"[E]mployers ... will want to critically review the vendor contracts and operating systems of the vendors that will participate in the program ... [for] prudence for inclusion, prohibited transactions, and other legal compliance, as well as to ensure that the contract by its terms holds the vendor responsible for delivering on service and other expectations created in the sales pitch.... [S]pecial attention should be given to fiduciary allocations, indemnification and standards of performance, business associate or other privacy and data security assurances required to comply with HIPAA and other confidentiality and data security requirements[.]"