Self-insured claims administration: you pay every dollar and the TPA makes the call

Self-insured claims administration splits the money from the decision. The employer posts the security deposit, pays every dollar of indemnity and medical, carries the liability and files the annual report. The claims administrator sets the reserve and decides the claim. California writes that split into regulation: reserving and claims decisions must be made by the claims administrator and not the employer. So a risk manager has no decision authority to take back. The only lever left is the standard of evidence behind each decision, and the audit record that proves it.

The second half of the problem is that nothing in the usual oversight stack measures that evidence. A TPA's service-level agreement measures speed and contact. So does the regulator: California's Division of Workers' Compensation cited 4,531 violations across nearly 2,700 claim files in its 2024 audit cycle, and the standards it grades against are built around whether benefits and notices arrived on time. Neither scorecard asks whether the file justifies the payment. A TPA can score green on every service level, pass a state audit, and still hand back a file with no written coverage position, a round-number reserve and no subrogation screen.

This is written from the employer's side of that relationship: what the claim file has to contain, what auditors find inside it, where reserves and recovery leak, what your TPA's claims administration system is built to do, and twelve questions to put to the administrator about AI and your files. The administrator's side of the same clock, with the state deadline tables, is in our piece on workers' compensation TPA claims handling.

Read the rule the way an auditor reads it. The California Department of Industrial Relations publishes what its Office of Self-Insurance Plans auditors look for, and the line that matters most to an employer is the allocation of authority: reserving and claims decisions must be made by the claims administrator and not the employer, citing 8 CCR 15452 and Labor Code 3702.1. The same framework attaches a named standard of care to the administrator. Under Labor Code 3702.1(d), a third-party administrator retained by a self-insured employer must estimate the employer's total accrued workers' compensation liability for the Self-Insurers' Annual Report both in good faith and with a reasonable degree of care, and a self-administering self-insurer is held to the same standard.

Liability does not travel with the decision. New York's Workers' Compensation Board frames self-insurance as a privilege granted to the employer: in exchange, the employer agrees to make benefit payments to injured employees and to meet all other obligations under Board law, rules and regulations, and a subsidiary is not automatically covered by its parent's approval. The collateral is real money as well. New York's minimum security deposit for a workers' compensation self-insurer is $1,999,000, effective July 1, 2026.

So the oversight question changes shape. It stops being "can we overrule this" and becomes "can this decision be shown to us, and to a state auditor, from the file alone." That second question is about documentation, which makes it contractible in a way that second-guessing a compensability call never was.

What California's register shows

The Office of Self-Insurance Plans publishes its register and its statistics: 7,049 active self-insured employers for workers' compensation, $341 billion of covered payroll, and 4.4 million covered workers, about 1 in 8 workers in the state. The prior year's count was 7,107, so this is a stable population rather than a growing one. Two cautions belong with those numbers. They are workers' compensation only, and they are one state. State agencies do not publish these counts uniformly, which means a national total of self-insured employers cannot be extrapolated from California. Treat any confident national count, and any list of states said to forbid private self-insurance, as unverified until someone shows you the agency page it came from.

Self-insurance also comes in structures, not one form. New York's Workers' Compensation Board recognises three categories: individual self-insurance, political subdivisions and group self-insurance, under WCL Article 4 section 50 and Article 9 section 211. A public entity pool, a single large employer and a group of small employers under a joint program all end up delegating the file to a claims administrator, and all three carry the loss dollars themselves. The oversight problem is identical in each case; only the size of the retention changes.

The self-funded health plan the same director runs

On the benefits side, self-funding is already the norm, and the same risk or benefits director usually signs that TPA contract too. KFF's 2025 Employer Health Benefits Survey, published October 22, 2025, puts 67% of covered workers in self-funded plans, splitting 27% at firms with 10 to 199 workers against 80% at larger firms, with 37% of covered workers at the smaller firms in level-funded arrangements. Those are health plans under an entirely different regime. They appear here because the same person lives under both contracts, not because the rules travel between them.

The claim file is a regulated artifact, which is the most useful fact in this whole subject. It has named contents, a named custodian and a named standard of care, so it can be audited rather than argued about. California requires a complete, up-to-date claim file for every self-insured indemnity or medical-only injury occurring after January 1, 2004. Claims administration for self-insured employers sits under Title 8, Chapter 8, Subchapter 2, Article 12, sections 15450 to 15463, and the state certifies the people doing it: a qualified claims administrator must pass a 100-question examination with a 70% passing score, and failure to provide a transfer of records in a timely manner may be cause for revocation of the certificate to administer.

