Increasing group health plan access to health data

(a) Group health plan access to information (1) In general Section 2799A–9 of the Public Health Service Act (42 U.S.C. 300gg–119) is amended by adding at the end the following: (1) Group Health Plan Access to Information (A) In general No contract or arrangement for services, and no extension or renewal of such contract or arrangement, between a group health plan that is offered by a specified large employer or that is a specified large plan (as such terms are defined in subparagraph (F)) and a health care provider (which for purposes of this subparagraph, includes a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, health insurance issuer offering group or individual health insurance coverage, or pharmacy benefit manager, or any entity acting as an intermediary between the group health plan and the health care provider, network association of providers, service provider offering access to a network or association of providers (including a licensed health insurance issuer or third-party administrator), or pharmacy benefit manager (collectively referred to in this subsection as Covered Service Providers), is reasonable within the meaning of this subsection unless such contract or arrangement— (i) allows the responsible plan fiduciary (as that term is defined in section 408(b)(2)(B)(ii)(I)(ee)) access to all claims and encounter information or data, and any documentation supporting claim payments, including, but not limited to, medical records and policy documents, or information or data described in subsection (a)(1)(B) to— (I) comply with applicable law; and (II) determine the accuracy or reasonableness of claims payment; and (ii) does not— (I) unreasonably limit or delay access, as determined by the Secretary but in any event not longer than 15 days, after a request for access by a plan fiduciary to such information or data; (II) limit the volume of claims and encounter information or data that the group health plan, the plan sponsor, the plan administrator, or a business associate of such plan may access during an audit or pursuant to any request for such information or data; (III) limit the disclosure of pricing terms for value-based payment arrangements or capitated payment arrangements, including— (aa) payment calculations and formulas; (bb) quality measures; (cc) contract terms; (dd) payment amounts; (ee) measurement periods for all incentives; and (ff) other payment methodologies used by an entity, including a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, or pharmacy benefit manager; (IV) limit the disclosure of overpayments and overpayment recovery terms; (V) limit the right of the group health plan, the plan sponsor, or the plan administrator of such plan to select an auditor or define audit scope or frequency; (VI) otherwise limit or unduly delay the group health plan, the plan sponsor, the plan administrator, or a business associate of such plan from accessing claims and encounter information or data; (VII) limit the disclosure of fees charged to the group health plan related to plan administration and claims processing, including renegotiation fees, access fees, repricing fees, or enhanced review fees; (VIII) limit the right of the group health plan, the plan sponsor, or the plan administrator to request action on any suspect claim payments; (IX) limit public disclosure of de-identified or aggregate information; (X) limit the disclosure of, with respect to a provider that files claims under such plan, whether a Covered Service Provider— (aa) has an ownership or investment interest; (bb) has a controlling interest; (cc) is a management services organization; or (dd) is a significant equity investor; or (XI) limit the disclosure of the name and address of each person or entity that, with respect to the health plan service provider— (aa) has an ownership or investment interest; (bb) has a controlling interest; or (cc) is a significant equity investor. (B) Manner of providing information or data (i) In general A Covered Service Provider shall provide information or data under this subsection in a manner consistent with the privacy regulations promulgated under section 13402(a) of the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17932(a)) and consistent with the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations) (referred to in this paragraph as the HIPAA privacy regulations) and shall restrict the use and disclosure of such information according to such privacy regulations and such HIPAA privacy regulations. A Covered Service Provider shall not be required to disclose information or data under this subsection that could reasonably identify a participant or beneficiary through individually identifiable health information (as such term is defined under HIPAA privacy regulations). (ii) Additional requirements In carrying out this subsection, a Covered Service Provider shall comply with section 164.504(f) of title 45, Code of Federal Regulations (or a successor regulation). (iii) Rule of construction (I) In general Nothing in this subsection shall be construed to modify the requirements for the creation, receipt, maintenance, or transmission of protected health information under the HIPAA privacy regulations. (II) Civil rights laws Nothing in this