ACA Reporting Updates & HIPAA Privacy Rule Changes: 2026 Employer Compliance Guide

As we move through another busy compliance season, employers must stay ahead of important updates related to ACA reporting and HIPAA Privacy Rule requirements. Recent federal legislation has introduced meaningful flexibility to Affordable Care Act reporting, while new HIPAA rules require updates to Notices of Privacy Practices—particularly for plans handling substance use disorder data.

Here’s what you need to know and what action steps to take now.

Affordable Care Act (ACA) Updates Form 1095 Distribution Deadline
The March 2 deadline to furnish Forms 1095-B and 1095-C to employees is quickly approaching. If you have not already done so, it is critical to confirm that these forms have been distributed—or that you are compliant with the alternative distribution method now permitted under federal law.

Recent legislation has expanded flexibility for employers when furnishing these forms.
See our past blog post here.

What Changed?
You may remember that President Biden signed the Employer Reporting Improvement Act and the Paperwork Burden Reduction Act into law, providing updates to ACA reporting requirements under Internal Revenue Code Sections 6055 and 6056. These changes applied the beginning with 2024 reporting (due in early 2025).

1. Electronic Delivery & Alternative Distribution Method

The law codifies the ability for Applicable Large Employers (ALEs) to provide Forms 1095-B and 1095-C electronically with employee consent. Consent is presumed if an individual previously agreed to receive statements electronically, though it may be revoked in writing.

In addition, employers may now use an alternative method of furnishing Forms 1095-B and 1095-C:

• Employers are not required to automatically distribute the forms.
• Instead, they may provide a clear, conspicuous, and accessible notice informing individuals that a copy is available upon request.
• Upon request, the form must be furnished by January 31 or within 30 days of the request (whichever is later).
• This streamlined method reduces administrative burden while maintaining employee access.

2. Extended Response Time for ESRP Assessments

Applicable Large Employers (ALEs) subject to Employer Shared Responsibility Payment (ESRP) assessments now have 90 days (extended from 30 days) to respond to proposed IRS penalty notices.

This change provides employers additional time to review, correct discrepancies, and respond appropriately.

3. Six-Year Statute of Limitations

The legislation establishes a six-year statute of limitations for IRS assessments related to employer shared responsibility payments. Previously, no explicit limitation period existed.

Employers should ensure document retention policies align with this new six-year timeframe.

4. TIN Reporting Flexibility

When a covered individual’s Tax Identification Number (TIN) or Social Security Number (SSN) is unavailable, employers may use the individual’s name and date of birth instead. While previously permitted in practice, this flexibility is now formally codified.

Important Reminder on State Reporting
These federal changes apply only to IRS reporting obligations. Employers operating in states with their own individual mandate reporting requirements must continue to comply with applicable state laws, which may not mirror federal flexibility.

ACA Action Items

• Review current ACA reporting processes.
• Confirm whether you will utilize the alternative furnishing method.
• Coordinate with ACA reporting vendors regarding implementation.
• Update employee communications accordingly.
• Ensure document retention policies reflect the six-year statute of limitations.
• Monitor state reporting requirements separately.

HIPAA Privacy Rule Updates
Notice of Privacy Practices (NPP) Deadline was: February 16, 2026
Download your sample here.

Under HIPAA, covered entities must maintain and distribute a Notice of Privacy Practices (NPP) explaining how Protected Health Information (PHI) may be used and disclosed.

Recent updates to the HIPAA Privacy Rule require modifications to Notices of Privacy Practices, particularly concerning how plans handle certain substance use disorder (SUD) data under updated Part 2 regulations.

Employer-sponsored health plans that qualify as covered entities must update and distribute the modified NPP by February 16, 2026.

Who Must Update the Notice?

• Fully insured plans: Typically may rely on carriers to update and distribute the notice (confirm with your carrier).
• Self-funded or level-funded plans: Plan sponsors are generally responsible for updating and distributing the notice.
• Health Care FSAs and HRAs: These may be treated as self-funded plans and could require updated notices.
• Federally assisted substance use disorder treatment programs: Must provide an updated Part 2 Patient Notice.

Distribution Requirements
Your method of distribution depends on how plan documents are currently shared:

If you maintain an intranet or benefits site:

• Post the updated notice by February 16, 2026.
• Notify employees that the notice has been updated and explain how to access it.
• You may distribute the full document at the next open enrollment.

If employees have work-related computer access and receive documents electronically:

• Distribute the updated notice within 60 days of the material change.

If employees lack work-related computer access or have not consented to electronic delivery:

• Deliver a paper notice within 60 days of the change.

Model Notices Available
Download here.

The Department of Health and Human Services has released updated model Notices of Privacy Practices and a model Part 2 Patient Notice to assist employers in compliance efforts.

Employers should review these models and coordinate with legal counsel, compliance teams, or benefits advisors to ensure proper implementation.

These ACA and HIPAA updates offer both relief and responsibility. While ACA reporting has become more flexible, HIPAA privacy requirements demand timely action—particularly for self-funded and level-funded plans.

Staying proactive now helps avoid penalties later.

If you have questions about ACA reporting, HIPAA notice updates, or how these changes impact your specific plan structure, please contact your Account Team for guidance and support.