COBRA Recordkeeping Requirements

COBRA recordkeeping obligations sit at the intersection of ERISA's general plan documentation rules and the specific notice-and-election mechanics of 29 U.S.C. §§ 1161–1168. Employers and plan administrators who fail to maintain adequate records face excise tax exposure under IRC § 4980B and potential civil enforcement by the Department of Labor. This page covers what records must be kept, how the retention framework operates, which scenarios create the highest documentation risk, and how to distinguish sufficient from insufficient recordkeeping practice.

Definition and scope

COBRA recordkeeping requirements are the set of documentation obligations imposed on group health plan administrators to demonstrate compliance with the continuation coverage rules established under the Consolidated Omnibus Budget Reconciliation Act of 1985 (29 U.S.C. § 1161 et seq.). These obligations are enforced through ERISA's broader fiduciary and disclosure framework, which is administered by the Employee Benefits Security Administration (EBSA), a division of the U.S. Department of Labor.

ERISA § 107 (29 U.S.C. § 1027) requires that every person subject to a reporting or disclosure obligation retain records sufficient to verify, explain, clarify, and check for accuracy and completeness any report required to be filed and any information required to be disclosed. The DOL has interpreted this to mean records must be preserved for a minimum of 6 years from the date the document was filed or the disclosure was made (ERISA § 107; DOL EBSA guidance).

The scope of COBRA-specific recordkeeping covers four primary categories:

  1. Qualifying event documentation — records establishing that a qualifying event occurred and when
  2. Notice records — copies of all notices sent and received, with proof of delivery or mailing dates
  3. Election records — written elections or declinations by qualified beneficiaries, timestamped
  4. Premium records — payment histories, grace period tracking, and termination-of-coverage documentation

Plans governed by the broader regulatory context for COBRA administration must satisfy both the COBRA-specific retention rules and any applicable state continuation requirements that impose parallel obligations.

How it works

The recordkeeping mechanism operates through a chain of custodial responsibility that begins with the employer and, in plans with separate plan administrators, transfers to the administrator at the point of qualifying event notification.

Step 1 — Qualifying event capture. When a qualifying event occurs (termination, reduction in hours, divorce, death, loss of dependent status, Medicare entitlement, or employer bankruptcy), the employer must create a contemporaneous record of the event type and the date coverage would otherwise be lost. The employer then has 30 days to notify the plan administrator (29 C.F.R. § 2590.606-2).

Step 2 — Notice issuance and documentation. The plan administrator must send the qualifying beneficiary a COBRA election notice within 14 days of receiving the employer's notification (29 C.F.R. § 2590.606-4). Records of the notice — including the template version used, the method of delivery (first-class mail, certified mail, electronic), and the date mailed — must be preserved. The DOL's model notices (available at dol.gov) provide the documentation baseline against which compliance is measured.

Step 3 — Election period tracking. The 60-day election window (29 C.F.R. § 2590.606-4(a)(2)) must be tracked per beneficiary. Records must capture whether an election was made, the date of election, and whether multiple qualified beneficiaries in the same household made independent elections.

Step 4 — Premium records. Payment dates, amounts, check or ACH reference numbers, and grace period calculations must be logged. The standard grace period for COBRA premiums is 30 days from the due date (29 C.F.R. § 2590.606-4(b)(6)). A lapse in payment that results in coverage termination requires a separate termination record with the controlling date.

Step 5 — Retention. All records must be held for at least 6 years from the date of the underlying filing or disclosure. Physical or electronic storage is permissible, but electronic systems must be capable of producing legible paper copies on demand (ERISA § 107).

Common scenarios

Qualifying event disputes. The most frequent recordkeeping failure occurs when an employer cannot produce documentation of when a qualifying event was reported to the plan administrator. Without a dated qualifying event record, the plan cannot establish whether the 30-day employer notification deadline or the 14-day administrator notice deadline was met. This gap is the primary trigger for IRS excise tax exposure under IRC § 4980B, which carries a penalty of $100 per day per qualified beneficiary for each day of noncompliance (26 U.S.C. § 4980B).

Proof-of-mailing failures. Sending a COBRA election notice by first-class mail creates a presumption of delivery, but only if the administrator retains a dated mailing log or certificate of mailing. Administrators who rely solely on internal database flags — without a physical or auditable electronic record of the mailing date — face significant evidentiary exposure in litigation.

Premium grace period miscalculation. When premium payment records are incomplete, administrators may incorrectly terminate coverage before the 30-day grace period has expired, or conversely, may fail to document a legitimate late payment that should have ended coverage. Both errors are documented sources of COBRA litigation. Resources on the COBRA administration home provide additional context on how premium mechanics interact with coverage timelines.

Disability extension documentation. Qualified beneficiaries entitled to the 11-month disability extension must provide a Social Security Administration disability determination. Administrators must retain a copy of that determination and the date it was received, because the extension period is measured from the date of the original qualifying event, not the date of the SSA determination.

Third-party administrator transitions. When a plan switches third-party administrators mid-coverage, records must transfer completely. Gaps in transferred records — particularly election notices and premium histories — are a documented source of compliance failures during DOL audits.

Decision boundaries

Distinguishing adequate from inadequate COBRA recordkeeping turns on three practical tests derived from ERISA § 107 and DOL enforcement practice:

Completeness vs. sufficiency. ERISA does not enumerate every document that must be retained; it requires records sufficient to verify compliance. A plan that retains a summary of events rather than underlying source documents may fail this test if the summary cannot be traced to a verifiable original.

Electronic vs. paper records. Both formats satisfy ERISA, but electronic records must meet the DOL's standards for electronic disclosure and document retention set out in 29 C.F.R. Part 2520. Systems that cannot reproduce a legible, printable record of each transaction are noncompliant regardless of their internal accuracy.

Employer records vs. administrator records. Employers and plan administrators carry distinct but overlapping obligations. An employer who outsources COBRA administration to a third party does not transfer its ERISA liability; it retains a duty to ensure the administrator is maintaining adequate records. This distinction becomes critical in mergers, acquisitions, and employer bankruptcy scenarios, where record custody is often contested.

Active coverage vs. terminated coverage. The 6-year retention period begins at the point of filing or disclosure — not at coverage termination. A plan administrator who terminates COBRA coverage in Year 1 must retain associated records through Year 7 at minimum. Coverage that extends to the 36-month maximum under a second qualifying event creates records that may need to be held for nearly a decade when the 6-year window is applied from the last disclosure date.

References

The law belongs to the people. Georgia v. Public.Resource.Org, 590 U.S. (2020)