subsection shall be construed to affect the application of any Federal or State privacy or civil rights law, including the HIPAA privacy regulations, the Genetic Information Nondiscrimination Act of 2008 (Public Law 110–233) (including the amendments made by such Act), the Americans with Disabilities Act of 1990 (42 U.S.C. 12101 et seq.), section 504 of the Rehabilitation Act of 1973 (29 U.S.C. 794), section 1557 of the Patient Protection and Affordable Care Act (42 U.S.C. 18116), title VI of the Civil Rights Act of 1964 (42 U.S.C. 2000d), and title VII of the Civil Rights Act of 1964 (42 U.S.C. 2000e). (iv) Written notice Each plan year, a Covered Service Provider shall provide to each participant or beneficiary written notice informing the participant or beneficiary of the requirement that Covered Service Providers respond to requests to submit information or data under paragraph (1), as applicable, which may include incorporating such notification in plan documents provided to the participant or beneficiary, or providing individual notification. (v) Clarification regarding public disclosure of information Nothing in this subsection shall prevent a Covered Service Provider from placing reasonable restrictions on the public disclosure of the information or data described in paragraph (1), except that such Provider may not restrict disclosure of such report to the Department of Health and Human Services, the Department of Labor, or the Department of the Treasury. (vi) Limitation This paragraph shall not be construed to abridge or limit the disclosure requirements under this subsection or to impose additional privacy or security requirements on Covered Service Providers or plan sponsors. (C) Limitation on disclosure A group health plan receiving information or data under this subsection may disclose such information only in a manner that is consistent with HIPAA and the privacy and security regulations promulgated thereunder, regardless of their direct or indirect applicability to the plan or any entities that could be or are business associates. A group health plan (and any business associate or other entity acting on behalf of such plan) may use such information or data only for purposes of plan administration and may not sell, license, or otherwise commercially exploit such information or data or provide such information or data to any third party that may take such action. (D) Requirements of information Information made available under this subsection shall conform to the following standards: (i) All claims from a healthcare provider shall be made to the group health plan in accordance with transaction standards adopted by regulation under HIPAA, as follows: (I) Institutional, professional, and dental claims shall be in ASC X12N 837D format or any subsequent standard as established by the Secretary. (II) Pharmacy claims shall be in the National Council for Prescription Drug Programs (NCPDP) format or any subsequent standard as established by the Secretary. (III) The files shall be unmodified copies of the files sent from the provider, or, upon request, delivered in a machine readable format. In the event that paper claims are sent by the provider, they shall be converted to the appropriate standard electronic format. Files shall be accessible to the plan at no cost to the group health plan. (ii) All claim payment (or EFT, electronic funds transfer) and electronic remittance advice (ERA) notices sent by a Covered Service Provider shall be made available to the group health plan as ASC X12N 835 files (or any other format as identified by the Secretary) in accordance with standards adopted by regulation under HIPAA. The files shall be unmodified copies of the files sent by the Covered Service Provider to the healthcare provider. Files shall be accessible at no cost to the group health plan. (iii) The contractual terms containing payment calculations and formulas, pricing methodologies, and other information used to determine the dollar value of reimbursement, in a format as specified by the Secretary. (iv) All non-claim costs shall be itemized and made available to the group health plan as requested through a web-based portal, through an application program interface (API), through a downloadable Comma-Separated Value (CSV) file, and, as appropriate, through other downloadable machine-readable file types. (E) Implementation The Secretary shall implement this subsection through notice and comment rulemaking in accordance with section 553 of title 5, United States Code. (F) Definitions (i) In general The provisions of sections 408 and 410 of the Employee Retirement Income Security Act of 1974 shall apply with respect to terms used under this subsection. (ii) Specified large employer In this subsection, the term specified large employer means, in connection with a group health plan (including group health insurance coverage offered in connection with such a plan) established or maintained by a single employer, with respect to a calendar year or a plan year, as applicable, an employer who employed an average of at least 50 employees on business days during the preceding calendar year or plan year and who employs at least 1 employee on the first day of the calendar year or plan year. (iii) Specified large plan In this subsection, the term