Health Data Access, Transparency, and Affordability Act of 2026

terms for recovery of overpayments; ``(V) limit the ability of the group health plan, the plan sponsor, or the plan administrator of such plan to select an auditor and define the scope and frequency of audits; ``(VI) otherwise limit or delay the responsible plan fiduciary or designated agent from accessing such claims and encounter information or data in a daily batch or on a daily basis; ``(VII) limit the disclosure to the responsible plan fiduciary or designated agent of fees charged to the group health plan related to plan administration and claims processing, including renegotiation fees, access fees, repricing fees, or enhanced review fees; ``(VIII) limit the ability of the responsible plan fiduciary or designated agent to request action on any claims or claim payments that such fiduciary or agent identifies as potentially erroneous or fraudulent; ``(IX) limit public disclosure of de- identified or aggregated information; or ``(X) limit access by the responsible plan fiduciary or designated agent to any extra- contractual terms containing claims payment calculations and formulas, pricing methodologies, and other information used to determine the dollar value of provider reimbursement. ``(E)(i) A person or entity shall provide information or data under this paragraph in a manner consistent with the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act (referred to in this paragraph as `HIPAA'). ``(ii) A group health plan that receives a disclosure pursuant to subparagraph (B) or (C) shall comply with the privacy and security regulations promulgated under HIPAA. ``(iii) Nothing in this subparagraph shall be construed to modify the requirements for the creation, receipt, maintenance, or transmission of protected health information under the HIPAA privacy regulation (as defined in section 1180(b)(3) of the Social Security Act) as they apply directly or indirectly to a person or an entity pursuant to this paragraph. ``(iv) This subparagraph shall not be read to abridge or limit the disclosure requirements under this paragraph or to impose additional privacy or security requirements on network service providers or plan sponsors. ``(F) A group health plan receiving information or data under this paragraph may disclose such information only in a manner that is consistent with HIPAA and the privacy and security regulations promulgated thereunder, regardless of their direct or indirect applicability to the plan or any persons or entities that could be or are business associates. ``(G) Information made available under this subparagraph shall conform to the following standards: ``(i) All claims from a healthcare provider shall be provided to the group health plan in accordance with transaction standards adopted by regulation under HIPAA, as follows: ``(I) Institutional, professional, and dental claims shall be in ASC X12N 837 format or any subsequent standard approved by the Secretary. ``(II) Pharmacy claims shall be in the National Council for Prescription Drug Programs format or any subsequent standard approved by the Secretary. ``(III) The files shall contain unmodified data taken directly from the files sent from the provider. In the event that paper claims are sent by the provider, they shall be converted to the appropriate standard electronic format. The files shall be accessible to the plan at no cost to the group health plan. ``(ii) All claim payment (or electronic funds transfer (EFT)) and electronic remittance advice (ERA) notices sent by a network service provider shall be made available to the group health plan as ASC X12N 835 files, or any subsequent standard approved by the Secretary, in accordance with standards adopted by regulation under HIPAA. The files shall be unmodified copies of the files sent by the network service provider to the healthcare provider. Files shall be accessible at no cost to the group health plan. ``(iii) All non-claim costs shall be itemized and made available to the group health plan in real time through a web-based portal, through an Application Programming Interface and through a downloadable Comma Separated Value file, or any subsequent standards approved by the Secretary. ``(H) The Secretary shall have authority to implement subparagraphs (C) through (F) through notice and comment rulemaking in accordance with section 553 of title 5, United States Code.''. (3) Civil enforcement.--Section 502(c) of such Act (29 U.S.C. 1132(c)) is amended by adding at the end the following: ``(14) In the case of an agreement between a group health plan (as defined in section 733(a)), or the responsible plan fiduciary, the plan sponsor, or the plan administrator of such plan, and any other person or entity, including a network service provider that violates section 724, the Secretary of Labor may assess a civil penalty against such other person or entity in the amount of up to $10,000 for each day during which such violation continues. Such penalty shall be in addition to other penalties as may be prescribed by law.''. (4) Existing provisions void.--Section 410 of such Act (29 U.S.C. 1110) is amended by adding at the end the following: ``(c) Any provision in an agreement or instrument shall be void as against public policy if such provision-- ``(1) delays or limits a group health plan (as defined in section 733(a)), or the responsible plan fiduciary, the plan sponsor, or the plan administrator of such plan, from accessing the claims and encounter information or data described in section 724(a)(1)(B); or ``(2) violates the requirements of section 408(b)(2).''. (5) Prohibition on indemnification of service providers for civil penalties.--Section 410(a) of such Act (29 U.S.C. 1110(a)) is amended-- (A) by striking ``Except'' and inserting ``(1) Except''; and (B) by adding at the end the following: ``(2) Except as provided in subsection 410(b)(2), no person or entity subject to a civil enforcement penalty under section 502(a)(13), 502(a)(14), 502(a)(15) or section 727(d) may be indemnified, directly or indirectly, or otherwise relieved from liability for any penalty, responsibility, obligation, or duty of such person or entity under this title. ``(3) Any provision of a contract or agreement in violation of paragraph (2) shall be void as against public policy.''. (b) Updated Attestation for Price and Quality Information.--Section 724(a)(3) of such Act (29 U.S.C. 1185m(a)(3)) is amended to read as follows: ``(3) Attestation.-- ``(A) In general.--Subject to subparagraph (C), a group health plan or health insurance issuer offering group health insurance coverage shall annually submit to the Secretary an attestation that such plan or issuer of such coverage is in compliance with the requirements of this subsection. Such attestation shall also include a statement verifying that-- ``(i) the information or data described under subparagraphs (A) and (B) of paragraph (1) is available upon request and provided to the group health plan, the plan sponsor, the plan administrator, or the business associate (other than the contracting party or entity or its subsidiaries or affiliates) of such plan, or the issuer in a timely manner; and ``(ii) there are no terms in the agreement under such paragraph (1) that directly or indirectly restrict or unduly delay a group health plan, the plan sponsor, the plan administrator, a business associate (other than the contracting party or entity or its subsidiaries or affiliates) of such plan, or the issuer from auditing, reviewing, or otherwise accessing such information. ``(B) Limitation on submission.--A group health plan or issuer offering group health insurance coverage may not enter into an agreement with a third-party administrator or other service provider to submit the attestation required under subparagraph (A). ``(C) Exception.--In the case of a group health plan or issuer offering group health insurance coverage that is unable to obtain the information or data needed to submit the attestation required under subparagraph (A), such plan or issuer may submit a written statement in lieu of such attestation that includes-- ``(i) an explanation of why such plan or issuer was unsuccessful in obtaining such information or data, including whether such plan, the plan sponsor, or the plan administrator or issuer was limited or prevented from auditing, reviewing, or otherwise accessing such information or data; ``(ii) a description of the efforts made by the group health plan, the plan sponsor, or the plan administrator to remove any gag clause provisions from the agreement under paragraph (1); and ``(iii) a description of any response by the third-party administrator or other service provider with respect to efforts to comply with the attestation requirement under subparagraph (A), including the name of the third-party administrator or other service provider.''. (c) Effective Date.--The amendments made by subsections (a) and (b) shall apply with respect to a plan beginning with the first plan year that begins on or after the date that is 1 year after the date of enactment of this Act regardless of the date of execution of any contact with a network service provider. <all>