Primarily applicable to retirement plans, but health plan fiduciaries must also avoid concentrating plan assets or decisions in ways that create undue risk. For health plans, this most commonly arises in stop-loss purchasing and captive arrangements.

Duty to follow plan documents

Fiduciaries must administer the plan in accordance with the plan documents — unless doing so would violate ERISA. This means the plan document must be accurate, current, and actually followed. Informal practices that deviate from the plan document create fiduciary exposure.

Duty to monitor service providers

Fiduciaries who delegate functions to service providers (TPAs, PBMs, stop-loss carriers) retain a duty to monitor those providers. Delegation does not eliminate fiduciary responsibility — it requires ongoing oversight to ensure the provider is performing its obligations and that fees are reasonable.

Prohibited transactions

ERISA Section 406 prohibits certain transactions between the plan and parties in interest, regardless of intent. Prohibited transactions trigger excise taxes under IRC Section 4975 and can result in DOL enforcement action. The most common prohibited transactions in health plans involve service provider compensation arrangements.

Self-dealing: A fiduciary using plan assets for their own benefit or the benefit of a party in interest.

Kickbacks: Receiving compensation from a service provider in connection with a plan transaction.

Transactions with parties in interest: Selling, leasing, or lending plan assets to a party in interest (employer, service provider, etc.) without an exemption.

Excessive compensation: Paying unreasonable fees to service providers — including TPAs, PBMs, and brokers — without benchmarking.

Eight steps that protect plan sponsors

Document every significant plan decision — vendor selection, benefit changes, fee negotiations — in writing

Benchmark service provider fees against market rates at least every 3 years

Review plan documents annually and update them to reflect actual plan operation

Conduct a formal RFP process when selecting or renewing major service providers

Obtain and review Form 5500 filings and audit reports for self-funded plans

Ensure all service providers with discretionary authority have signed fiduciary acknowledgments

Obtain fiduciary liability insurance — it does not eliminate liability but covers defense costs

Review CAA broker/consultant compensation disclosures annually

Check your plan's ERISA compliance posture

The Compliance Health Check evaluates your plan's fiduciary documentation, plan document currency, and service provider oversight against ERISA requirements.

Compliance Health Check ← Compliance hub