What steps do plan sponsors need to take to comply with the "RxDC" rules, and how do these fit into the larger picture of healthcare transparency laws?
Prescription Drug and Health Care Spending Reporting is the product of one of several healthcare transparency-related provisions contained in the Consolidated Appropriations Act, 2021 (CAA).1 Section 204 of the CAA requires group health plans or health issuers (insurers) to submit general information regarding the plan or coverage, as well as detailed information surrounding prescription spending, total health care spending, and the impact of any prescription drug rebates, fees, or other compensation affecting premiums and out-of-pocket costs.
In 2021, the Department of Labor, Health and Human Services, and the Treasury Department (Agencies) released an interim final rule, "Prescription Drug and Health Care Spending," implementing these provisions.2 The Centers for Medicare and Medicaid Services (CMS) has subsequently released supporting documents for the regulations, including an overview of who must submit and when, data submission instructions, and examples of specific categories of reporting. Insurers and thirdparty administrators (TPAs) are expected to provide much of the reporting, but group health plans are ultimately responsible for ensuring that the necessary information is submitted. As a result of these rules, group health plan sponsors must report or ensure that certain information related to health plan spending, via an "RxDC" report, is submitted to CMS by June 1 each year for the prior year's data.
While the Agencies expressly allow and expect that third parties such as TPAs, Pharmacy Benefit Managers (PBMs) and health insurers to provide much of the information, the CAA ultimately places the responsibility for compliance on group health plans. There is no exception to the reporting requirement for small groups, grandfathered, or fully insured group health plans. The interim final rule addresses the concept of a "reporting entity" by providing an expansive definition that includes essentially any entity submitting the necessary information on behalf of a plan. Plan sponsors should discuss with insurers and/or TPAs – as well as any other vendors whose services are brought in under the rules – to determine who will prepare and submit the necessary reporting for each plan. Agreements should be documented in writing.
Several categories of information must be submitted, including the following:
This data must be submitted via the CMS Health Insurance Oversight System (HIOS). CMS provides updated reporting instructions and help desk contact information every year.
For group health plan sponsors, a key compliance step is coordinating with vendors to determine how they will assist plan sponsors in meeting their reporting obligations, as most group health plans will lack the necessary information on their own. This consideration should also extend to changing or onboarding new vendors, ensuring that reporting responsibilities are clearly defined well in advance. As noted in the previous section, the Departments have provided an internet portal where RxDC reports must be submitted. The HIOS portal can be accessed from the CMS webpage, which also provides a user manual, frequently asked questions, and other resources.
Beyond that, the actions plan sponsors will need to take will vary based on their group health plan's structure, the level of insurer or TPA involvement, and other factors, making a one-size-fits-all checklist impractical. That said, there are some relatively simple steps that plan sponsors can take to prepare.
Fully insured plans – Plan sponsors will need to confirm who will submit the required data via the CMS HIOS portal. Fully insured plan sponsors will generally be able to rely on insurers for this step but should verify whether the insurer will be submitting all or a portion of the data on the sponsor's behalf. Even where insurers will submit information on a plan's behalf, they will generally need additional information from plan sponsors such as employer versus member premiums. To that end, plan sponsors should be alert to insurer communications requesting any additional information, noting any deadlines imposed by the insurer.
Fully insured groups can shift liability to the insurer. The regulations state, "if a health insurance issuer and a group health plan sponsor enter into a written agreement under which the issuer agrees to provide the information required … and the issuer fails to do so, then the issuer, but not the plan, violates the reporting requirements…." What is sufficient to constitute that written agreement has not been explained. A generic email announcement stating what the carrier is willing to do probably would not, under a conservative reading of the rules, constitute a "written agreement" that would shield the plan sponsors from liability should the insurer fail to report the requisite information. Certainly, a signed agreement between the plan sponsor and insurer is preferred and encouraged as a best practice; although, practically speaking, a mass communication may be the only assurance plan sponsors are able to obtain from their insurers. Clarification from the Agencies on this point would be welcome.
Self-funded plans – While self-funded plan sponsors can also enter into agreements with vendors to complete these requirements, ultimately, they cannot shift liability for compliance.
Because the necessary reporting information may reside with multiple sources, plan sponsors will need to determine which sources possess the required information. For example, while plan sponsors will typically have information on the average monthly premium paid by the plan and enrollees, the TPA is more likely to have the data related to prescription drug and health care expenditures and the impact of rebates. While the insurer will often handle all prescription benefits for a fully insured plan sponsor, self-funded plan sponsors – particularly those with carved-out prescription benefits – may have to coordinate the reporting process with not only the TPA but also their PBMs or even other vendors. Determining where the information is might be as simple as an email exchange with the relevant vendors, but this is an important step in the data collection process.
Plan sponsors will also have to decide who will perform the reporting. Keep in mind that is it possible for a plan to meet all of its Section 204 reporting obligation by having multiple entities submit files on its behalf. At least for the initial rounds of reporting, many vendors gave clients the option to request their individual plan data to submit the reporting themselves, or to allow the vendor to perform at least a portion of the reporting on their behalf. And naturally, many plan sponsors want to allow vendors to assist in this way. Vendors will have specific deadlines that must be met by plan sponsors and should be carefully noted. Some vendors have historically charged fees in connection with preparing this information, with the level of fee dependent on complexity. One consideration when deciding who should report should be that, while the Agencies have encouraged aggregate submissions, multiple entities should not submit the same data for a plan, i.e., avoid "double reporting." So, in essence, plan sponsors should keep track of who is reporting what.
Plan sponsors should obtain contractual commitments, if possible, from any vendor providing such reporting on the plan's behalf. As stated previously, vendors may be unwilling to enter into a contractual agreement wherein they agree to bear liability for noncompliance.
Because data is filed for a prior year (referred to as a "reference period" or "reference year" in the instructions), plan sponsors who changed insurers, TPAs, or PBMs should always confirm with the prior service provider – ideally before the transition – what assistance they will provide with the required reporting. This may include filing on behalf of the former client or by supplying the necessary information to the former client to complete the reporting themselves.
While the regulations are silent on the subject of penalties for noncompliance, it is possible that the IRS could impose an excise tax of up to $100 per day per affected individual. The Department of Labor can also enforce compliance for ERISA plans, while the Department of Health and Human Services can enforce compliance on non-ERISA plans. As with most things in employee benefits compliance, plan sponsors cannot simply write a check to get out of complying with the rules.
While the CAA's prescription drug and health care reporting ("RxDC") requirements ultimately place responsibility on group health plans, employer plan sponsors will need to lean heavily on vendors in order to provide the necessary information to regulators. Because the data may be submitted by a variety of entities and the Agencies have expressed an expectation that many insurers, TPAs, and PBMs will submit for the plans, sponsors should contact and negotiate with partners to provide the necessary information. Group health plan sponsors should familiarize themselves with the law and existing guidance and work with vendors to ensure proper coordination of efforts.
