Health DATA Act of 2026

This Act may be cited as the Health Data Access, Transparency, and Affordability Act of 2026 or Health DATA Act of 2026.
Section 408(b)(2) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1108(b)(2)) is amended by inserting after subparagraph (C) the following:
No contract or arrangement for services, and no extension or renewal of such a contract or arrangement, between a group health plan (as defined in section 733(a)) and any other entity, including a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, or entity providing pharmacy benefit management services, is reasonable within the meaning of this paragraph unless such contract or arrangement—
allows the group health plan to audit all de-identified claims and encounter information or data described in section 724(a)(1)(B), provided that such information or data has been deidentified in accordance with section 164.514 of title 45, Code of Federal Regulations (or successor regulations), to—
ensure that such entity complies with the terms of the plan, the terms of the contract or arrangement for services, and the requirements of this title; and
determine the reasonableness of compensation received by such entity; and
does not—
unreasonably limit the number of audits permitted during a given period of time;
limit the number of de-identified claims and encounter information or data that the group health plan may access during an audit;
limit the disclosure of pricing terms for value-based payment arrangements or capitated payment arrangements, including—
payment calculations and formulas;
quality measures;
contract terms;
payment amounts;
measurement periods for all incentives; and
other payment methodologies used by an entity, including a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, or entity providing pharmacy benefit management services;
limit the disclosure of overpayments and overpayment recovery terms;
limit the right of the group health plan to select an auditor;
otherwise limit or unduly delay by greater than 60 calendar days after the date of request the group health plan from auditing any such de-identified claims and encounter information or data; or
permit the entity to charge a fee beyond the reasonable direct costs to provide the required information and otherwise comply and assist with an audit request.
Section 408(b)(2) of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1108(b)(2)), as amended by paragraph (1), is further amended by adding at the end the following:
An entity shall—
provide data or information under subparagraph (D) in a manner consistent with—
the privacy regulations promulgated under section 13402(a) of the Health Information Technology for Clinical Health Act (42 U.S.C. 17932(a)); and
the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 in part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or successor regulations); and
to the extent such data or information constitutes protected health information, restrict the use and disclosure of such information for purposes of such privacy regulations.
A group health plan shall comply with section 164.504(f) of title 45, Code of Federal Regulations (or a successor regulation), and a plan sponsor shall act in accordance with the terms of the agreement described in such section.
Subsection (c) of section 502 of such Act (29 U.S.C. 1132) is amended by adding at the end the following:
In the case of an agreement between a group health plan and a health care provider (including a health care facility), network or association of providers, service provider offering access to a network of providers, third-party administrator, entity providing pharmacy benefit management services, or other service provider that violates the provisions of section 724, the Secretary may assess a civil penalty against such provider, network or association of providers, service provider offering access to a network of providers, third-party administrator, entity providing pharmacy benefit management services, or other service provider in the amount of $10,000 for each day during which such violation continues. Such penalty shall be in addition to other penalties as may be prescribed by law.
Paragraph (6) of section 502(a) of such Act, is amended to read as follows:
by the Secretary to collect any civil penalty that the Secretary has imposed or assessed pursuant to this title;
Section 506 of such Act (29 U.S.C. 1136) is amended by adding at the end the following:
Notwithstanding subsection (a) of this section, the Secretary shall collect the attestations required to be submitted under section 724(a)(3). The Secretary shall ensure that any service provider submitting such an attestation on behalf of a group health plan does not have any conflicts of interest with regard to such attestation.
Section 506(a) of such Act (29 U.S.C. 1136(a)) is amended by striking In order and inserting Subject to subsection (d), in order.
Section 3(21)(A)(iii) of the Employee Retirement Income Security Act (29 U.S.C. 1002(21)(A)(iii)) is amended by striking such plan. and inserting the following: such plan, including any authority over the use, management, disposition, or safeguarding of data generated, used, or maintained by the plan or a service provider to the plan in connection with the administration of benefits or management of plan assets..
Part 5 of subtitle B of title I of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1131 et seq.) is amended by adding at the end the following:
It shall be unlawful for a person specified in subsection (c) to discharge, fine, suspend, expel, discipline, or discriminate against, including by failing to meet the requirements of subsection (a) or (b) of section 702 (related to discrimination in eligibility and premiums for participation in group health plans), a participant or beneficiary on the basis of information or data described in section 724.
The provisions of section 502 shall be applicable in the enforcement of this section, except that in any action brought under subsection (a)(1)(B) of such section in relation to data or information described in section 724, a participant or beneficiary may not be required to exhaust administrative remedies prior to bringing such action.
In applying section 502 for the purposes of this section, the term equitable relief shall include any relief necessary to restore a participant or beneficiary to the position they would have occupied but for a violation of subsection (a).
In the case of a violation of subsection (a) by a person, the Secretary may assess a civil monetary penalty against such person.
The amount of the civil monetary penalty imposed by subparagraph (A) shall be $100 for each day in the noncompliance period with respect to each participant or beneficiary to whom such violation of subsection (a) relates.
For the purposes of this subparagraph, the term noncompliance period means, with respect to any violation of subsection (a), the period—
beginning on the date such violation occurs; and
ending on the date such violation is corrected.
A person specified in this subsection is any of the following:
An employer.
A plan sponsor.
A plan administrator.
A plan fiduciary.
Nothing in this Act, or the amendments made by this Act, shall be construed to limit the application of any Federal or State privacy or civil rights law, including the HIPAA privacy regulations, the Genetic Information Nondiscrimination Act of 2008 (Public Law 110–233) (including the amendments made by such Act), the Americans with Disabilities Act of 1990 (42 U.S.C. 12101 et seq.), section 504 of the Rehabilitation Act of 1973 (29 U.S.C. 794), section 1557 of the Patient Protection and Affordable Care Act (42 U.S.C. 18116), title VI of the Civil Rights Act of 1964 (42 U.S.C. 2000d), and title VII of the Civil Rights Act of 1964 (42 U.S.C. 2000e).
The table of contents in section 1 of the Employee Retirement Income Security Act of 1974 (29 U.S.C. 1001 et seq.) is amended by inserting after the item relating to section 523 the following: