Increasing transparency of group health plan data

(a) Group health plan audit rights (1) In general Section 408(b)(2) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1108(b)(2)) is amended by inserting after subparagraph (C) the following: (D) No contract or arrangement for services, and no extension or renewal of such a contract or arrangement, between a group health plan (as defined in section 733(a)) and any other entity, including a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, or entity providing pharmacy benefit management services, is reasonable within the meaning of this paragraph unless such contract or arrangement— (i) allows the group health plan to audit all de-identified claims and encounter information or data described in section 724(a)(1)(B), provided that such information or data has been deidentified in accordance with section 164.514 of title 45, Code of Federal Regulations (or successor regulations), to— (I) ensure that such entity complies with the terms of the plan, the terms of the contract or arrangement for services, and the requirements of this title; and (II) determine the reasonableness of compensation received by such entity; and (ii) does not— (I) unreasonably limit the number of audits permitted during a given period of time; (II) limit the number of de-identified claims and encounter information or data that the group health plan may access during an audit; (III) limit the disclosure of pricing terms for value-based payment arrangements or capitated payment arrangements, including— (aa) payment calculations and formulas; (bb) quality measures; (cc) contract terms; (dd) payment amounts; (ee) measurement periods for all incentives; and (ff) other payment methodologies used by an entity, including a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, or entity providing pharmacy benefit management services; (IV) limit the disclosure of overpayments and overpayment recovery terms; (V) limit the right of the group health plan to select an auditor; (VI) otherwise limit or unduly delay by greater than 60 calendar days after the date of request the group health plan from auditing any such de-identified claims and encounter information or data; or (VII) permit the entity to charge a fee beyond the reasonable direct costs to provide the required information and otherwise comply and assist with an audit request.. (2) Privacy requirements (A) In general Section 408(b)(2) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1108(b)(2)), as amended by paragraph (1), is further amended by adding at the end the following: (E) Privacy requirements (i) In general An entity shall— (I) provide data or information under subparagraph (D) in a manner consistent with— (aa) the privacy regulations promulgated under section 13402(a) of the Health Information Technology for Clinical Health Act (42 U.S.C. 17932(a)); and (bb) the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations); and (II) to the extent such data or information constitutes protected health information, restrict the use and disclosure of such information for purposes of such privacy regulations. (ii) Restriction A group health plan shall comply with section 164.504(f) of title 45, Code of Federal Regulations (or a successor regulation), and a plan sponsor shall act in accordance with the terms of the agreement described in such section.. (b) Civil enforcement (1) In general Subsection (c) of section 502 of such Act (29 U.S.C. 1132) is amended by adding at the end the following: (14) In the case of an agreement between a group health plan and a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, entity providing pharmacy benefit management services, or other service provider that violates the provisions of section 724, the Secretary may assess a civil penalty against such provider, network or association of providers, service provider offering access to a network of providers, third-party administrator, entity providing pharmacy benefit management services, or other service provider in the amount of $10,000 for each day during which such violation continues. Such penalty shall be in addition to other penalties as may be prescribed by law.. (2) Penalty collection Paragraph (6) of section 502(a) of such Act, is amended to read as follows: (6) by the Secretary to collect any civil penalty that the Secretary has imposed or assessed pursuant to this title;. (c) Improving collection of gag clause attestations (1) In general Section 506 of such Act (29 U.S.C. 1136) is amended by adding at the end the following: (d) Attestations relating to group health plan data Notwithstanding subsection (a) of this section, the Secretary shall collect the attestations required to be submitted under section 724(a)(3). The Secretary shall ensure that any service provider submitting such an attestation on behalf of a group health plan does not have any conflicts of interest with regard to such attestation.. (2) Conforming amendment Section 506(a) of such Act (29 U.S.C. 1136(a)) is amended by striking In order and inserting Subject to subsection (d), in order.