H.R. 9228: Health Data Access, Transparency, and Affordability Act of 2026

This bill would change federal rules for employer-sponsored health plans so that plan fiduciaries, sponsors, and administrators can get more detailed claims and payment information from companies that help run the plan.

What it would require plans and service providers to do

Under the bill, contracts between a group health plan and service providers would have to allow the plan’s responsible fiduciary, or an authorized agent, to access:

• Claims and encounter data
• Supporting documents such as medical records and policy documents related to claim payments
• Pricing terms for alternative payment or capitated arrangements
• Information about overpayments and how they are recovered
• Fees tied to plan administration and claims processing
• Information needed to investigate possibly erroneous or fraudulent claims
• De-identified or aggregated information that could be publicly disclosed
• Extra-contractual terms used to calculate provider reimbursement

The bill says this information generally must be made available quickly, and in some cases no later than 15 days, or sooner if the Secretary of Labor sets a shorter time. It also says plans should be able to receive claims data on a daily basis, and non-claim cost data must be itemized and made available in real time through a web portal, API, and downloadable CSV file.

Data format and privacy rules

The bill sets standards for how the information must be shared. Claims data would need to follow existing HIPAA-related electronic formats, such as standard medical and pharmacy claim file formats. Copies provided to the plan would have to be unmodified versions of the files sent by providers or service vendors, and the files would have to be available at no cost to the plan.

The bill also says the transfer and use of this information must be consistent with HIPAA privacy and security rules. It states that nothing in the bill should be read to reduce HIPAA protections, but it also says these privacy rules cannot be used to block the disclosure requirements the bill creates.

Limits on contract restrictions

The bill would make certain contract terms void if they delay or limit access to the required claims and encounter information. In other words, agreements that block or slow down access to the data the bill requires would not be enforceable as public policy.

Annual attestation requirement

The bill would revise an existing requirement for group health plans and group health insurance issuers to file an annual attestation with the Department of Labor saying they are not subject to prohibited “gag clauses” that restrict access to pricing and claims information. The updated attestation would also need to confirm that the required information is available on request and that the contract does not improperly restrict auditing or access.

The bill would prohibit plans or issuers from hiring a third-party administrator or other service provider to file the attestation for them. If a plan or issuer cannot get the needed information, it could file a written explanation instead, including why it could not obtain the data and what efforts it made to remove gag clause restrictions.

Enforcement

If a contract violates the new access rules, the Secretary of Labor could assess a civil penalty of up to $10,000 per day for each continuing violation. The bill also says certain indemnification arrangements would not be allowed to shield responsible parties from these penalties, and any contract terms trying to do so would be void.

When it would take effect

The changes would apply starting with the first plan year that begins at least one year after the bill becomes law.

Relevant Companies

• UNH — UnitedHealth Group, including its health benefits and services businesses, could be affected because the bill targets claims data access and service arrangements used by group health plans.
• HUM — Humana could be affected as a health insurer and administrator of group coverage that may need to adjust data-sharing and contract practices.
• CVS — CVS Health, through its pharmacy benefit management and health services operations, could be affected by requirements involving claims, pricing, and administrative fee disclosures.
• CI — Cigna Group could be affected through its insurance and health-services businesses, including any role in managing or processing plan data.
• ELV — Elevance Health could be affected through its health plan administration and claims-processing activities.
• CI — Cigna Group could be affected through its insurance and health-services businesses, including any role in managing or processing plan data.
• CAH — Cardinal Health could be affected indirectly if its services or data-related arrangements touch group health plan administration.