Oversight of administrative service providers

(a) PHSA amendment Part D of title XXVII of the Public Health Service Act (42 U.S.C. 300gg–111 et seq.), as amended by section 404, is amended by adding at the end the following: 2799A–15. Oversight of administrative service providers (a) In general For plan years beginning on or after January 1 of the year that begins on or after the date that is 1 year after the date of enactment of the Health CARE Act of 2026, no agreement between a group health plan that is offered by a specified large employer or that is a specified large plan (as such terms are defined in section 2799A–11(f)) or a health insurance issuer offering individual or group health coverage (that makes an election subject to subsection (b)(5)) and a health insurance issuer that is operating as a third-party administrator, a health care provider, network or association of providers, third-party administrator, service provider offering access to a network of providers, pharmacy benefit managers, or any other third party (each referred to in this section as a health plan service provider) is permissible if such agreement limits (or delays beyond the applicable reporting period described in subsection (b)(1)) the disclosure of information to such group health plans and health insurance issuers in a manner that prevents any health plan service provider from providing the information described in subsection (b). (b) Required disclosures (1) Contents and frequency With respect to plan years beginning on or after the date that is 1 year after the date of enactment of this section, not less frequently than quarterly, a health plan service provider shall provide to the group health or the health insurance issuer offering individual or group health insurance coverage the following information at no cost to the plan or issuer: (A) The information described in section 2799A–9(a)(1)(B) (42 U.S.C. 300gg–119(a)(1)(B)). (B) Any contractual and subcontractual calculation methodologies, pricing or fee schedules, or other formulae used to determine reimbursement amounts to providers and subcontractors, including methodologies, schedules, fee structures, and any applied adjustments or modifiers, with such information provided in a manner sufficiently detailed to enable the group health plan or issuer to accurately assess, verify, and ensure compliance with the terms of any contractual and subcontractual agreement governing the reimbursement amounts. (C) The total amount received or expected to be received by the health plan service provider or its subcontractors in provider or supplier rebates, fees, alternative discounts, and all other remuneration including amounts held in escrow or variance accounts that has been paid or is to be paid for claims incurred and administrative services including data sales or network payments. (D) The total amount paid or expected to be paid by the health plan service provider to its subcontractors in rebates, fees, contractual arrangements, and all other remuneration for administrative and other services. (E) All payment data, calculation methodologies, and reconciliation information related to alternative compensation arrangements, including accountable care organizations, value-based programs, shared savings programs, incentive compensation, bundled payments, capitation arrangements, performance payments, and any other reimbursement or payment models, where the group health plan paid fees, incurred obligations, or made payments in connection with the group health plan or issuer related to such arrangements. (F) Whether, with respect to a provider that files claims under such plan or coverage, the health plan service provider— (i) has an ownership or investment interest; (ii) has a controlling interest; (iii) is a management services organization; or (iv) is a significant equity investor. (G) The name and business address for each person or entity that, with respect to the health plan service provider— (i) has an ownership or investment interest; (ii) has a controlling interest; or (iii) is a significant equity investor. (2) Manner of providing information or data (A) In general A health plan service provider shall provide information or data under paragraph (1) in a manner consistent with the privacy regulations promulgated under section 13402(a) of the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. 17932(a)) and consistent with the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations) (referred to in this paragraph as the HIPAA privacy regulations) and shall restrict the use and disclosure of such information according to such privacy regulations and such HIPAA privacy regulations. (B) Additional requirements In carrying out this subsection, a health plan service provider shall comply with section 164.504(f) of title 45, Code of Federal Regulations (or a successor regulation). (C) Rule of construction (i) In general Nothing in this subsection shall be construed to modify the requirements for the creation, receipt, maintenance, or transmission of protected health information under the HIPAA privacy regulations. (ii) Civil rights laws Nothing in this subsection shall be construed to affect the application of any Federal or State privacy or civil rights law, including the HIPAA privacy regulations, the Genetic Information Nondiscrimination Act of 2008 (Public Law 110–233) (including the amendments made by such Act), the Americans with Disabilities Act of 1990 (42 U.S.C. 12101 et seq.), section 504 of the Rehabilitation Act of 1973 (29 U.S.C. 794), section 1557 of the Patient Protection and Affordable Care Act (42 U.S.C. 18116), title VI of the Civil Rights Act of 1964 (42 U.S.C. 2000d), and title VII of the Civil Rights Act of 1964 (42 U.S.C. 2000e). (D) Written notice Each plan year, a health plan service provider shall provide to each participant or beneficiary written notice informing the participant or beneficiary of the requirement for health plan service providers to submit information or data under paragraph (1), as applicable, which may include incorporating such notification in plan documents provided to the participant or beneficiary, or providing individual notification. (E) Clarification regarding public disclosure of information Nothing in this subsection shall prevent a health plan service provider from placing reasonable restrictions on the public disclosure of the information or data described in paragraph (1), except that such provider may not restrict disclosures under subsection (b)(1) to the Department of Health and Human Services, the Department of Labor, or the Department of the Treasury. (F) Limitation This paragraph shall not be construed to abridge or limit the disclosure requirements under this subsection or to impose additional privacy or security requirements on health plan service providers or plan sponsors. (3) Disclosure and redisclosure (A) In general A group health plan or health insurance issuer offering individual or group coverage receiving information under paragraph (1) may disclose such information only— (i) to the entity from which the information was received or to that entity’s business associates as defined in section 160.103 of title 45, Code of Federal Regulations (or successor regulations); or (ii) as permitted by the HIPAA Privacy Rule (45 CFR part 160 and subparts A and E of part 164). (B) Availability of information To the extent the information required by this subsection is made available to the health insurance issuer offering group health insurance coverage, the health insurance issuer shall make such information available, at the same time, in the same format, and at no cost, to the group health plan. (C) Limitation on use of information A group health plan or health insurance issuer (and any business associate or other entity acting on behalf of such plan) may use information or data under this paragraph only for purposes of plan administration and may not sell, license, or otherwise commercially exploit such information or data or provide such information or data to any third party that may take such action. (D) Rule of construction Nothing in this section shall be construed to prevent a group health plan, a health insurance issuer, or a health plan service provider providing services with respect to such a plan, from placing reasonable restrictions on the public disclosure of the information described in paragraph (1), except that such plan or entity may not restrict disclosure of such information to the Department of Health and Human Services, the Department of Labor, the Department of the Treasury, or the Comptroller General of the United States. (E) Failure to provide The obligation to provide information pursuant to this subsection shall exist notwithstanding the presence of any formal data-sharing agreement between the parties. Failure to provide the required information as specified shall constitute a violation of this Act and the Secretary shall initiate enforcement action under section 2723(b) (42 U.S.C. 300gg–22(b)) within 90 days of becoming aware of a violation of this section, except that nothing in this section shall be construed to limit the Secretary’s existing authority under this Act. (4) Data format standards All data and information provided pursuant to this subsection shall comply with the following standards: (A) All claims from a healthcare provider shall be made to the group health plan in accordance with standards adopted under HIPAA as described in subpart K of part 162 of title 45, Code of Federal Regulations, as follows: (i) Institutional, professional, and dental claims and adjustments to these claims shall be provided to the group health plan or health insurance issuer in the ASC X12N 837 format. (ii) Prescription drug claims shall be in the National Council for Prescription Drug Programs (NCPDP) format. (iii) The files shall be unmodified copies of the files sent from the provider. In the event that paper claims are sent by the provider, they shall be converted to the appropriate standard electronic format. Such data shall be provided at no cost to the group health plan. (B) All claim payment (or EFT, electronic funds transfer) and electronic remittance advice (ERA) information sent by a health plan service provider shall be provided to the group health plan or health insurance issuer in the ASC X12N 835 format, in accordance with standards and operating rules adopted under HIPAA at subpart P of part 162 of title 45, Code of Federal Regulations, unmodified from the form in which it was transmitted to the healthcare provider. Such information shall be provided at no cost to the group health plan. (C) The Secretary may modify the standards set forth in this paragraph as necessary to align with any changes adopted by the Secretary pursuant to the authority provided under section 1173 of the Social Security Act (42 U.S.C. 1320d–2). (5) Opt-in for health insurance coverage In the case of a health insurance issuer offering coverage in the individual or group market, such issuer may, on an annual basis, for plan years beginning on or after the effective date of this section, elect to require a health plan service provider to submit to such issuer a report that includes all of the information described in paragraph (1). (c) Prohibited contractual provisions Any provision in an agreement that unduly delays or limits a group health plan or issuer’s access to information described in this section or that restricts the format or timing of the provision of such information in a manner that is inconsistent with the requirements of this section shall be prohibited and, if a group health plan or issuer enters into such agreement, shall be deemed void as against public policy. (d) Regulations The Secretary shall implement this section through notice and comment rulemaking in accordance with section 553 of title 5, United States Code.. (b) Penalty Section 2723(b) of the Public Health Service Act (42 U.S.C. 300gg–22(b)) is amended by adding at the end the following: (4) Enforcement authority relating to health plan service providers Notwithstanding any provisions to the contrary, the Secretary may assess a penalty against a health plan service provider, as defined in section 2799A–15(a), of $100,000 per day for each violation of such section, pursuant to substantially similar processes and procedures as those set forth in section 2723(b)(2)(D) through (G).. (c) ERISA amendments (1) In general Section 502(c) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1132(c)) is amended by adding at the end the following new paragraph: (14) The Secretary may assess a civil penalty against any person of $100,000 per day for each violation by any person of section 2799A–15 of the Public Health Service Act.. (2) Technical amendment Paragraph (6) of section 502(a) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1132(a)) is amended by striking or (9) and inserting (9), (13), or (14).