§1914. Plan sponsor access to claims data; right to audit
1.
High-cost claims data.
Upon request of a plan sponsor that has certified its compliance with the use and disclosure requirements of 45 Code of Federal Regulations, Section 164.504(f), an administrator shall provide data on a high-cost claim so that a plan sponsor may perform an audit to ensure compliance with the plan sponsor's contract prior to payment of the high-cost claim. The data must include any itemized billing statements and medical records associated with the claim in the possession of the administrator or the administrator's agents. The plan sponsor or the plan sponsor's designee shall make a request for data on a high-cost claim within 2 business days of receipt of the claim and the administrator must provide the requested information within 30 business days of the request. For the purposes of this subsection, "high-cost claim" means any claim related to an individual provided health coverage by a plan sponsor that exceeds $100,000.
[PL 2025, c. 487, §1 (NEW).]
2.
Claims data; right to audit.
An administrator that contracts with a plan sponsor to provide health coverage shall permit a plan sponsor to perform a post-payment audit of all claims paid to ensure compliance with the contract at least once in a calendar year as long as the request is not earlier than 6 months following a previously requested audit. Upon request of a plan sponsor as part of an audit, an administrator shall disclose within 30 business days to a plan sponsor that has certified its compliance with the use and disclosure requirements of 45 Code of Federal Regulations, Section 164.504(f) or, to the extent permitted by law and if requested by the plan sponsor, to the plan's designated business associate the following information specific to the plan sponsor's plans:
A.
Claims data received by the administrator via electronic claims transactions on any current standardized claim form approved by the Federal Government for professional services or institutional services. The form or transaction may be modified only as necessary to comply with the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191;
[PL 2025, c. 487, §1 (NEW).]
B.
Claims payments, electronic funds transfers or remittance advice notices provided by the administrator as electronic files compliant with the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, including, but not limited to, electronic claims transactions for both the billed amount and the paid amount for professional services and both the billed amount and the paid amount for institutional services. The files may be modified only as necessary to comply with the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104‑191, and the federal Health Information Technology for Economic and Clinical Health Act of 2009, Title XIII, Subtitle D, Public Law 111-5, and any regulations promulgated under those laws;
[PL 2025, c. 487, §1 (NEW).]
C.
Any fees charged to the plan sponsor related to plan administration and claims processing, including renegotiation fees, access fees, repricing fees or enhanced review fees; and
[PL 2025, c. 487, §1 (NEW).]
D.
Any out-of-network fees or out-of-network negotiated discounts, aligned incentive program fees, pay-for-performance payments and recoveries, cost-containment program fees, overpayment recovery program fees, subrogation fees and any other special program fees and discounts.
[PL 2025, c. 487, §1 (NEW).]
[PL 2025, c. 652, §1 (AMD); PL 2025, c. 652, §10 (AFF).]
3.
No conditions or fees on audit.
An administrator may not impose on a plan sponsor:
A.
Any fees relating to an audit request under this section that exceed the direct expenses properly and actually incurred by the administrator to provide the data; or
[PL 2025, c. 487, §1 (NEW).]
B.
Any conditions that would restrict a plan sponsor's right to conduct an audit under this section, including, but not limited to, restrictions on:
[PL 2025, c. 487, §1 (NEW).]
(1)
The time period covered by the audit, except that a request pursuant to this section must be made within 24 months of the end of each plan year to be audited;
(2)
The number of claims analyzed;
(3)
The type of analysis conducted;
(4)
The data elements used in the analysis;
(5)
The means by which an auditor is compensated by a plan sponsor; or
(6)
The plan sponsor's choice of auditor as long as the plan sponsor certifies that the auditor has adequate conflict of interest protection provisions to prevent conflicts of interest from adversely affecting the outcome of the audit.
[PL 2025, c. 487, §1 (NEW).]
4.
Nondisclosure and data use agreement.