The audit checklist is published too, which means an employer can borrow the regulator's own list instead of inventing one. OSIP field audits check that benefit notices were proper, that indemnity and medical benefits were timely, that denials were appropriate, that all liens were satisfied before closure and that future-benefit claims comply with 8 CCR 15400.2, citing 8 CCR 15458, Labor Code 129 and the Labor Code 3700 series, with Labor Code 3702(a)(1) through (5) behind the treatment of denials. Read that list once and the shape of it is clear: every item is about whether something happened and whether it happened on time. None of them asks what the decision was based on.

National uniformity does not rescue the gap either. The NAIC's third-party administrator model, Guideline 1090 on the registration and regulation of third party administrators, was first adopted as a model law in 1977 and last amended in 2001, and the current guideline exists in two versions, one extending its scope to workers' compensation and stop-loss and one omitting workers' compensation entirely. That is a registration and solvency framework of long standing, documented in the Model Regulation Service of October 2011. It is not a file-quality standard, and it does not pretend to be one.

Set all of that against the record the same employer receives on the health side. ERISA's claims procedure regulation, 29 CFR 2560.503-1, sets hard clocks for self-funded health and disability plans: 72 hours for urgent care, 15 days for pre-service group health claims, 30 days for post-service claims and 45 days for disability claims, extendable twice by 30 days, with appeals at 60 days for post-service health and 45 days for disability. More to the point, it dictates content. An adverse benefit determination notice must give the specific reasons for the denial, reference the relevant plan provisions, describe any additional material needed and why, explain the review procedures and time limits, and state the right to bring a civil action under ERISA section 502(a); disability notices must additionally discuss the basis for disagreeing with treating physicians, vocational assessments and Social Security determinations.

ERISA governs self-funded health plans. It does not govern workers' compensation, and the two regimes should never be blended in a policy argument. The contrast is the useful part, and it is the sharpest way to state the gap: your health plan's TPA has to put the reason, the plan provision and the evidence into the denial notice, while your workers' compensation TPA has no equivalent duty to show its reasoning inside the claim file. One of your two delegated programs owes you a documented rationale by federal rule. The other one owes you a timely payment.

The published audit record is the only hard evidence of delegated claim-file quality that anyone outside a program can read, and California publishes the most of it. The Division of Workers' Compensation's 2024 annual report to the Legislature, required by Labor Code 129(e) and posted by the Department of Industrial Relations on May 8, 2026 as the 2024 Audit Unit annual report and reported in the trade press on May 12, 2026, records 40 audits of insurers, self-insured employers and third-party administrators across nearly 2,700 claim files, with 4,531 violations cited. Those audits produced 275 notices of compensation due, totalling $442,000 in unpaid temporary and permanent disability benefits, and $1.35 million in penalties assessed, of which about $1.01 million was subject to collection. Of the subjects reviewed, 8 failed the initial profile audit review and went to a full compliance audit, and 5 of those then failed the second-stage review. The same unit handled 560 complaints in 2024 and recovered a further $1.18 million in payments to injured workers and providers.

The finding to carry into your next administrator review is the one in the middle of that list: unpaid indemnity benefits in more than 10% of reviewed claims. These were files being handled by people paid to handle them, and in more than one in ten the injured worker was owed money that had not been paid. None of that failure mode is visible on a dashboard of average days to first contact or average days to first payment. It shows up only when somebody opens the file and recalculates the benefit from the documents inside it.

California also publishes the bar it grades against, which makes it borrowable. For 2027 the Division set a profile audit review performance standard of 1.67327, a full compliance audit standard of 2.14192 and a severity rate standard of $165.60, announced October 19, 2026, and reviews each audit subject at least once every five years. Those are numbers an employer can ask its administrator to produce against, which is more than most TPA scorecards contain. They are also a five-year floor set for a state agency with finite staff, not an oversight cadence for the party paying the losses.

The reserve is the most load-bearing number in a self-insured program and the one the employer touches least. It drives the excess attachment point, the collateral or security deposit the state requires, the accrual in the financial statements, the actuary's development triangles and next year's renewal conversation. It is set by an examiner whose own money is not in it, under a standard of care that is written down and almost never tested. The regulation is clear that this is the administrator's call, not the employer's, which is exactly why the reserve basis is the single most valuable thing to require in writing.

