Prescription Drug Data Reporting: What the “Good Faith Compliance” Extension Really Means for Self-Funded Group Health Plans

In the FAQ, the Departments pledged to not take enforcement action against any plan or issuer that makes a good faith effort to comply and establishes a submission grace period through January 31, 2023. The FAQ also provides a series of “clarifications” to the RxDC rules that relaxes the rules on multiple submissions, permits duplicative submissions by multiple reporting entities, loosens the standards governing data aggregation, allows for the submission of certain data by email and makes certain otherwise required reporting elements optional. A summary of their impact on self-funded group health plans is as follows:

• Multiple Submissions by the Same Reporting Entity Allowed. The interim final rule implementing the RxDC rules generally require a reporting entity that submits RxDC reporting data on behalf of more than one plan or issuer to combine the data of all clients within a single set of plan lists and data files. (Section 5.3 Instructions are in accord; Section 5.4 provides useful examples.) Compliance with this requirement has proven particularly troublesome for entities that have gone through one or more acquisitions and found they had missing information due to former plan vendors and/or plans who were unwilling or unable to provide the information necessary to complete the required reporting. In a subsequent Centers for Medicare & Medicaid Services (CMS) FAQ, the regulators permitted multiple data files of the same type from the same group health plan (e.g., two or more D2 files reporting the plan’s total annual healthcare spending), if there are “extenuating circumstances” preventing vendors from working together. The FAQ removes the qualifier. By way of example, a group health plan that covers employees of multiple corporations, trades or businesses under common control is, under the clarification, permitted to report by controlled-group entity instead of including data for all entities in a single set of plan lists and data files. More relief from the Departments specific to corporate transactions and/or merged plans would be welcome.
• Submissions by Multiple Reporting Entities Allowed. According to the Instructions (Section 3.3): “Multiple reporting entities should not submit the same data file for a plan, issuer, or carrier. For example, a TPA and PBM should not both submit D2 for the same group health plan.”

Under the FAQ’s clarification, more than one reporting entity may submit the same data file type on behalf of the same plan or issuer, instead of working together to consolidate all data into a single data file for each type of data. The D2, for example, includes information on medical spending by category. Categories for this purpose include hospital, primary care, specialty care, other medical costs and services and known and estimated medical benefit drugs. It is not uncommon for self-funded group health plans to have multiple service providers. The relief in this instance will allow information for the same file (here, D2) to come from multiple sources.

• Aggregation Restriction Suspended. The interim final rules require that if multiple reporting entities submit the required data on behalf of one or more plans or issuers in a state and market segment, the data submitted by each of these reporting entities must be aggregated to at least the aggregation level used by the reporting entity that submits data on the total annual spending on healthcare services on behalf of those plans or issuers. Total annual spending is reported in the D2 file. The FAQ relieves the entity submitting D3 through D8 files from having to ensure that the data in the D2 file for the 2020 and 2021 reference years is aggregated at the same level of detail. Thus, for example, a group health plan may submit data for the D2 file at the plan level, while the plan’s third-party administrator (TPA) may submit the remaining files using data that is aggregated across its entire self-funded book of business.
• Submission of Premium and Life-Years Data by Email. RxDC reports are submitted using the CMS Health Insurance Oversight System (HIOS), which requires users to go through the CMS Enterprise Portal (Instructions Section 3.1). Doing so requires users to register for a CMS Identity Management system account. Most carriers and TPAs already have HIOS accounts; most group health plans do not. The registration process is complicated, takes time and in most cases requires—or at least benefits from—competent (and patient) IT assistance. The need to establish the account has proven particularly nettlesome for a subset of self-funded plans with unique or overlapping funding and benefit structures and for multiple employer arrangements, among others. Submitting the information required by the P2 list and the D1 file is particularly challenging. The FAQs permit a group health plan or its reporting entity to submit only the plan list (P2 in the case of a group health plan), premium and life-years data and narrative response by email. The relief is directed at the D1 file, which includes premium and life-year data. In addition, the narrative response of a self-funded plan that estimates certain plan parameters (g., take-up rates) must explain their methodology if the plan deviates from the method prescribed. While the relief under this clarification is narrow, it will be particularly useful in the instances to which it applies.
• Reporting on Vaccines Optional. Under the FAQ, reporting entities of all stripes may, but are not required to, include certain vaccines in their data files. The relief applies to plans and issuers alike.
• Reporting Amounts Not Applied to the Deductible or Out-of-Pocket Maximum Optional. The FAQ exempts all reporting entities form having to report a value for “amounts not applied to the deductible or out-of-pocket maximum” and the “Rx amounts not applied to the deductible or out-of-pocket maximum.” Reporting entities are admonished not “to remove these columns from data files D2” but instead should “leave blank the data fields in these columns.” Like the previous bullet point, the relief applies across the board.

In recognition of the extensive reporting obligations and the compliance difficulties facing plan sponsors with multiple health plan vendors, the FAQ provides only limited enforcement relief. Plan sponsors that have submitted RxDC reports may consider whether they should adjust their reports considering the FAQ, and plan sponsors that have not submitted RxDC reports now have additional time to complete their submission. All plan sponsors should work with their health plan vendors to compile complete information by the updated enforcement deadlines of January 31, 2023, for the 2020 and 2021 reference years and June 1, 2023, for the 2022 reference year.

The statute imposes RxDC reporting obligations on the group health plan itself. Insured plans may satisfy the requirements by entering into a written agreement with a carrier to report the required information. If the carrier fails to report, the carrier (not the plan) violates the reporting requirements. A different rule applies to self-funded plans. While self-funded plans will inevitably contract with third parties to assist with their RxDC reporting obligations, if the third party fails to report the required information, the plan is responsible for the failure. Self-funded plans have encountered difficulties when current plan vendors have refused to assist with RxDC reporting for merged plans or plans of acquired entities, requiring the employees of the sponsor of the self-funded plan to make best efforts to complete the required reporting. The stakes for self-funded plans are, as a result, high, and any relief the Departments may choose to provide is welcome.

Employers and plan sponsors with questions about RxDC should contact their regular McDermott employee benefits lawyer or one of the authors listed below.