tions at parts 160 and 164 of title 45, Code of 
Federal Regulations, promulgated under sub-
title F of the Health Insurance Portability and 
Accountability Act of 1996, subtitle D of the 
Health Information Technology for Clinical 
Health Act of 2009, and section 1180 of the 
Social Security Act, and shall restrict the use 
and disclosure of such information according to 
such privacy, security, and breach notification 
regulations. An entity that receives a disclosure 
from a party in interest pursuant to subpara-
graph (B) or (C) shall comply with the privacy 
and security regulations promulgated under 
HIPAA. 
‘‘(B) RESTRICTIONS.—A group health plan 
that is a self-funded, non-Federal governmental 
plan shall comply with section 164.504(f) of 
title 45, Code of Federal Regulations (or a suc-
cessor regulation), and a plan sponsor shall act 
in accordance with the terms of the agreement 
described in such section. 
‘‘(C) RULE OF CONSTRUCTION.—Nothing 
in this section shall be construed to modify the 
requirements for the creation, receipt, mainte-
nance, or transmission of protected health in-
VerDate Sep 11 2014 
23:41 Oct 01, 2025
Jkt 059200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
kjohnson on DSK7ZCZBW3PROD with $$_JOB
formation under the HIPAA privacy regulations 
(45 C.F.R. parts 160 and 164, subparts A and 
E). 
‘‘(3) DISCLOSURE AND REDISCLOSURE.— 
‘‘(A) IN GENERAL.—A group health plan 
that is a self-funded, non-Federal governmental 
plan receiving information under paragraph (1) 
may disclose such information only— 
‘‘(i) to the entity from which the in-
formation was received or to that entity’s 
business associates as defined in section 
160.103 of title 45, Code of Federal Regu-
lations (or successor regulations); or 
‘‘(ii) as permitted by the HIPAA Pri-
vacy Rule (45 C.F.R. parts 160 and 164, 
subparts A and E). 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this section shall be construed to prevent a 
group health plan that is a self-funded, non- 
Federal Governmental plan, or a health plan 
service provider providing services with respect 
to such a plan, from placing reasonable restric-
tions on the public disclosure of the information 
described in paragraph (1), except that such 
plan or entity may not restrict disclosure of 
VerDate Sep 11 2014 
23:41 Oct 01, 2025
Jkt 059200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
kjohnson on DSK7ZCZBW3PROD with $$_JOB
such information to the Department of Health 
and Human Services, the Department of Labor, 
the Department of the Treasury, or the Comp-
troller General of the United States. 
‘‘(C) FAILURE TO PROVIDE.—The obliga-
tion to provide information pursuant to this 
subsection shall exist notwithstanding the pres-
ence of any formal data-sharing agreement be-
tween the parties. Failure to provide the re-
quired information as specified shall constitute 
a violation of this Act and the Secretary shall 
initiate 
enforcement 
action 
under 
section 
2723(b) (42 U.S.C. 300gg–22(b)) within 90 
days of becoming aware of a violation of this 
section, except that nothing in this section shall 
be construed to limit the Secretary’s existing 
authority under this Act. 
‘‘(4) DATA FORMAT STANDARDS.—All data and 
information provided pursuant to this subsection 
shall comply with the following standards: 
‘‘(A) All claims from a healthcare provider 
shall be made to the group health plan in ac-
cordance with standards adopted under HIPAA 
at section 162.1101 of title 45, Code of Federal 
Regulations, as follows: 
VerDate Sep 11 2014 
23:41 Oct 01, 2025
Jkt 059200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(i) Institutional, professional, and 
dental claims and adjustments to these 
claims shall be provided to the group 
health plan that is a self-funded, non-Fed-
eral Governmental plan in the ASC X12N 
837 format. 
‘‘(ii) Prescription drug claims shall be 
in the National Council for Prescription 
Drug Programs (NCPDP) format. 
‘‘(iii) The files shall be unmodified 
copies of the files sent from the provider. 
In the event that paper claims are sent by 
the provider, they shall be converted to the 
appropriate standard electronic format. 
Such data shall be provided at no cost to 
the group health plan. 
‘‘(B) All claim payment (or EFT, elec-
tronic funds transfer) and electronic remittance 
advice (ERA) information sent by a health plan 
service provider shall be provided to the group 
health plan or health insurance issuer in the 
ASC X12N 835 format, in accordance with 
standards adopted under HIPAA at section 
162.1602 of title 45, Code of Federal Regula-
tions, unmodified from the form in which it was 
VerDate Sep 11 2014 
23:41 Oct 01, 2025
Jkt 059200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
kjohnson on DSK7ZCZBW3PROD with $$_JOB
transmitted to the healthcare provider. Such in-
formation shall be provided at no cost to the 
group health plan. 
‘‘(C) The Secretary may modify the stand-
ards set forth in this paragraph as necessary to 
align with any changes adopted by the Sec-
retary pursuant to the authority provided under 
section 1173 of the Social Security Act (42 
U.S.C. 1320d–2). 
‘‘(c) PROHIBITED CONTRACTUAL PROVISIONS.—Any 
provision in an agreement that unduly delays or limits a 
group health plan that is a self-funded, non-Federal Gov-
ernmental plan’s access to information described in this 
section or that restricts the format or timing of the provi-
sion of such information in a manner that is inconsistent 
with the requirements of this section shall be prohibited 
and, if a self-funded, non-Federal Governmental plan en-
ters into such agreement, shall be deemed void as against 
public policy. 
‘‘(d) REGULATIONS.—The Secretary shall implement 
this section through notice and comment rulemaking in 
accordance with section 553 of title 5, United States 
Code.’’. 
VerDate Sep 11 2014 
23:41 Oct 01, 2025
Jkt 059200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H5582.IH
H5582
kjohnson on DSK7ZCZBW3PROD with $$_JOB