For employers with employees in San Francisco, the Health Care Security Ordinance (HCSO) can appear straightforward at a high level¹: identify which employees are covered under the law, measure healthcare expenditures, and make up any shortfall. In practice, however, compliance often becomes more complicated once employers dig into the mechanics of employee elections, self-funded plan valuation, and annual reporting. That complexity is especially relevant now because minimum healthcare expenditure rates increased for 2026.

The HCSO requires that for-profit employers with 20+ workers and at least one employee with eligible hours worked in San Francisco spend at least $4.11 (Large Business²) or $2.74 per hour (Medium-sized Business³) on their employees’ healthcare, net of any respective employee contributions for healthcare. Required expenditure rates for 2026 increased from $3.85 to $4.11 per hour for large employers and from $2.56 to $2.74 per hour for medium-sized employers, with the first quarterly filing made on April 30, 2026. As many employers are navigating higher 2026 HCSO payments, the increase in expenditure rates offers a timely opportunity for employers to review their HCSO compliance process. Failure to meet all compliance requirements using supportable methodology⁴ could result in investigation, corrective action, and penalties from the San Francisco Office of Labor Standards Enforcement.

Key opportunities for plan sponsors within HCSO

Many employers think of the HCSO primarily as a quarterly funding exercise, but the annual filing often reveals whether the underlying process is truly cohesive. The annual report is more than an administrative formality; it can expose disconnects among payroll data, eligibility determinations, waiver tracking, enrollment changes, and the methodology used to attribute healthcare expenditures to specific covered employees. Employers that wait until filing season to test those assumptions may find themselves compressing a year’s worth of reconciliation into a matter of days.

Self-funded plans deserve particular attention. Under the City’s 2025 self-funded plan instructions, employers may not use the COBRA premium rate to calculate required expenditures. Instead, the employer may calculate the annual spend for its self-funded plans; if that annual spend falls short of the applicable HCSO expenditure rate, the employer must make a top-off payment. Examples of healthcare expenditures identified by the law are:

• Payments to a third party to provide healthcare services (such as health, dental, or vision premiums)
• Expenditures made by self-funded programs
• Expenditures made to a union trust fund for healthcare
• Irrevocable contributions to medical reimbursement accounts (such as Health Savings Accounts)
• Costs incurred in the direct delivery of healthcare services

Employers should review and consider whether all eligible components of spend are reflected in the calculation. For example, administrative costs paid to third parties (such as medical plan administrative service costs) can be included as employer spend.

At the same time, quarterly expenditure requirements still apply for employees who are not enrolled in the employer’s insurance. In addition to calculating annual spend, employers with self-funded plans need to understand the intricacies of the quarterly calculation to satisfy the HCSO requirement for employees who waive coverage. Employers should similarly consider whether all components of their healthcare spend have been captured; for example, employer spend on dental and/or vision plans can be included in the fully insured calculation (even if those plans are self-funded).

Plan sponsor action items on HCSO

Review the process, not just the output

• Confirm that your quarterly HCSO process is aligned with how covered employees are identified, how waived coverage is tracked, and how enrollment changes are reflected during the year. Are managers, as defined by the HCSO, being properly identified and excluded from the calculation? Is the 90-day waiting period for new hires being applied correctly?
• Use the new 2026 reporting cycle as an opportunity to test whether payroll, HR, and benefits administration data produce a consistent and supportable compliance narrative.
• Revisit 2026 budgeting and monitoring assumptions in light of the higher hourly expenditure rates, even if your process appeared to be working in prior years. Are you booking higher HCSO required payments in 2026? A process that appeared sufficient in prior years may leave less room for error with the required expenditure rate increase.

Self-funded arrangements require a second look

• Assess whether each self-funded plan is being evaluated using a methodology that reflects the HCSO’s current rules, including the prohibition on using COBRA premium rates. Are all eligible coverages and expense items being considered?
• Identify employee populations that may still require quarterly treatment even where the employer also performs an annual self-funded plan calculation.
• Document assumptions and supporting data before the annual reporting deadline, rather than rebuilding the rationale after a shortfall or filing issue has surfaced.

We’re here to help

Our support is designed to help employers move beyond broad compliance assumptions and toward a more repeatable, defensible approach. That may include identifying where existing processes are working, where the annual report could expose hidden inconsistencies, and where self-funded plan methodologies may warrant a closer review. For employers that have not recently revisited their HCSO approach, the 2026 rate increases present a natural opportunity to do so. Contact Milliman for help with:

• Quarterly HCSO expenditure analyses and employee-level shortfall reviews
• Annual self-funded plan calculations and top-off support
• Annual reporting preparation and process review

This Benefits Briefing is for informational purposes only and should not be construed as legal or tax advice. Please consult professional counsel before taking any action based on this material.

¹ Office of Labor Standards Enforcement. (n.d.). Health Care Security Ordinance. The City and County of San Francisco. Retrieved June 22, 2026, from https://www.sf.gov/information--health-care-security-ordinance.

² The HCSO defines a Large Business as an employer for which an average of 100 or more persons per week perform work for compensation during a quarter. A Medium-sized Business is defined as one having 20–99 persons.

³ Office of Labor Standards Enforcement, op. cit.

⁴ The HCSO requires employers to keep records sufficient to establish compliance with employer spending requirements, healthcare expenditures made, calculations of healthcare expenditures, and proof establishing that such expenditures were made at least quarterly each year (except for self-funded plans).