H.R. 9228

119 HR 9228 IH: Health Data Access, Transparency, and Affordability Act of 2026
 U.S. House of Representatives
 2026-06-09
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 I  119th CONGRESS  2d Session  H. R. 9228  IN THE HOUSE OF REPRESENTATIVES   June 9, 2026   Mr. Onder  introduced the following bill; which was referred to the  Committee on Education and Workforce    A BILL
To amend the Employee Retirement Income Security Act of 1974 to ensure plan fiduciaries have access to de-identified information relating to health claims, and for other purposes.
1.
Short title
This Act may be cited as the   Health Data Access, Transparency, and Affordability Act of 2026  .
2.
Increasing group health plan access to health data
(a)
Group health plan access to information
(1)
Definition
Section 3 of the Employee Retirement Income Security Act of 1974 ( 29 U.S.C. 1002 ) is amended by adding at the end the following:
(46)
Network service provider
(A)
In general
The term  network service provider  means—
(i)
any person or entity that has an arrangement or contract, direct or indirect, to provide services to a group health plan (as defined in section 733(a)), including a health care provider, health care facility, network or association of providers, service provider offering access to a network of providers, third party administrator, health insurance issuer (as defined in section 733(b)), entity providing pharmacy benefit management services, or any other service provider; and
(ii)
any person or entity acting as an intermediary between the group health plan and a person or entity described in subparagraph (A).
(B)
Health care provider
Notwithstanding subparagraph (A), no health care provider shall be considered a network service provider solely in its capacity as a provider of health care services.
 .
(2)
In general
Section 408(b)(2) of such Act ( 29 U.S.C. 1108(b)(2) ) is amended by adding at the end the following:
(D)
No contract or arrangement for services, whether direct or indirect, and no extension or renewal of such contract or arrangement, between a group health plan (as defined in section 733(a)) and any other person or entity, including a network service provider, is reasonable within the meaning of this paragraph unless such contract or arrangement—
(i)
allows the responsible plan fiduciary (as that term is defined in subparagraph (B)(ii)(I)) and the designated agent (which may include the plan sponsor, the plan administrator, or a business associate (other than such other party or entity (or its subsidiaries or affiliates))) of such fiduciary access to all claims and encounter information described in section 724(a)(1)(B), and any documentation, including medical records and policy documents, supporting claim payments; and
(ii)
does not—
(I)
limit or delay access by the responsible plan fiduciary or designated agent to claims and encounter information or data for longer than 15 days or a period determined appropriate by the Secretary, whichever is shorter;
(II)
limit the amount of claims and encounter information or data that the responsible plan fiduciary or designated agent may access pursuant to any request for such information or data;
(III)
limit access by the responsible plan fiduciary or designated agent to pricing terms for alternative payment arrangements or capitated payment arrangements, including—
(aa)
payment calculations and formulas;
(bb)
quality measurements or indicators;
(cc)
contract terms;
(dd)
payment amounts;
(ee)
measurement periods for all incentives; and
(ff)
other payment methodologies;
(IV)
limit access by the responsible plan fiduciary or designated agent to information regarding overpayments, including terms for recovery of overpayments;
(V)
limit the ability of the group health plan, the plan sponsor, or the plan administrator of such plan to select an auditor and define the scope and frequency of audits;
(VI)
otherwise limit or delay the responsible plan fiduciary or designated agent from accessing such claims and encounter information or data in a daily batch or on a daily basis;
(VII)
limit the disclosure to the responsible plan fiduciary or designated agent of fees charged to the group health plan related to plan administration and claims processing, including renegotiation fees, access fees, repricing fees, or enhanced review fees;
(VIII)
limit the ability of the responsible plan fiduciary or designated agent to request action on any claims or claim payments that such fiduciary or agent identifies as potentially erroneous or fraudulent;
(IX)
limit public disclosure of de-identified or aggregated information; or
(X)
limit access by the responsible plan fiduciary or designated agent to any extra-contractual terms containing claims payment calculations and formulas, pricing methodologies, and other information used to determine the dollar value of provider reimbursement.
(E)
(i)
A person or entity shall provide information or data under this paragraph in a manner consistent with the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act (referred to in this paragraph as  HIPAA ).
(ii)
A group health plan that receives a disclosure pursuant to subparagraph (B) or (C) shall comply with the privacy and security regulations promulgated under HIPAA.
(iii)
Nothing in this subparagraph shall be construed to modify the requirements for the creation, receipt, maintenance, or transmission of protected health information under the HIPAA privacy regulation (as defined in section 1180(b)(3) of the Social Security Act) as they apply directly or indirectly to a person or an entity pursuant to this paragraph.
(iv)
This subparagraph shall not be read to abridge or limit the disclosure requirements under this paragraph or to impose additional privacy or security requirements on network service providers or plan sponsors.
(F)
A group health plan receiving information or data under this paragraph may disclose such information only in a manner that is consistent with HIPAA and the privacy and security regulations promulgated thereunder, regardless of their direct or indirect applicability to the plan or any persons or entities that could be or are business associates.
(G)
Information made available under this subparagraph shall conform to the following standards:
(i)
All claims from a healthcare provider shall be provided to the group health plan in accordance with transaction standards adopted by regulation under HIPAA, as follows:
(I)
Institutional, professional, and dental claims shall be in ASC X12N 837 format or any subsequent standard approved by the Secretary.