specified large plan means a group health plan (including group health insurance coverage offered in connection with such a plan) established or maintained by a plan sponsor described in clause (ii) or (iii) of section 3(16)(B) of the Employee Retirement Income Security Act of 1974 that had an average of at least 50 participants on business days during the preceding calendar year or plan year, as applicable.. (2) Civil enforcement (A) Civil enforcement Subsection (c) of section 502 of such Act (29 U.S.C. 1132) is amended by adding at the end the following new paragraph: (13) (A) In the case of an agreement between a group health plan (as defined in section 733(a)), the plan sponsor of such plan (as defined in section 3(16)(B)), or the plan administrator of such plan (as defined in section 3(16)(A)) and a health care provider (which, for purposes of this paragraph, includes a health care facility), network or association of providers, service provider offering access to a network or association of providers, third-party administrator, or pharmacy benefit manager, that violates the provisions of section 724(b), the Secretary may assess a civil penalty against such provider, network or association, service provider offering access to a network or association of providers, third-party administrator, pharmacy benefit manager, or other service provider in the amount of up to $10,000 for each day during which such violation continues. Such penalty shall be in addition to other penalties as may be prescribed by law. (B) Nothing in subparagraph (A) shall be construed to permit the Secretary to regulate health care providers acting in their capacity as medical organizations furnishing items and services to patients.. (B) Existing provisions void Section 410 of such Act (29 U.S.C. 1110) is amended by adding at the end the following: (c) Any provision in an agreement or instrument shall be void as against public policy if such provision— (1) unduly delays or limits a group health plan (as defined in section 733(a)), the plan sponsor of such plan (as defined in section 3(16)(B)), or the plan administrator of such plan (as defined in section 3(16)(A)) from accessing the claims and encounter information or data described in section 724(b)(1)(B); or (2) violates the requirements of section 408(b)(2)(C).. (C) Technical amendments Section 408(b)(2)(B) of such Act (29 U.S.C. 1108(b)(2)) is amended— (i) in clause (i), by striking this clause and inserting this paragraph; and (ii) by adding at the end the following: (xi) A contract or arrangement shall not be reasonable under this subparagraph if it fails to comply with section 724(b).. (b) Updated attestation for price and quality information Section 2799A–9(a)(4) of the Public Health Service Act (42 U.S.C. 300gg–119(a)(4)) is amended to read as follows: (4) Attestation (A) In general Subject to subparagraph (C), a group health plan or health insurance issuer offering group health insurance coverage shall annually submit to the Secretary an attestation that such plan or issuer of such coverage is in compliance with the requirements of this subsection. Such attestation shall also include a statement verifying that— (i) the information or data described under subparagraphs (A) and (B) of paragraph (1) is available upon request and provided to the group health plan, the plan sponsor, the plan administrator, or the business associate of such plan, or the issuer, as applicable, in a timely manner; and (ii) there are no terms in the agreement under such paragraph (1) that directly or indirectly restrict or unduly delay a group health plan, the plan sponsor, the plan administrator, a business associate of such plan, or the issuer from auditing, reviewing, or otherwise accessing such information. (B) Limitation on submission A group health plan or issuer offering group health insurance coverage may not enter into an agreement with a third-party administrator or other service provider to submit the attestation required under subparagraph (A). (C) Exception In the case of a group health plan or health insurance issuer offering group health insurance coverage that is unable to obtain the information or data needed to submit the attestation required under subparagraph (A), such plan or issuer may submit a written statement in lieu of such attestation that includes— (i) an explanation of why such plan or issuer was unsuccessful in obtaining such information or data, including whether such plan, the plan sponsor, or the plan administrator or issuer was limited or prevented from auditing, reviewing, or otherwise accessing such information or data; (ii) a description of the efforts made by the group health plan, the plan sponsor, or the plan administrator to remove any gag clause provisions from the agreement under paragraph (1); and (iii) a description of any response by the third-party administrator or other service provider with respect to efforts to comply with the attestation requirement under subparagraph (A), including the name of the third-party administrator or other service provider.. (c) Effective date The amendments made by subsections (a) and (b) shall apply with respect to a plan beginning with the first plan year that begins on or after the date that is 1 year after the date of enactment of this Act.