The MHPAEA Audit Is Not a Checkbox: Why $2 Million DOL Penalties Are Just the Opening Act for Employer-Sponsored Plans

The ERISA Industry Committee's lawsuit against the 2024 MHPAEA Final Rule bought employers a temporary regulatory reprieve. When the Departments of Labor, HHS, and Treasury announced in May 2025 that they would suspend enforcement of the new rule pending litigation plus 18 months, many plan sponsors read that statement and exhaled. That exhale was premature.

The 2013 final MHPAEA regulations remain fully enforceable. The Consolidated Appropriations Act's nonquantitative treatment limitation (NQTL) comparative analysis mandate is still active. The tri-agencies' Fourth Annual Report to Congress, released March 3, 2026, documented an 89% insufficiency rate on submitted comparative analyses. And ERISA's statutory floor requires at least 20 MHPAEA investigations per year, regardless of which administration runs the agency. The $2 million penalty figure circulating in benefits compliance discussions is not a worst-case ceiling. Under ERISA's $150-per-day, per-participant civil penalty structure, it is a plausible midrange outcome for a mid-size employer plan with documented NQTL failures.

The Enforcement Pause Is Not What Most HR Departments Think It Is

The May 2025 non-enforcement statement suspended enforcement of provisions "new in relation to the 2013 final rule." That phrase is doing substantial work, and most plan sponsors are not parsing it carefully enough.

What the pause covers: the 2024 Rule's meaningful benefits requirement, its material differences in access standard, the fiduciary certification requirement, and the expanded comparative analysis framework specific to the new regulations. What it does not cover is equally significant: the requirement to maintain NQTL comparative analyses under the 2013 framework, the CAA 2021 mandate that plans prepare and make those analyses available on request, or the underlying statutory obligation to demonstrate that nonquantitative treatment limitations operate comparably across mental health and medical/surgical benefits.

ERISA Section 104(b) still entitles plan participants to request those analyses and receive them within 30 days. As Groom Law Group noted, those participant requests "can serve as a form of pre-litigation discovery for the plaintiffs' bar." Federal enforcement is paused on specific new-rule provisions; private enforcement is running at full speed.

State regulators add another layer. Federal non-enforcement does not bind state insurance commissioners. Fully insured plans operating in states with independent mental health parity standards face dual compliance exposure even as federal agencies stand down from the 2024 rule's incremental requirements.

What the Fourth Annual Enforcement Report Actually Shows

At 32 pages, the 2026 tri-agencies report is less than a quarter the length of its 2024 predecessor. The current administration signaled explicitly that parity enforcement should not be "unduly burdensome." That tonal shift should not be mistaken for substantive retreat; the data in the report tells a different story.

EBSA sent 85 initial letters requesting comparative analyses and returned 76 insufficiency letters, an 89% insufficiency rate. From there, 34 plans received initial determination letters and 15 received final determinations of noncompliance. CMS, which covers fully insured plans in states without their own enforcement infrastructure, issued four times as many insufficiency letters as EBSA and twice as many final determination letters. One issuer was publicly identified as noncompliant with respect to three separate NQTLs. In FY 2023, EBSA cited 31 MHPAEA violations across 17 investigations. Every noncompliant plan identified in the most recent cycle was self-funded or operated a hybrid self-funded/fully insured structure.

This pattern is not coincidental. Self-funded employers bear direct ERISA fiduciary responsibility for MHPAEA compliance. They cannot deflect that responsibility to their TPA or insurance carrier, and EBSA has said so explicitly.

Why NQTL Comparative Analyses Keep Failing

The technical standard requires plans to document parity at two levels. Design-level means the written criteria for a nonquantitative treatment limitation, such as a prior authorization protocol, must be no more restrictive for MH/SUD services than for analogous medical conditions. Application-level means actual outcomes data showing the limitation operates comparably in practice.

