If you run a small business, you've probably heard that Health Reimbursement Arrangements are the easy way to offer health benefits without the headache of group insurance. QSEHRAs and ICHRAs let you set a budget, reimburse employees for their own plans, and move on with your day. It sounds simple. And for a lot of businesses, it is-until it isn't.
The problem is that the industry oversells the simplicity. Brokers and payroll companies pitch HRAs as a "set it and forget it" solution. But the moment you adopt one, you inherit a set of legal responsibilities that most small owners never see coming. Let's pull back the curtain on what's really going on under the hood.
You Just Became an ERISA Fiduciary
Most people think ERISA only applies to retirement plans. Nope. An HRA is a welfare benefit plan under ERISA law, which means even a three-person shop has fiduciary duties. You need a written plan document, a summary plan description, and a formal process for handling claims and appeals. If an employee disputes a denied reimbursement, you can't just shrug it off. You need a system that meets federal standards.
Plenty of HRA platforms provide template documents, but these are often generic. They might not account for state-specific rules like California's pregnancy coverage mandates or New York's infertility requirements. A template without a lawyer's review is a gamble.
HIPAA Privacy Is Not Optional
Here's a scenario I see constantly: a business owner asks employees to email receipts for doctor visits or prescriptions. Those receipts contain CPT codes, provider names, and sometimes diagnoses. That's protected health information (PHI). Under HIPAA, your HRA is a group health plan. The Privacy Rule applies even if you have fewer than 50 participants, as long as you handle PHI yourself. Most small businesses don't have a Notice of Privacy Practices, a privacy officer, or a Business Associate Agreement with their HRA platform. One employee complaint can trigger an OCR investigation. It's rare, but it happens.
What You Should Do Instead
- Use a third-party administrator that provides a HIPAA-compliant process.
- Sign a Business Associate Agreement with your platform.
- Never collect receipts via unsecured email. Use a secure portal.
ACA Affordability for ICHRAs: The Hidden Math
If you offer an Individual Coverage HRA, you must ensure it's affordable under ACA rules. Affordability means the employee's share of the lowest-cost silver plan in their area, minus your reimbursement, can't exceed 9.12% of their household income. That's tricky because you don't know their household income.
You can use safe harbors like the federal poverty line or W-2 wages, but you have to elect one in your plan document. Most small owners don't. They set a flat dollar amount and assume it's fine. If an employee ends up qualifying for a Premium Tax Credit because your HRA is unaffordable, the IRS can hit you with a $100 per day per employee penalty. That adds up fast.
The Eligibility Data Gap
Another quiet problem: eligibility. If your HRA defines "full-time" as 30 hours per week, you need to track hours accurately. Many small businesses use manual time sheets or a spreadsheet. That data rarely syncs with the HRA platform. An employee who averages 32 hours might be denied reimbursement because the owner thought they were part-time. That's a lawsuit waiting to happen under ERISA.
How to Close the Gap
- Use an HRIS like Gusto or BambooHR that tracks hours automatically.
- Integrate that system with your HRA platform.
- Document eligibility rules clearly in your plan documents.
State Rules That Catch You Off Guard
ERISA preempts state insurance mandates, but it doesn't preempt everything. A few examples:
- California: Your HRA might be considered a health benefit under Labor Code 2802, which creates liability if you mishandle claims.
- New York: Using an HRA to reimburse paid family leave isn't allowed-it's not a state-approved plan.
- Massachusetts and New Jersey: They require employers to report offering coverage to state health connectors. Report the wrong code, and employees face tax penalties.
National HRA templates rarely account for these state-level quirks. You need a local check.
Don't Treat It Like Petty Cash
An HRA is a real health plan with real legal weight. Treat it that way. Use a reputable platform that provides ERISA documents and HIPAA compliance. Integrate your data systems. Review your plan documents annually. And if you're not sure about something, ask a benefits attorney before you set it up.
HRAs are a powerful tool for small businesses, but only when you respect what they are. The compliance iceberg is real, and it has already sunk plenty of unwary owners. Don't be one of them.
Want a compliance checklist for your HRA? Drop me a note. I review these setups every day.