An Act to Strengthen
Maine Legislature, Session 132, LD 0378
Committee Amendment CA_A_S624 (Senate)
Amends: 24-A MRSA §1914, 24-A MRSA §4347, 24-A MRSA §4349-B

COMMITTEE AMENDMENT " ^ " to S.P. 135, L.D. 378, "An Act to Strengthen
tile Health Care System in Maine"
Amend the bill by striking out the title and substituting the following:
'An Act to Clarify That Health Insurers Must Comply with Plan Sponsors' Statutory
Rights to Audit Claims and Data Requests Related to Those Audits'
Amend tlie bill by inserting after the title and before the enacting clause the following:
'Emergency preamble. Whereas, acts and resolves of the Legislature do not
become effective until 90 days after adjournment unless enacted as emergencies; and
Whereas, current law requires 3rd-party administrators of health plans to grant plan
sponsors certain audit rights and to provide the requisite medical and pharmacy data to
conduct those audits; and
Whereas, this legislation clarifies that law to ensure that liealth insurers administering
health plans on behalf of plan sponsors are considered administrators and must comply
with a plan sponsor's statutory right to audit claims and data requests related to those audits;
and
Whereas, this legislation needs to take effect without delay so that plan sponsors can
include these audit rights in contracts with administrators that are being renewed, amended
or entered into prior to the 2027 plan year; and
Whereas, in the judgment of the Legislature, these facts create an emergency within
the meaning of the Constitution of Maine and require the following legislation as
immediately necessary for the preservation of the public peace, health and safety; now,
therefore,'
Amend the bill by striking out everything after the enacting clause and inserting the
following;
'See. 1. 24-AMRSA §1914, sub-§2, as enacted by PL 2025, c. 487, §1, is amended
to read:
COMMITTEE AMENDMENT
ROS
COMMITTEE AMENDMENT " j\ " to S,P, 135, L,D, 378 ( ^"(
2. Claims data; right to audit. An administrator that contracts with a plan sponsor
to provide health coverage shall permit a plan sponsor to perform a post-payment audit of
all claims paid to ensure compliance with tile contract at least once in a calendar year as
long as the request is not earlier than 6 months following a previously requested audit,
Upon request of a plan sponsor as part of an audit, an administrator shall disclose within
30 business days to a plan sponsor that has certified its compliance with the use and
disclosure requirements of 45 Code of Federal Regulations, Section 164.504(f) or, to the
extent permitted by law and if requested by the plan sponsor, to the plan sponsor's plan's
designated business associate the following information specific to the plan sponsor
sponsor's plans:
A. Claims data received by the administrator via electronic claims transactions on any
current standardized claim form approved by the Federal Government for professional
services or institutional services. The form or transaction may be modified only as
necessary to comply with the federal Health Insurance Portability and Accountability
Act of 1996, Public Law 104-191;
B. Claims payments, electronic funds transfers or remittance advice notices provided
by the administrator as electronic files compliant with tlie federal Health Insurance
Portability and Accountability Act of 1996, Public Law 104-191, including, but not
limited to, electronic claims transactions for both the billed amount and the paid
amount for professional services and both the billed amount and the paid amount for
institutional services, The files may be modified only as necessary to comply with the
federal Health Insurance Portability and Accountability Act of 1996, Public Law
104-191, and the federal Health Information Technology for Economic and Clinical
Health Act of 2009, Title XIII, Subtitle D, Public Law 111 -5, and any regulations
promulgated under those laws;
C, Any fees charged to the plan sponsor related to plan administration and claims
processing, including renegotiation fees, access fees, repricing fees or enhanced review
fees; and
D. Any out-of-network fees or out-of-network negotiated discounts, aligned incentive
program fees, pay-for-performance payments and recoveries, cost-confainment
program fees, overpayment recovery program fees, subrogation fees and any other
special program fees and discounts.
See. 2. 24-A MR8A §1914, sub-§4, as enacted by PL 2025,c. 487, § 1, is amended
to read;
4. Nondisclosure and data use agreement. An administrator may require that the
plan sponsor and the plan sponsor's designated business associate execute a nondisclosure
and data use agreement that protects the confidentiality of the administrator's trade secrets.
proprietary information or information otherwise confidential by law. rule or regulation
before data is provided in accordance with this section and that reasonably restricts the
auditor's use of such data provided by the administrator to the sole purpose of conducting
an audit on behalf of a plan sponsor. The coverage limits of any cybersecurity insurance or
liability insurance policy required under the nondisclosure and data use agreement may not
exceed the administrator's limit of liability under the services agreement between tlie plan
sponsor and the administrator, if such limit applies. Except for the coverage limits of any
cvbersecurhv insufance or liability insurance policy, this subsection is not intended to limit
Page2-132LR0726(02)
COMMITTEE AMENDMENT
ROS
COMMITTEE AMENDMENT"/^ "toS.P, 135> L,D. 378 ( ")•
I the inclusion in a nondisclosure and data use apreement of reasonable requirements
regardiiiR notice, indemnificatioii or liability for the unauthorized disclosure or security
breach of data m the possession of the plan sponsor or its desienated business associate
pursuant to tliis section, In addition, an administrator is not required to provide data to an
auditor selected by a plan sponsor if the auditor has previously breached a nondisclosure
and data use agreement with that administrator or refuses to execute a nondisclosure and
data use agreement.
See. 3. 24-A MRSA §1914, sub"§4-A is enacted to read:
4-A. Liability for disclosure of protected information. A plan sponsor or a plan
sponsor's designated business associate who receives information from an administrator
pursuant to this section shall notify the administrator of any unauthorized disclosure or
security breach of the followine information in the possession of the plan sponsof or its
designated business associate immediately upon discover/ of the unauthorized disclosure
or security breach of;
A. Personal information as defined in Title 10. section 1347. subsection 6;
B, Protected health infoi'tnation in violation of any applicable reciuirements of the
federal Health Insurance Portability and Accountability Act of 1996. Public Law
104-191. and any reeulations promuleated under that law;
C, Electronic Drotectedlw^^^^^ the federal Health Information
Technoloev for Economic and Clinical Health Act of 2009. Title XIII. Subtitle D.
Public Law 11 1-5. and any regulations promuleated under that law; or
D. Nonmiblic information as defined in section 2263. subsection 10.
Sec. 4. 24-A MRSA §1914, sub-§S-A is enacted to read:
S-A. Certain nersons actine as administrators included. Notwithstandine section
1901, subsection 1. oaraeraohs D and E. for the purposes of this section, an admmistrator
subject to the requirements of this section includes any person who, on behalf of a plan
sponsor, receives or collects charges, contributions or premiums for or adjusts or settles
claims on residents of this State in connection with any type of health benefit.
Sec. 5. 24-A MRSA §4347, sub-§l-A is enacted to read;
1-A. Administrator. "Administrator" includes. notwithstandine section 1901.
subsection 1. paragt'aRhs D and B, any person who. on behalf of a plan sponsor, receives or
collects charees. contributions or premiums for or adjusts or settles claims on residents of
this State in connection with any type of health benefit,
See. 6. 24-A MRSA §4347, sub-§18-A, as enacted by PL 2025, c, 487, §2, is
amended to read;
18-A. Plan sponsor. "Plan sponsor" has the same meaning as in section 1901,
subsection 8, except that "plan sponsor" does not include an-employer a person that offers
8 or provides a health plftH benefit that is fully insured by an insurer authorized to de transact
insurance business in this State,
Sec. 7. 24-A M:RSA §4349-B, sub-§2, as enacted by PL 2025, c. 487, §3 and
reallocated by RR 2025,c. 1, Pt. A, §34, is amended to read:
COMMITTEE AMENDMENT
ROS
COMMITTEE AMENDMENT " /^ " to S,P, 135, L.D. 378 i cry
2. Claims data; right to audit. Notwithstanding section 4350-C, a pharmacy benefits
manager that contracts with a plan sponsor to provide prescription drug coverage shall
permit a plan sponsor to perform a post-payment audit of claims paid to ensure compliance
with the contract at least once in a calendar year as long as the request is not earlier than 6
months following a previously requested audit. Upon request of a plan sponsor as part of
an audit, a pharmacy benefits manager shall disclose within 30 business days to a plan
sponsor who has certified its compliance with the use and disclosure requirements of 45
Code of Federal Regulations, Section 164,504(f), or, to the extent permitted by law and if
requested by the plan sponsor, to the plan sponsor's plan's designated business associate the
following information specific to the plan sponsor sponsor's plans:
A. Rebate amounts, identified by the drug and therapeutic oategoiy, secured on
prescription drugs provided by a pharmaceutical manufacturer that are generated by
claims processed through the plan maintained by the plan sponsor and administered by
the pharmacy benefits manager;
B. Prescription drug and device claims received by the pharmacy benefits manager via
electronic claims transactions on any current standardized claim form approved by the
Federal Government for these services. The form or transaction may be modified only
as necessary to comply with the federal Health Insurance Portability and
Accountability Act of 1996, Public Law 104-191, and the federal Health Information
Technology for Economic and Clinical Health Act of 2009, Title XIII, Subtitle D,
Public Law 111-5, and any regulations promulgated under those laws;
C. Prescription drug and device claims payments, electronic funds transfers or
remittance advice notices provided by the pharmacy benefits manager as electronic
files, The files may be modified only as necessary to comply with the federal Health
Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the
federal Health Information Technology for Economic and Clinical Health Act of 2009,
Title XIII, Subtitle D, Public Law 111-5, and any regulations promulgated under those
laws; and
D. Any other revenue and fees derived by the pharmacy benefits manager from the
contract, including all direct or indirect remuneration from pharmaceutical
manufacturers regardless of whether the remuneration is classified as a rebate, fee or
other classification.
Sec. 8. 24-A MRSA §4349-B, sub-§4, as enacted by PL 2025, c. 487, §3 and
reallocated by RR 2025, c.1, Pt. A,§34, is amended to read;
4. Nondisclosure and data use agreement. A pharmacy benefits manager may
require that the plan sponsor and the plan sponsor's designated business associate execute
a nondisclosure and data use agreement that protects the confidentiality of the pharmacy
benefits manager's trade secrets, pt-oprietary information or information otherwise
confidential bv law, rule or regulation before data is provided in accordance with this
section and that reasonably restricts the auditor's use of such data provided by the pharmacy
benefits manager to the sole purpose of conducting an audit on behalf of a plan sponsor.
The coverage limits of any cybersecurity insurance or liability insurance policy required
under tlie nondisclosure and data use agreement may not exceed the pharmacy benefits
manager's limit of liability under the services agreement between the plan sponsor and the
pharmacy benefits manager, if such limit applies. Except for the coverage limits of any
Page4-132LR0726(02)
COMMITTEE AMENDMENT
ROS
COMMITTEE AMENDMENT " ^ " to S.P. 135, L.D, 378
cybersecurity insurance or liability insurance policy, tllis subsection is not intended to limit
the inclusion in a nondisclosure and data use agreement of reasonable requirements
regarding notice, indemnification or liability for tlie unauthorized disclosure or security
breach of data in the possession of the plan sponsor or its designated business associate
pursuant to this section. In addition, a pharmacy benefits manager is not required to provide
data to an auditor selected by a plan sponsor if the auditor lias previously breached a
nondisclosure and data use agreement with that pharmacy benefits manager or refuses to
execute a nondisclosure and data use agreement,
Sec. 9. 24-A MRSA §4349-B, sub"§4-A is enacted to read;
4-A. Liability for disclosure of nrotected informatioi»L A olan sponsor or a plan
sponsor's designated business associate who receives information from a pharmacy benefits
manager pursuant to this section shall notify the pharmacy benefits manager of any
unauthorized disclosure or security breach of the followina information in the possession
of the plan sponsor or its designated business associate immediately upon d iscoverv of the
unauthorized disclosure or security breach of:
A. Personal information as defined in Title 10, section 1347. subsection 6;
B. Protected health infomiation in violation of any applicable rea uh'ements of the
federal Health Insurance Portability and Accountability Act of 1996. Public Law
i04-19_L_and any regulations promuleated under that law;
C. Electronic protected health information as defined in the federal Health Information
Technoloev for Economic and Clinical Health Act of 2009. Title XIII. Subtitle D.
Public Law 11 1-5. and any reaulations promulgated under that law; or
D. Nonpublic information as defined in section 2263. subsection 10.
Sec. 10. Effective date. This Act takes effect July 1,2026.
Emergency clause. In view of the emergency cited in the preamble, this legislation
takes effect when approved,'
Amend the bill by relettering or renumbering any nonconsecutive Part letter or section
number to read consecutively.
SUMMARY
This amendment replaces the bill, which is a concept draft, changes the title and adds
an emergency preamble and an emergency clause. It clarifies current law to ensure that
health insurers administering liealtli plans on behalf of plan sponsors are considered
administrators and must comply with a plan sponsor's statutory right to audit claims and
data requests related to those audits. The amendment also clarifies the responsibilities of
plan sponsors related to the security of data shared by an administrator for the purposes of
an audit, The requirements take effect July 1,2026.
COMMITTEE AMENDMENT