Health DATA Act of 2026
- Sponsor
- Rep. Takano, Mark [D-CA-39]
- Committees
- Education and Workforce Committee (primary)
- Last action
- Jun 25, 2026
Bottom line
The Health DATA Act of 2026 aims to empower group health plans with greater oversight over their health data and service providers, while also protecting individuals from discrimination based on their health information.
What it actually does
This bill amends the Employee Retirement Income Security Act of 1974 (ERISA) to significantly increase transparency requirements for group health plans and their service providers. It grants group health plans explicit rights to audit de-identified claims and encounter data from entities like third-party administrators (TPAs) and pharmacy benefit managers (PBMs), prohibiting contract terms that limit such audits. Furthermore, it expands fiduciary duties to include data management and establishes new protections against discrimination based on health plan data, with civil penalties for violations.
Proponents argue
Proponents argue that this bill is crucial for reining in healthcare costs by giving employers and group health plans the necessary tools to scrutinize how their healthcare dollars are spent and ensure fair pricing. They contend that increased data transparency will foster competition, expose inefficiencies, and prevent hidden fees or conflicts of interest among service providers. Additionally, supporters emphasize the importance of protecting participants and beneficiaries from potential discrimination arising from the misuse of their health data.
Opponents contend
Opponents, particularly within the healthcare service provider industry, may argue that the bill imposes excessive administrative burdens and compliance costs, which could ultimately be passed on to group health plans and beneficiaries through higher fees. They might also raise concerns about the disclosure of proprietary business information, the potential for data breaches even with de-identification, and the risk of increased litigation due to expanded fiduciary duties and direct rights of action for discrimination claims.
The bill is relatively concise and can be read and understood by an informed reader within a reasonable timeframe, making it accessible for evaluation.
Section 2(a) (amending ERISA Section 408(b)(2))
Group Health Plan Audit Rights and Contract Requirements
This provision mandates that contracts between group health plans and their service providers (like health care providers, networks, TPAs, or PBMs) must allow the plan to audit all de-identified claims and encounter data. The purpose of these audits is to ensure compliance with plan terms and ERISA requirements, and to determine the reasonableness of compensation received by the service provider. The provision explicitly prohibits contract clauses that unreasonably limit the number of audits, the amount of data accessible, the disclosure of pricing terms for value-based or capitated payments, overpayment recovery terms, the plan's choice of auditor, or unduly delay data access (beyond 60 days). It also limits fees for providing audit data to reasonable direct costs.
Supporters argue
Supporters argue that this provision is essential for group health plans, particularly employers, to act as true fiduciaries for their participants' healthcare dollars. By enabling comprehensive audits and preventing restrictive contract clauses, plans can identify waste, fraud, and abuse, negotiate better rates, and ultimately lower healthcare costs for their employees and themselves.
Critics contend
Critics, likely from the service provider industry, may contend that these audit rights are overly broad and could lead to the disclosure of sensitive proprietary business information, harming their competitive advantage. They might also argue that the administrative burden of providing extensive de-identified data and complying with frequent audits will increase their operational costs, which could then be passed back to plans and beneficiaries.
Tradeoffs
This provision balances the need for transparency and fiduciary oversight by group health plans against the proprietary interests and administrative capacities of healthcare service providers. It also navigates the tension between empowering plans to control costs and potentially increasing compliance costs for providers.
Section 2(a)(2) (amending ERISA Section 408(b)(2))
Privacy Requirements for Audit Data
This section adds specific privacy requirements for any data or information provided under the new audit rights. It mandates that all data sharing must be consistent with HIPAA and HITECH privacy regulations. Furthermore, if the data constitutes protected health information (even if de-identified), its use and disclosure must be restricted according to these privacy regulations, and group health plans must comply with specific rules regarding agreements with plan sponsors for such information.
Section 2(b) (amending ERISA Section 502(c))
Civil Enforcement for Gag Clause Violations
This amendment authorizes the Secretary of Labor to assess a civil penalty of $10,000 for each day a violation continues against any healthcare service provider (including health care facilities, networks, TPAs, or PBMs) that violates the provisions of Section 724 of ERISA. Section 724 generally relates to gag clauses and price transparency requirements in contracts.
