Selecting an HSA provider for a large employer runs through procurement as much as benefits. The decision brings requirements a smaller group never sees: a migration plan for thousands of existing accounts, an information security review, contract terms with service commitments attached, and pricing that has to be modeled across several years and often several legal entities. What follows is what to require at each of those stages, for the benefits leader running the evaluation and the broker advising them.

The migration from your current provider

For a large employer, choosing a provider is almost always a switch, which means thousands of employees already hold accounts, balances, and in many cases investment positions with the incumbent. How those move is the first thing to get in writing. Ask whether balances transfer in bulk through a trustee-to-trustee process, what the timeline looks like from signed contract to completed transfer, and what happens to invested funds along the way. Some transfers require liquidation to cash, which creates a gap in market exposure. Selling inside the account has no tax consequence, but the transfer method does. Funds should move directly between custodians, since a check issued to the employee starts the IRS 60-day rollover clock and a missed deadline makes the entire balance taxable.

The second half of the migration question is the employee experience during cutover. Ask how long card access is interrupted, if at all, who drafts the employee communications, and what happens to anyone with a pending claim on the transfer date. A provider with a track record at this scale will produce a migration plan with named milestones, and it is reasonable to ask for one from a comparable client with the identifying details removed.

Multiple entities, plan years, and locations

Large employers are rarely one company. Subsidiaries, acquired businesses, and separate operating units often carry their own EINs, their own payroll systems, and sometimes their own plan years. The provider needs to run those entities under one master agreement with consolidated reporting, support different contribution schedules within the same relationship, and onboard an acquired group's existing accounts partway through a year without starting a new implementation. If each entity requires its own contract and its own setup, the administrative overhead you were trying to reduce returns in a different form.

Platform and employee experience

Large-employer implementations succeed or stall on whether the platform fits the systems already in place. Confirm which payroll and HRIS systems the provider connects to natively rather than through file uploads, since a file-based integration puts a manual step back into every pay cycle. On the employee side, the questions are about self-service: whether an employee can open the account, activate the card, check a balance, and submit a receipt from the app without a separate login, and how much of a typical support question the platform resolves before a person has to. A demo built on your own plan structure, with your payroll cadence and your contribution rules loaded in, shows this better than a generic walkthrough.

Security and vendor review

At this scale, the HSA provider goes through the same information security review as any vendor handling employee financial and health data. Knowing what to request before the review starts saves weeks. The standard package includes:

• A current SOC 2 Type II report and the scope it covers

• How employee data is encrypted at rest and in transit

• Where data is hosted and whether any of it is processed outside the United States

• Whether employee data is shared with third parties, and under what terms

• The incident response process and notification timeline

Providers that regularly sell into large employers keep this package current and can send it the same week it is requested.

Contract terms and service commitments

Beyond price, the terms worth negotiating are implementation milestones with dates and a defined remedy if they slip, service level commitments for support response and contribution file processing, a fee schedule that holds for a set period, and exit terms that spell out how accounts and data transfer out and what that costs. The contract should also state which compliance responsibilities the provider takes on, such as contribution limit monitoring and eligibility validation, and which stay with the plan sponsor. Getting that division written down avoids a gap that only surfaces after something goes wrong.

Pricing modeled across three years

A large-group monthly rate is negotiated and will look competitive on its own. The full cost depends on everything around it. Build a three-year model that includes per-employee-per-month fees and any volume tiers, fees paid by account holders rather than the employer, investment fees and any balance threshold that gates investment access, and what happens to fees when an employee leaves and keeps the account. Compare the three-year total across providers rather than the monthly rate. A lower monthly fee with account-holder charges and investment thresholds can cost more over the life of the contract.

Reporting for the employer and the broker

Reporting at scale has two audiences. The benefits team needs participation and funding data to run the program, and the broker needs the same data at renewal to show the benefits committee it is working. Confirm that both can pull participation and funding rates by entity and plan tier, employer contribution reconciliation, investment adoption over time, and support contact volume. That last one shows whether the provider's self-service is absorbing questions or passing them back to HR. The practical test is whether the broker can log in and pull these numbers ahead of a renewal meeting without asking the provider for an export.

How Lively helps

Lively supports large employers and their brokers through migration, multi-entity setup, and ongoing reporting. If you are running an evaluation, get in touch and we can walk through your structure.