Author
Elizabeth (Izzy) Montgomery, MPA
Health Policy Analyst
Contact
ACHI Communications
501-526-2244
jlyon@achi.net
Third-party administrators (TPAs) have become fundamental to the operations of self-insured health plans, or plans in which employers pay their employees’ health claims directly instead of contracting with insurance companies. In a self-insured plan, the employer bears the financial risk of employees’ healthcare costs, while day-to-day administration of the plan, from claims processing to network management, is often conducted by a TPA. In 2024, 63% of covered employees in the U.S. were in self-insured plans.[1]
Although TPAs largely operate behind the scenes, their practices directly influence employers’ costs and employees’ access to health care. This explainer examines what TPAs do, how they differ from traditional insurers, the regulatory environment in which they operate, and related policy concerns and issues.
What Is a Third-Party Administrator?
TPAs provide administrative services to support self-insured health plans, but they do not bear any direct financial risk for the cost of care. Employers often contract with TPAs to administer healthcare benefits on their behalf, as many employers lack the resources to manage health plans themselves.[2] This arrangement is distinct from fully insured health plans, in which insurance companies are financially responsible for paying medical claims (see Figure 1). Typical activities of TPAs include:
- Processing plan enrollment and claims for services provided.
- Negotiating and managing contracts and rates with hospitals, physicians, and other healthcare providers.
- Overseeing plan utilization management and prior authorization requirements.
- In some instances, coordinating pharmacy benefits through a pharmacy benefits manager.
Insurance companies often offer TPA services because of the limited financial risk and to leverage economies of scale in their administrative operations. Some of the nation’s largest insurers provide TPA services for a large share of the employers offering self-insured plans.[3] TPA contracts were estimated to represent 76% of covered lives for Cigna, 59% of covered lives for Aetna, and 42% of covered lives for UnitedHealthcare in 2020.[4]
Oversight and Regulation of Third-Party Administrators
Self-insured health plans are governed by the federal Employee Retirement Income Security Act (ERISA), which is enforced by the U.S. Department of Labor. Employers offering self-insured plans are subject to ERISA’s fiduciary standards — including obligations to guard against waste, abuse, and neglect — but ERISA preempts most state laws from applying to self-insured plans.[3] A TPA performing only administrative services on behalf of a self-insured plan is not directly subject to ERISA’s fiduciary standards, but when a TPA exercises discretionary control over plan management, assets, or benefit determination, courts have found that it may act as a functional fiduciary under ERISA. Because ERISA has occupied the regulatory field, meaning that it preempts state laws, self-insured health plans are exempt from complying with many state-level health insurance regulations, such as network adequacy requirements, premium rate approval requirements, and coverage mandates. In Arkansas, however, TPAs are required to register annually with the Arkansas Insurance Department.[5] The department’s annual report for 2023 states that 403 TPAs were registered, including 20 licensed as resident business entities and 383 licensed as non-resident business entities.[6] Figure 2 shows the share of private-sector employees enrolled in self-insured plans among firms with 50 employees or more in Arkansas compared to the national average.[7]
Third-Party Administrator Issues
Although TPAs provide important administrative services for employers offering self-insured plans, some of their practices, particularly those directly affecting employers’ costs and beneficiaries’ coverage, have raised concerns.
Pharmacy benefit managers — intermediaries that manage prescription drug benefits for insurers, employers, and other payers — have come under increased scrutiny at the state and federal levels for some business practices and contracting arrangements. However, while TPAs operate similarly, their practices have so far evaded comparable oversight.[8] Employers pay TPAs a per-member-per-month fee under administrative service agreements that often grant TPAs broad discretion to administer claims, including the ability to reprice medical claims and collect provider overpayments. These agreements typically do not disclose how TPAs determine provider reimbursements or what discounts are negotiated, which TPAs classify as proprietary information.
There have also been allegations that some TPAs may attempt to conceal or inflate administrative fees. In a recent lawsuit, the plaintiffs alleged that two prominent TPAs acted as functional fiduciaries in exercising discretion over plan management and assets.[9] Aetna subcontracted with Optum Health, asserting that the arrangement would lead to lower provider rates that Aetna could negotiate directly. The plaintiffs alleged that Aetna created “dummy codes” to hide subcontractor charges in medical claims, thus passing along administrative fees hidden as provider payments. A district court ruled in favor of Aetna and Optum Health in 2019, but the Fourth Circuit Court of Appeals overturned the decision. The Fourth Circuit ruled that the plaintiffs produced sufficient evidence to show that Aetna could be considered a fiduciary agent and that its disguising of subcontractor fees could support a finding that it breached its fiduciary duty.[10] The case was later settled.