There is one published figure on what reserve auditing finds, and it is old enough that the period has to be stated with it. Over the five-year period from 2007 to 2011, California's Office of Self-Insurance Plans reported that its audits identified over $570 million in under-reported reserves at a program cost of about $1 million a year, which the agency expresses as $114 of under-reported reserves and liability exposure identified per $1 spent auditing. That window closed before any currently sold claims platform existed, and no comparable figure has been published since, so treat it as a direction and not a current rate. The direction is the point: when somebody audits reserves specifically, they find the reserves were short.

Under-reserving is rarely a conspiracy. It is what happens when a reserve is set once at intake from a severity band, then never revisited because nothing in the workflow forces a revisit. Which turns the oversight ask into two questions an examiner can answer straight off a file that is built right, and cannot answer at all off one that is not: who set this reserve and what did they rely on, and when did it last move and what new fact moved it.

The published aggregate band for claims leakage is 7% to 14% of total claims spend, per EY's work on indemnity in litigated claims. We have already gone through why no published source gives a leakage rate by line of business, and that caution carries here: use the band as an order of magnitude for a conversation, never as a budget line for your own program. For a self-insured employer the band lands differently than it does for a carrier, because there is no premium pool absorbing it. Leakage in a self-insured program is a direct transfer out of the operating budget.

Timing is what quietly closes the recovery window, and litigation is the clock that closes it. A WCRI study of more than 950,000 workers' compensation claims with more than seven days of lost time, reported by Claims Journal on October 3, 2024, found attorney involvement associated with $7,700 to $12,400 more in indemnity benefits paid. Representation reached 34% of those workers overall, rising from 14% on temporary-disability claims to 64% on permanent-partial-disability and lump-sum claims, and average indemnity ran $6,918 on temporary-disability claims against $39,150 on permanent-partial and lump-sum claims. The study's authors note the correlation and call for more research on causation, so read it as the shape of the risk rather than a mechanism. The operational read is simpler: by the time a file is represented, the evidence that would support a third-party recovery is older, witnesses are harder to reach, and the clean demand window has usually passed. Our write-up of how recovery screening gets built into the file instead of bolted on afterwards goes through the mechanics.

This category deserves credit before it deserves criticism. Consolidating workers' compensation, general liability, auto and property for a self-insured program or a public entity pool onto one data model, with state reporting, document custody, deductible and excess tracking and a loss run an actuary can work with, is a genuinely hard problem that these platforms solve. Origami Risk's claims administration materials run from submission and policy verification through adjudication, reserves management, payments, recovery, quality assurance and closure. Riskonnect describes Claims Intelligence inside iVOS with claims automation AI and return-to-work prediction for workers' compensation, and says it serves more than 2,000 organizations across six continents. FileHandler Enterprise from JW Software targets TPAs, self-insured groups and public entities with over 50 built-in business automation rules, and Cloud Claims from APP Tech is built around incident capture with an open REST API into TPA, carrier and accounting systems. Ventiv is a long-standing participant in the same category; its public materials were unreachable on October 23, 2026, so nothing here is attributed to it.

Here is the boundary the whole category shares: a system of record holds the file. Filling it with verified evidence is a separate job, and these platforms do not claim to do it. That is a boundary, not a flaw. It does mean "which RMIS does our TPA run" and "what standard of evidence sits behind our decisions" are two different procurement questions, and only the first one normally gets asked. For the TPA-side version of the same layering, see our breakdown of what a TPA buys at each layer of its claims stack. Hesper AI is explicit about its own boundary here: it is not a claims administration system replacement, it integrates with the system of record your administrator already runs, and no risk manager should be told to rip out their TPA's platform to raise an evidence standard.

Be precise about what AI currently does in claims, because the honest answer is narrower than the marketing. In WTW's 2026 Advanced Analytics and AI Survey of 59 P&C insurers, reported by Insurance Journal on March 25, 2026, 14% currently use straight-through processing in claims workflow automation with a further 36% planning to adopt it, while 33% use advanced claims analytics for fraud detection and 29% for severity assessment, both expected to reach 65% to 70% within two years. The same survey found insurers with more sophisticated analytics running combined ratios six percentage points lower and premium growth three percentage points higher than slower adopters between 2022 and 2024. On the governance side, the NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023, which reminds insurers that decisions or actions made or supported by AI must comply with all applicable insurance laws and regulations. The obligation does not move to the vendor, and it does not move to your administrator either.

Here are the twelve questions. Each one is tied to something already in the rules or already in the published audit record, which is what stops them being a wish list.