Plans consistently fail the application-level test even when they pass the design-level test. A plan might document that prior authorization criteria are identically worded for mental health and medical services. Auditors then pull claims data and find that mental health prior authorization requests are denied at three times the rate of analogous medical requests, or that authorizations for inpatient psychiatric care expire after seven days while comparable medical admissions receive 30-day authorizations. The written policy said parity. The claims data proved otherwise.

As Insurica's 2026 compliance analysis notes, regulators now expect "data-driven documentation showing that mental health and substance-use-disorder benefits are truly comparable in both design and operation." Documentation that describes intent without demonstrating outcomes is not defensible. Common application-level failures across recent enforcement cycles include mental health provider wait times exceeding medical wait times by more than 50%, per-admission authorization periods shorter for inpatient psychiatric care than for comparable medical admissions, and step therapy protocols requiring medication failures for mental health drugs with no analogous prerequisite for equivalently costly medical treatments.

The $2 Million Penalty Is a Data Point, Not a Ceiling

The penalty exposure for MHPAEA noncompliance runs across multiple channels simultaneously. DOL civil penalties under ERISA can reach $150 per day per affected participant. For a self-funded employer plan covering 500 employees, a single documented NQTL violation sustained across a full plan year produces theoretical exposure well above the $2 million figure that appears in compliance discussions. Actual enforcement settlements cluster below the statutory maximum, but the $2 million figure represents a high-end documented outcome under the 2013 framework, not a ceiling defined by the new one.

Beyond DOL penalties, noncompliant employers face private ERISA litigation, excise tax liability under Internal Revenue Code Section 4980D, state enforcement actions, and class action exposure when systematic denials affected a substantial portion of the covered population. The Epstein Becker Green analysis frames this exposure clearly: the Departments must conduct at least 20 MHPAEA investigations annually by statute, existing investigations remain active, and the agencies will continue pursuing "substantive disparities" rather than documentation format violations.

The private litigation channel deserves particular attention. Plaintiff attorneys now routinely issue ERISA 104(b) comparative analysis requests as an early litigation step. Plans that cannot produce a current, defensible analysis within 30 days are, in practical terms, handing opposing counsel their liability documentation before a case is filed.

The TPA Accountability Gap Plan Sponsors Keep Ignoring

Most mid-size employers managing self-funded plans rely on their TPA's template comparative analysis documentation. That documentation was designed to demonstrate design-level compliance, covering written criteria and formal plan terms. It was generally not built to satisfy the application-level data analysis that auditors and plaintiff attorneys now treat as their primary testing methodology.

The employer reviewed the TPA's template, renewed the contract, and moved on. EBSA's position is unambiguous: that delegation does not insulate the plan sponsor from fiduciary liability. Benefits advisors and brokers who place clients into self-funded arrangements without verifying the quality of TPA comparative analysis documentation are carrying fiduciary risk that few have quantified. ERISA fiduciary duties require prudent monitoring of service providers. A TPA whose MHPAEA documentation consistently produces DOL insufficiency letters is, by definition, a service provider whose performance is not being adequately monitored.

Plans that passed 2022 or 2023 audits based on design-level documentation compliance are now being reviewed against application-level claims data standards. The old test and the current test are different tests.

What a Defensible Comparative Analysis Actually Requires in 2026

A compliant NQTL comparative analysis requires documented parity at both design and application levels, with actual claims data showing comparable approval rates, authorization periods, denial rates, and out-of-network cost differentials. Network adequacy must be supported by real access metrics: provider-to-member ratios, average time-to-appointment, and geographic access data.

The analysis must be updated annually and must reflect current plan terms, current vendor processes, and current outcomes data. A comparative analysis built on 2022 claims data is not defensible against a 2026 audit. Behavioral health utilization patterns shifted substantially between 2020 and 2025; stale evidence demonstrates stale compliance.

The enforcement pause opened a window for plans to close documentation gaps without confronting the additional complexity of the 2024 Final Rule's new requirements. Plans that use this window to build application-level analyses will be in a materially stronger position when the pause ends and the 18-month clock starts. Plans treating the pause as license to delay are accumulating liability under a regulatory framework that never stopped running.