Section 3 (amending ERISA Section 3(21)(A)(iii))
Expanded Fiduciary Duty for Plan Data
This amendment explicitly expands the definition of an ERISA fiduciary to include any authority over the use, management, disposition, or safeguarding of data generated, used, or maintained by a group health plan or its service providers in connection with benefits administration or asset management. This clarifies that fiduciaries have a legal responsibility to manage plan data prudently and solely in the interest of participants and beneficiaries.
Section 4 (adding new ERISA Section 524)
Preventing Discrimination Based on Plan Data
This new section makes it unlawful for employers, plan sponsors, administrators, or fiduciaries to discriminate against a participant or beneficiary based on information or data described in ERISA Section 724 (related to transparency and gag clauses). It allows participants or beneficiaries to bring civil actions without exhausting administrative remedies and grants courts the power to provide any equitable relief necessary to restore the individual to their original position. Additionally, the Secretary of Labor can assess a civil monetary penalty of $100 per day per affected individual for such discrimination.
Limits the fee a service provider can charge a group health plan for providing required audit information to 'reasonable direct costs'.
Section 2(a)(1)(D)(ii)(VII)
Why it matters:This is standard legislative practice for specifying cost limitations within broader regulatory requirements. It's a technical detail that defines the financial scope of the audit process.
Case for: Supporters would argue this prevents service providers from using excessive fees as a de facto barrier to transparency and audits, ensuring that plans can exercise their rights without undue financial burden.
Case against: Service providers might argue that 'reasonable direct costs' is open to interpretation and may not adequately cover all indirect costs associated with data extraction, formatting, and security, potentially leading to disputes and under-reimbursement.
Estimated impact: This provision will directly influence the financial feasibility and frequency of audits for group health plans, potentially saving them significant costs or leading to disputes over what constitutes 'reasonable direct costs'.
Prohibits contract terms that 'unduly delay by greater than 60 calendar days after the date of request' the group health plan from auditing de-identified claims and encounter information.
Section 2(a)(1)(D)(ii)(VI)
Why it matters:This is a common legislative technique to provide a concrete, measurable standard for compliance, rather than leaving 'unduly delay' open to subjective interpretation. It sets a clear operational expectation.
Case for: Proponents would highlight this as a critical measure to ensure timely access to data, preventing service providers from using delays as a tactic to hinder audits and obscure information. A clear deadline facilitates effective oversight.
Case against: Service providers might argue that a 60-day window may not always be feasible for complex data requests, especially if data is stored across multiple systems or requires extensive de-identification and formatting, potentially leading to inadvertent non-compliance.
Estimated impact: This provision establishes a clear operational timeline for data provision during audits, significantly impacting the speed and efficiency of transparency efforts for group health plans.
Includes a rule of construction clarifying that the Act does not limit the application of any existing Federal or State privacy or civil rights law, specifically listing HIPAA, GINA, ADA, Section 504 of the Rehabilitation Act, Section 1557 of the ACA, Title VI and Title VII of the Civil Rights Act of 1964.
Section 4(b)
Why it matters:This is standard legislative practice to ensure that new laws do not inadvertently supersede or weaken existing protections. It clarifies the relationship between this Act and a broad array of established civil rights and privacy laws.
Case for: Proponents would argue this is a crucial safeguard, ensuring that the new anti-discrimination provisions are additive and do not create loopholes or diminish existing rights. It provides legal certainty and reinforces a comprehensive framework of protections.
Case against: No direct case against this provision, as it aims to preserve existing rights. However, some might argue that the extensive list could lead to complex legal interpretations when multiple laws apply to a single discrimination claim.
Estimated impact: This provision ensures that the new anti-discrimination measures in the bill complement, rather than replace, a wide array of existing federal and state privacy and civil rights laws, thereby strengthening overall protections for individuals.