1. Show me the written coverage or compensability position on these ten files, and the documents it cites. California requires a complete, up-to-date claim file per injury under 8 CCR 15400, and OSIP auditors check whether denials followed proper procedure.
2. Who in your organisation set the reserve on this file, and what did they rely on? The decision is legally theirs under 8 CCR 15452, made in good faith and with reasonable care under Labor Code 3702.1(d), on our money.
3. When did this reserve last move, and what new fact moved it? One state's audit program identified over $570 million in under-reported reserves across 2007 to 2011, which is what a reserve nobody revisits looks like in aggregate.
4. What is your performance rating in every state that audits you, and show me the last report. California's 2027 standards are a profile audit review standard of 1.67327 and a full compliance audit standard of 2.14192.
5. Of our closed files in the last year, how many had unpaid indemnity you later had to pay? The 2024 California audits found unpaid indemnity benefits in more than 10% of reviewed claims. That is the benchmark to be measured against.
6. Which of our files were screened for subrogation, and what is the documented reason on the ones marked no recovery? Recovery screening appears on no state audit checklist, so if your contract does not score it, nothing does.
7. At what point in the file do you flag attorney involvement risk, and what changes when you do? WCRI associates representation with $7,700 to $12,400 more in indemnity, and representation runs 14% on temporary-disability claims against 64% on permanent-partial and lump-sum claims.
8. Where is AI used on our claims today, at which step, and what does it output? Across the category the published answer is document summarisation, intake assist and triage scoring, and 14% of surveyed insurers use straight-through processing in claims today.
9. For any AI-assisted step, can you reconstruct why a given decision was made, with sources and timestamps? The NAIC model bulletin, adopted December 2023, holds that decisions made or supported by AI must comply with all applicable insurance law.
10. Our health plan's TPA has to put the reason, the plan provision and the evidence in a denial notice under 29 CFR 2560.503-1. What is the equivalent record on our workers' compensation denials?
11. Can we pull the audit record for a file ourselves, without asking you to assemble it? The state auditor will open these files whether or not we ever did, and an assembled record is not the same artifact as a maintained one.
12. Who passed the qualified claims administrator examination on our program, and when? California's examination is 100 questions with a 70% passing score, and the certificate can be revoked for failure to provide a transfer of records in a timely manner.

Questions one and eleven do most of the work together. The first asks whether the reasoning exists in the file. The eleventh asks whether it exists in a form you can read without your administrator's help. A program that answers yes to both has an audit record. A program that answers yes to the first and no to the second has an assembly project that happens to be dormant, and it will be discovered at the worst possible moment, which is usually a state audit or a coverage dispute with the excess carrier.

Nothing in that description is a faster file. It is a file where the same record answers the state audit, the excess carrier, the actuary and the recovery demand without anyone reassembling it. That standard is not rare because administrators are careless. It is rare because building a file to that standard by hand is expensive, and the economics of claims administration have never paid for it.

Count the hours and the gap explains itself. Manual investigation runs 14+ days per case against 200+ cases per investigator, both Hesper internal benchmarks, which is why roughly 25% of flagged claims get a real workup and the rest get a disposition instead. Hesper AI runs 15+ investigation phases in parallel rather than one at a time, in minutes, not weeks, which takes coverage of flagged claims from about 25% to 100% on the same benchmark and at a fraction of the manual cost. The mechanism is not that software is clever. It is that an investigator's attention is a bottleneck and software attention is not, so the phases run simultaneously.

For a self-insured program the consequence lands exactly where the regulation left the employer. Every agent action is logged with its sources, reasoning and timestamps, so the record is defensible to a state auditor, an excess carrier or a capacity partner without being rebuilt. Every file is screened for subrogation and salvage, which is the line item no service-level agreement measures. Coverage positions arrive cited to the policy and endorsements they rest on, reserve recommendations arrive with the evidence behind them, and the licensed human still makes every call. Evidence behind every decision. Adjusters review evidence-backed files instead of building them, which is the only version of this that scales across all eight stages of the claims lifecycle rather than one stage at a time.

You still cannot set the reserve. That is settled by 8 CCR 15452 and it is not going to change. What you can do is insist that the reserve arrive with the fact that moved it, that the coverage position arrive with the documents it cites, and that the subrogation screen arrive with a reason either way. The employer who pays every dollar does not need decision authority to raise the standard. It needs the evidence standard written into the administration agreement and tested on ten random files a quarter.