There have also been allegations that some TPAs may allow overpayments to providers and later profit by charging recovery fees when those payments are recouped, without employers’ knowledge.[8] In one notable case, the Sixth Circuit Court of Appeals clarified that when TPAs exercise this type of discretion over plan assets, they can be held to ERISA’s fiduciary standards and be subject to scrutiny.[11]
Large insurance companies that also own provider groups may use their TPAs to direct patients to affiliated providers. There have been allegations that TPAs increase the profits of their parent companies — while also increasing employer costs — by directing patients to affiliated providers, whom they often pay more than non-affiliated providers.[8]
Another area of concern is “cross-plan offsetting,” which occurs when a TPA leverages the assets of one employer plan to correct overpayments made on another plan. Both federal courts and the Department of Labor have weighed in on this practice, stating that it creates conflicts of interest and potentially violates ERISA’s fiduciary obligations.[1]
Policy Options To Strengthen Third-Party Administrator Oversight
Although ERISA limits state authority over self-insured plans, some states have worked to strengthen oversight of TPAs. In addition to requiring TPAs to register annually with the state Insurance Department, Arkansas law requires most TPAs to post a nominal surety bond — usually $25,000.[12] A TPA operating in the state must also maintain records of all plan transactions for the duration of its contract with an employer and for five years after the contract ends. The state insurance commissioner can access these records for the “purpose of examination, audit, and inspection.”[13]
Hawaii has imposed more stringent regulations on TPAs. The state requires a surety bond of at least $100,000 and requires TPAs to submit annual financial statements for the most recent two-year period showing that they are financially sound.[14]
Like Arkansas, Vermont requires that TPAs maintain transaction records and make them available for state review. However, Vermont also requires TPAs to file a report by July 1 of each year with the state Department of Financial Regulation. A TPA that handles or holds employer plan funds must submit a full audited financial statement, while a TPA that does not hold funds may simply submit a certified financial statement. The annual report must also include the names and addresses of all insurance companies or employers that the TPA has contracted with in the prior year. Additionally, the state requires that the insurance commissioner review each report by September 1 of each year and either certify that the TPA has a positive net worth and is in good standing or identify any deficiencies found in the report.[15]
Conclusion
TPAs have become integral to the delivery of employer-sponsored coverage, but they lack transparency, and some TPAs have faced litigation over their practices. While Arkansas requires TPAs to register with the state and meet certain financial standards, other states have developed stronger regulatory oversight to increase TPA accountability. Calls for greater transparency and scrutiny of TPAs at the federal level have yet to lead to meaningful action. A better understanding of the role of TPAs in the healthcare system is important to ensure they meet their fiduciary responsibility to employers and provide adequate services to beneficiaries.
References
[1] KFF. (2024, October 9). 2024 Employer Health Benefits Survey. https://www.kff.org/health-costs/2024-employer-health-benefits-survey/
[2] Monahan, C. (2023, March 24). Questionable conduct: Allegations against insurers acting as third-party administrators. Center on Health Insurance Reforms, Georgetown University. https://chir.georgetown.edu/questionable-conduct-allegations-insurers-acting-third-party-administrators/
[3] Walker, L. (2021, September 23). Inside big health insurers’ side hustle. Tradeoffs. https://tradeoffs.org/2021/09/23/inside-big-health-insurers-side-hustle/
[4] Beerman, L. (2022, September 2). The new TPA dynamics as HCSC hauls in Trustmark. HealthLeaders. https://www.healthleadersmedia.com/payer/new-tpa-dynamics-hcsc-hauls-trustmark
[5] Arkansas Code Ann. § 23-92-203 (2024). https://law.justia.com/codes/arkansas/title-23/subtitle-3/chapter-92/subchapter-2/section-23-92-203/
[6] Arkansas Insurance Department. (2023). 2023 annual report. Accessed October 2, 2025. https://insurance.arkansas.gov/site/assets/files/4819/2023_annual_report_final.pdf
[7] KFF. Share of private sector employees enrolled in self-insured plans. Accessed October 14, 2025. https://www.kff.org/state-health-policy-data/state-indicator/share-of-private-sector-enrollees-enrolled-in-self-insured-plans/?currentTimeframe=0&sortModel=%7B%22colId%22:%22Location%22,%22sort%22:%22asc%22%7D
[8] Handorf, K., Monahan, C. H., & Watts, K. (2025, May 16). Third-party administrators — The middlemen of self-funded health insurance. Health Affairs. https://www.healthaffairs.org/content/forefront/third-party-administrators-middlemen-self-funded-health-insurance
[9] Pifer, R. (2025, September 8). Aetna, Optum settle ‘dummy codes’ case for $8.4M. Healthcare Dive. https://www.healthcaredive.com/news/aetna-optum-dummy-codes-settlement/759469/
[10] Reuters. (2021, June 23). 4th Circ. revives dummy-code lawsuit against Aetna, Optum. https://www.reuters.com/legal/transactional/4th-circ-revives-dummy-code-lawsuit-against-aetna-optum-2021-06-23/
[11] Camp, L. R., Wozniak, T. D., & Perkowski, M. I. (2025, June 2). Sixth Circuit reverses dismissal of ERISA healthcare fee suit against third-party administrator. Holland & Knight. https://www.hklaw.com/en/insights/publications/2025/06/sixth-circuit-reverses-dismissal-of-erisa-healthcare-fee-suit-against
[12] Arkansas Code Ann. § 23-92-204 (2024). https://law.justia.com/codes/arkansas/title-23/subtitle-3/chapter-92/subchapter-2/section-23-92-204/
[13] Arkansas Code Ann. § 23-92-207 (2024). https://law.justia.com/codes/arkansas/title-23/subtitle-3/chapter-92/subchapter-2/section-23-92-207/
[14] Polsinelli. (2019, December). Third party administrator update: TPA licensing and compliance developments. https://polsinelli.gjassets.com/content/uploads/2022/05/TPA_Update_DEC2021.pdf
[15] State of Vermont Department of Financial Regulation. (2022, July 1). Third-party administrator rule. https://dfr.vermont.gov/content/third-party-administrator-rule
