"Insured health plans will have the option to enter into agreements with their insurer or another third-party administrator (TPA) to meet these disclosure requirements ... [which] shifts potential ... liability for any noncompliance to the insurer.... Self-funded plans may enter into written agreements with service providers, but the liability remains with the self-funded plan sponsor to ensure compliance with the final rule."