An administrator may require that the plan sponsor and the plan sponsor's designated business associate execute a nondisclosure and data use agreement that protects the confidentiality of the administrator's trade secrets, proprietary information or information otherwise confidential by law, rule or regulation before data is provided in accordance with this section and that reasonably restricts the auditor's use of such data provided by the administrator to the sole purpose of conducting an audit on behalf of a plan sponsor. The coverage limits of any cybersecurity insurance or liability insurance policy required under the nondisclosure and data use agreement may not exceed the administrator's limit of liability under the services agreement between the plan sponsor and the administrator, if such limit applies. Except for the coverage limits of any cybersecurity insurance or liability insurance policy, this subsection is not intended to limit the inclusion in a nondisclosure and data use agreement of reasonable requirements regarding notice, indemnification or liability for the unauthorized disclosure or security breach of data in the possession of the plan sponsor or its designated business associate pursuant to this section. In addition, an administrator is not required to provide data to an auditor selected by a plan sponsor if the auditor has previously breached a nondisclosure and data use agreement with that administrator or refuses to execute a nondisclosure and data use agreement.
[PL 2025, c. 652, §2 (AMD); PL 2025, c. 652, §10 (AFF).]
4-A.
Liability for disclosure of protected information.
A plan sponsor or a plan sponsor's designated business associate who receives information from an administrator pursuant to this section shall notify the administrator of any unauthorized disclosure or security breach of the following information in the possession of the plan sponsor or its designated business associate immediately upon discovery of the unauthorized disclosure or security breach of:
A.
Personal information as defined in Title 10, section 1347, subsection 6;
[PL 2025, c. 652, §3 (NEW); PL 2025, c. 652, §10 (AFF).]
B.
Protected health information in violation of any applicable requirements of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104‑191, and any regulations promulgated under that law;
[PL 2025, c. 652, §3 (NEW); PL 2025, c. 652, §10 (AFF).]
C.
Electronic protected health information as defined in the federal Health Information Technology for Economic and Clinical Health Act of 2009, Title XIII, Subtitle D, Public Law 111-5, and any regulations promulgated under that law; or
[PL 2025, c. 652, §3 (NEW); PL 2025, c. 652, §10 (AFF).]
D.
Nonpublic information as defined in section 2263, subsection 10.
[PL 2025, c. 652, §3 (NEW); PL 2025, c. 652, §10 (AFF).]
[PL 2025, c. 652, §3 (NEW); PL 2025, c. 652, §10 (AFF).]
5.
Compliance with federal law.
Information provided by an administrator to a plan sponsor in accordance with this section must comply with any applicable requirements of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104‑191, and the federal Health Information Technology for Economic and Clinical Health Act of 2009, Title XIII, Subtitle D, Public Law 111-5, and any regulations promulgated under those laws.
[PL 2025, c. 487, §1 (NEW).]
5-A.
Certain persons acting as administrators included.
Notwithstanding section 1901, subsection 1, paragraphs D and E, for the purposes of this section, an administrator subject to the requirements of this section includes any person who, on behalf of a plan sponsor, receives or collects charges, contributions or premiums for or adjusts or settles claims on residents of this State in connection with any type of health benefit.
[PL 2025, c. 652, §4 (NEW); PL 2025, c. 652, §10 (AFF).]
6.
Application.
An administrator may not enter into, issue, amend or renew any contract or network services agreement with a plan sponsor on or after January 1, 2026 that contains any provision that violates this section.
[PL 2025, c. 487, §1 (NEW).]
7.
Exclusive enforcement; violation.
Notwithstanding section 12‑A, a violation of this section is subject to exclusive enforcement under the Maine Unfair Trade Practices Act, including any of the remedies provided for in the Act. A violation is committed each time a prohibited act under this section occurs. Investigations of violations by administrators may include a 3rd party that may possess evidence supporting such investigation.
[PL 2025, c. 487, §1 (NEW).]
SECTION HISTORY
PL 2025, c. 487, §1 (NEW). PL 2025, c. 652, §§1-4 (AMD). PL 2025, c. 652, §10 (AFF).