A few months ago, I sat across from an HR director who was genuinely proud of the benefits refresh she’d just rolled out. Her team had spent months integrating the HSA enrollment flow with the retirement plan’s investment dashboard. Employees could now pick from a hand-picked list of ten Vanguard funds-selected by the company’s investment committee-and even opt into automatic quarterly sweeps from cash into a target-date fund. Engagement numbers were up. Everything felt polished. Then she asked me a question no one on her team had raised during the entire project: “We didn’t just turn our HSA into an ERISA plan, did we?”
The silence that followed said everything. The answer, quite possibly, was yes. Not because anyone intended to, but because a line most benefits teams don’t even know exists had been crossed-quietly, in a user experience meeting, by people trying to be helpful. That line separates a hands-off health savings account from an ERISA-governed retirement plan, and it lives inside your HSA investment design. It’s the trap almost nobody talks about.
How a Well-Meaning Curation Becomes a Fiduciary Trigger
Most benefits people know the Department of Labor’s safe harbor for HSAs. Keep employer involvement minimal. Choose a custodian, negotiate fees, let employees contribute pre-tax through a Section 125 cafeteria plan. Participation must be voluntary, and you can’t accept compensation from the HSA provider. If you check those boxes, the arrangement isn’t an ERISA plan, and you sleep well at night.
But that safe harbor has a blind spot the size of a 401(k) plan: investment control. The DOL has been clear about this for years-Field Assistance Bulletins 2004-1 and 2006-2 specifically warn that if an employer influences how HSA funds are invested, the whole thing can flip into ERISA territory. Influence can mean limiting choices to a curated menu, endorsing certain funds, or (critically) making any investment decision on behalf of an employee. Once that happens, you’re not just offering a savings account. You’re a fiduciary, on the hook for prudent selection, ongoing monitoring, fee reasonableness, and Form 5500 filings. Most HR departments are not built for that, and most benefits administration platforms don’t even have a button for it.
I’ve seen the trigger pulled in painfully innocent ways. A broker asks the investment committee for “a solid lineup” to include in the HSA. Someone in finance decides to feature low-cost index funds and limits the brokerage window to those options. That act of selecting, filtering, and presenting a subset is enough. The employer has now endorsed those investments. And yet, this nuance almost never surfaces during open enrollment planning because everyone assumes the HSA lives safely inside the cafeteria plan. It doesn’t. The cafeteria plan covers contributions. The investment arrangement is its own regulatory creature, and it’s far more dangerous than people realize.
When Your Benefits Platform Becomes an Accomplice
Here’s where the systems angle gets interesting-and frankly, a bit alarming. Modern ben admin tools are fantastic at enrollment, payroll feeds, and even basic HSA contribution tracking. But they are not built to support an ERISA-covered health plan that also manages investments. Not even close. When I poke around the configuration of popular platforms, I routinely find that:
- Fiduciary audit trails are nonexistent. There’s no module to document the prudent process behind selecting and monitoring investment options-the very thing a DOL examiner would request first.
- Fee disclosure and benchmarking are entirely absent. In the 401(k) world, 408(b)(2) regulations require a detailed accounting of revenue sharing and plan costs. HSA investment modules have no such equivalent. If your plan becomes ERISA, you’re flying blind on fees that might be eating into employee balances.
- Form 5500 support doesn’t exist. Because platforms assume a non-ERISA environment, they won’t auto-populate a single field. You’d be manually piecing together data from bank statements, payroll records, and investment reports while a deadline looms.
- Participant-level fee allocation isn’t tracked. If the plan receives any revenue sharing or sub-transfer agency fees, you need to allocate those properly. Most systems lack the engine to do that, and that gap alone can blow up your fiduciary compliance.
Add to that the popular new trend of automatic cash sweeps into investment options-a sort of QDIA (Qualified Default Investment Alternative) for HSAs. It sounds brilliant on a whiteboard: get employees past the inertia of cash by automatically moving balances above a certain threshold into a diversified fund. But here’s the problem: by sweeping money without the employee’s specific direction, you’ve just made an investment decision on their behalf. That’s the hallmark of fiduciary control. If you haven’t already structured the HSA as an ERISA plan, you can’t do that safely. And if you have structured it as an ERISA plan, you’ve suddenly activated a cascade of compliance obligations your technology probably can’t support.
Three Ways Forward, Each Demanding Systems Discipline
None of this means you should kill HSA investing. Far from it. The triple tax advantage is too powerful to ignore. But it does mean you need to be ruthlessly intentional about how the investment piece is designed and what your technology stack can actually handle. In my work with large employers, I see three viable paths emerge-each one a deliberate choice, not an accident.
- Stay in the Safe Harbor with a Pure Brokerage Window. Offer the custodian’s self-directed brokerage window and nothing else. No curation, no defaults, no employer branding on the investment page. Every available fund, stock, and ETF appears without filtering or highlighting. All educational content comes directly from the custodian-not your benefits portal. The enrollment platform’s job is to show a simple link: “Access your HSA investment options.” That’s it. The user interface must not rank, compare, or recommend. This path keeps you comfortably inside the DOL’s safe harbor because you’ve made exactly zero discretionary decisions about investments. The discipline here is entirely technological: you have to police the UX to ensure no implicit endorsement creeps in.
- Embrace ERISA with Intentional Infrastructure. If your organization genuinely wants a managed, 401(k)-like experience-curated funds, QDIA, integrated dashboards, the works-then stop pretending it’s not an ERISA plan. Formally establish the HSA as one. Adopt an investment policy statement. Select a recordkeeping platform that can handle fiduciary reporting, fee benchmarking, and Form 5500 generation. This is heavy lifting, and it requires bridging HSA investment data into your retirement plan dashboard, often with custom APIs and rigorous privacy controls because medical and investment data will now mingle. For large employers with sophisticated benefits and a dedicated fiduciary committee, it can be worth the effort. But don’t walk this road unless you’re ready to staff and fund the compliance infrastructure. The systems barrier is the real gating factor.
- Exploit the “Cafeteria Plan Firewall” - But Understand Its Limits. A common misconception is that because the HSA sits inside a Section 125 plan, the employer is automatically insulated from ERISA liability on all fronts. That’s wrong. The cafeteria plan covers the salary reduction election, not the underlying investment arrangement. A well-built system will sever those two universes entirely, so the employee never perceives employer endorsement from the flow. But I’ve rarely seen a platform that does this cleanly. Most blend everything into a single “HSA” screen, blurring the lines. If you’re going to rely on this firewall, test it ruthlessly. Can an employee access investment options without ever seeing a page that bears your company’s logo or language that implies selection? If the answer is no, you’re at risk even without a curated fund lineup.
The Question Nobody’s Asking-Until the Audit Letter Arrives
There’s a reason this trap stays hidden. Enforcement from the DOL on HSA investments is still nascent. But the legal architecture of a violation is clear as day, and I’ve watched too many well-meaning benefits teams arm-wrestle with ERISA consequences they never intended to trigger. The safeguard isn’t complicated, but it demands a level of systems awareness that most organizations haven’t cultivated yet. Every time you touch the HSA investment experience with an employer-initiated decision-whether it’s selecting funds, setting sweep rules, or even branding a curated list-ask yourself one brutally simple question: “Who chose these funds?”
If the answer is anyone on your payroll, or anyone acting at your direction, you may already be in deeper than you think. Better to figure that out now, while you can still fix the configuration, than to explain it later to an auditor holding a copy of your enrollment wizard.