(II)
Pharmacy claims shall be in the National Council for Prescription Drug Programs format or any subsequent standard approved by the Secretary.
(III)
The files shall contain unmodified data taken directly from the files sent from the provider. In the event that paper claims are sent by the provider, they shall be converted to the appropriate standard electronic format. The files shall be accessible to the plan at no cost to the group health plan.
(ii)
All claim payment (or electronic funds transfer (EFT)) and electronic remittance advice (ERA) notices sent by a network service provider shall be made available to the group health plan as ASC X12N 835 files, or any subsequent standard approved by the Secretary, in accordance with standards adopted by regulation under HIPAA. The files shall be unmodified copies of the files sent by the network service provider to the healthcare provider. Files shall be accessible at no cost to the group health plan.
(iii)
All non-claim costs shall be itemized and made available to the group health plan in real time through a web-based portal, through an Application Programming Interface and through a downloadable Comma Separated Value file, or any subsequent standards approved by the Secretary.
(H)
The Secretary shall have authority to implement subparagraphs (C) through (F) through notice and comment rulemaking in accordance with section 553 of title 5, United States Code.
 .
(3)
Civil enforcement
Section 502(c) of such Act ( 29 U.S.C. 1132(c) ) is amended by adding at the end the following:
(14)
In the case of an agreement between a group health plan (as defined in section 733(a)), or the responsible plan fiduciary, the plan sponsor, or the plan administrator of such plan, and any other person or entity, including a network service provider that violates section 724, the Secretary of Labor may assess a civil penalty against such other person or entity in the amount of up to $10,000 for each day during which such violation continues. Such penalty shall be in addition to other penalties as may be prescribed by law.
 .
(4)
Existing provisions void
Section 410 of such Act ( 29 U.S.C. 1110 ) is amended by adding at the end the following:
(c)
Any provision in an agreement or instrument shall be void as against public policy if such provision—
(1)
delays or limits a group health plan (as defined in section 733(a)), or the responsible plan fiduciary, the plan sponsor, or the plan administrator of such plan, from accessing the claims and encounter information or data described in section 724(a)(1)(B); or
(2)
violates the requirements of section 408(b)(2).
 .
(5)
Prohibition on indemnification of service providers for civil penalties
Section 410(a) of such Act ( 29 U.S.C. 1110(a) ) is amended—
(A)
by striking  Except  and inserting  (1) Except ; and
(B)
by adding at the end the following:
(2)
Except as provided in subsection 410(b)(2), no person or entity subject to a civil enforcement penalty under section 502(a)(13), 502(a)(14), 502(a)(15) or section 727(d) may be indemnified, directly or indirectly, or otherwise relieved from liability for any penalty, responsibility, obligation, or duty of such person or entity under this title.
(3)
Any provision of a contract or agreement in violation of paragraph (2) shall be void as against public policy.
 .
(b)
Updated attestation for price and quality information
Section 724(a)(3) of such Act ( 29 U.S.C. 1185m(a)(3) ) is amended to read as follows:
(3)
Attestation
(A)
In general
Subject to subparagraph (C), a group health plan or health insurance issuer offering group health insurance coverage shall annually submit to the Secretary an attestation that such plan or issuer of such coverage is in compliance with the requirements of this subsection. Such attestation shall also include a statement verifying that—
(i)
the information or data described under subparagraphs (A) and (B) of paragraph (1) is available upon request and provided to the group health plan, the plan sponsor, the plan administrator, or the business associate (other than the contracting party or entity or its subsidiaries or affiliates) of such plan, or the issuer in a timely manner; and
(ii)
there are no terms in the agreement under such paragraph (1) that directly or indirectly restrict or unduly delay a group health plan, the plan sponsor, the plan administrator, a business associate (other than the contracting party or entity or its subsidiaries or affiliates) of such plan, or the issuer from auditing, reviewing, or otherwise accessing such information.
(B)
Limitation on submission
A group health plan or issuer offering group health insurance coverage may not enter into an agreement with a third-party administrator or other service provider to submit the attestation required under subparagraph (A).
(C)
Exception
In the case of a group health plan or issuer offering group health insurance coverage that is unable to obtain the information or data needed to submit the attestation required under subparagraph (A), such plan or issuer may submit a written statement in lieu of such attestation that includes—
(i)
an explanation of why such plan or issuer was unsuccessful in obtaining such information or data, including whether such plan, the plan sponsor, or the plan administrator or issuer was limited or prevented from auditing, reviewing, or otherwise accessing such information or data;
(ii)
a description of the efforts made by the group health plan, the plan sponsor, or the plan administrator to remove any gag clause provisions from the agreement under paragraph (1); and
(iii)
a description of any response by the third-party administrator or other service provider with respect to efforts to comply with the attestation requirement under subparagraph (A), including the name of the third-party administrator or other service provider.
 .
(c)
Effective date
The amendments made by subsections (a) and (b) shall apply with respect to a plan beginning with the first plan year that begins on or after the date that is 1 year after the date of enactment of this Act regardless of the date of execution of any contact with a network service provider.