The No Surprises Act (NSA), enacted as part of the Consolidated Appropriations Act, 2021 (CAA), includes transparency provisions requiring group health plans, including grandfathered plans, and health insurance carriers to submit certain information about prescription drug and healthcare spending to the federal government (DOL, HHS, and Treasury). The agencies plan to use this information to issue public reports on prescription drug pricing costs and trends beginning in 2023.
While this will become an annual obligation, the initial reports (for the 2020 and 2021 calendar years) must be electronically submitted to the Centers for Medicare & Medicaid Services (CMS) by Dec. 27, 2022. Most self-insured health plans will need to rely heavily on their vendors such as their Third-Party Administrator (TPA) and/or Pharmacy Benefit Manager (PBM) to provide the data necessary, or to submit the plan’s data to CMS. Any organization submitting data to CMS is referred to as a “reporting entity.” There may be multiple reporting entities involved in compiling and submitting data for any particular employer plan.
Reporting Requirement
Fully-insured: Employers with fully- insured plans who contract with their carrier to complete the reporting will not be held liable for failure to
Self-insured: Employers with self-insured plans will be responsible for submitting all prescription drug information, but will need to rely on TPAs and PBMs for data generation and, perhaps, the reporting
Action Items
Fully-insured: Confirm with carriers that they will be complying by completing the reporting on behalf of fully-insured
Self-insured: Identify what your partner PBM/TPA is doing to facilitate fulfillment of this requirement. If a plan’s partner will not report any data or only partial data on behalf of the plan, plans will have to submit data to CMS electronically themselves
Reporting on Pharmacy Benefits and Drug Costs
So, what does it mean for health plans to report information on plan medical costs and prescription drug spending to the agencies? Specifically, plans must report the following:
General information on the plan or coverage, such as the beginning and end dates of the plan year, the number of participants, beneficiaries, or enrollees (as applicable), and each state in which the plan or coverage is offered;
The 50 brand prescription drugs most frequently dispensed by pharmacies for claims paid by the plan and the total number of paid claims for each drug;
The 50 most costly prescription drugs with respect to the plan by total annual spending and the annual amount spent by the plan for each drug;
The 50 prescription drugs with the greatest increase in plan expenditures over the prior plan year and, for each drug, the change in amounts expended by the plan in each plan year;
Total spending on health care services by the group health plan, broken down by the type of costs; the average monthly premium paid by employers (as applicable) and by enrollees; and any impact on premiums by rebates, fees, and any other remuneration paid by drug manufacturers to the plan; and
Any reduction in premiums and out-of-pocket costs associated with rebates, fees or other remuneration.
Additionally, plan-specific information is required as well:
Identifying information for plans and issuers and other reporting entities;
The beginning and end dates of the plan year;
The number of participants, beneficiaries, or enrollees, as applicable, covered on the last day of the year; and
Each state in which a plan or coverage is
Compliance Responsibility
Plans may satisfy these reporting obligations by having third parties—such as carriers, PBMs, and TPAs—submit some or all of the required information on their behalf.
Employers with fully-insured group health plans, where all prescription drug coverage is provided through the group health plan, can rely on their carrier to submit the necessary data to CMS. However, if a fully-insured employer covers some prescription drug costs through separate arrangements, such as a specialty drug carve-out or a separate mail-order drug benefit, other reporting may be necessary.
For employers who sponsor self-insured plans, CMS recognizes that employers will need to rely on their vendors to provide the required data to the employer for submission to CMS, or to submit the data on behalf of the employer’s plan. However, CMS also makes it very clear that it is the employer/plan sponsor’s responsibility to work with their vendors to ensure reporting is completed. CMS also recognizes that it is possible that no single entity will have all the information necessary, so some coordination will need to occur between stakeholders, such as the plan sponsor and their vendors.
Recap
If the issuer of a fully-insured group health plan is required by written agreement to report the required information but fails to do so, then the issuer—not the plan—violates the reporting requirements.
If a fully-insured or self-funded group health plan or an issuer offering group or individual health coverage requires another party (such as another issuer, a PBM, a TPA or other third party) to report the required information by written agreement but the third party fails to do so, then the plan or issuer violates the reporting requirements.
Reporting Process
There are 9 separate files, plus a narrative file, that employer-sponsored group health plans must electronically submit to CMS. One of the most difficult things about the reporting process is that for many employers, no single entity will have all of the required data. As mentioned above, if an employer uses a single vendor such as a fully-insured health insurance carrier to process all the plan’s prescription drug claims, that vendor is likely to have virtually all of the information needed to submit on behalf of the employer’s plan. Other employers, however, will find that the required data may be held by different entities. The following chart identifies which organization is most likely to have the data necessary to submit each file:
Report Deadlines
This is an annual reporting requirement; the Departments deferred enforcement of the initial reporting requirement to Dec. 27, 2022. This means that the required information for calendar years 2020 and 2021 must be submitted by December 27, 2022. After this year, the previous calendar year’s information will be due by June 1 of the following year (ex: 2022 information will be due June 1, 2023).
How Required Data is Reported
Data is submitted through the RxDC module in the Health Insurance Oversight System (HIOS). HIOS is an application within the CMS Enterprise Portal. Employers do not need to set up an account in HIOS if their vendors will be submitting all the required data on their behalf. However, depending on how the employer’s vendors approach the requirement, some employers may need to submit at least some of the files themselves and therefore set up an account.
For employers who need to submit their own data, instructions for creating a CMS Enterprise Portal and HIOS account can be found here. The instructions for using the RxDC module are in the RxDC HIOS User Manual here.
CMS has also set up a help desk to assist with this process which can be reached at 1-855-267-1515 or CMS_FEPS@cms.hhs.gov.
NOTE: We have created a resource that includes additional information regarding the HIOS submission process, including a step-by-step guide and associated tips for registering and accessing the portal. Please ask your Cottingham & Butler representative for a copy of this set-up guide if your plan must file some or all of the data.
Next Steps for Employer Plan Sponsors
Employers sponsoring self-insured plans will likely face one of the following four scenarios:
The TPA (and/or PBM) will submit all of their clients’ prescription drug cost data in the aggregate.
Action Items and Comments:
The government agencies do not require the prescription cost data to be submitted in a way that is identifiable at the plan level. Thus, an aggregate submission of multiple plans’ data by a TPA/PBM is permissible.
There will still be information required that cannot be reported in the aggregate and must be submitted by each individual plan. This includes plan information: plan name, plan year dates, number of participants covered and premium cost.
Bottom Line: Even if a plan’s partner reports in the aggregate, plans will likely have to set up an account in HIOS (through the CMS portal) and submit the plan-identifying information on their own.
The TPA/PBM will report all of the prescription drug cost data and plan information on behalf of each self-insured plan.
Action Items and Comments:
Many TPAs are charging a fee to provide this service.
Because the partner may not already possess plan or premium information, plans will need to provide that partner with such information to ensure a complete submission.
Bottom Line: If the plan verifies that all data files have been submitted in a timely manner, there will be no need to report anything on their own and they can consider their compliance obligations as being met.
The TPA/PBM reports some, but not all, of a plan’s required prescription drug cost data.
Action Items and Comments:
Some TPAs are charging a fee to provide this service.
Bottom Line: The plan will still need to set up an account in HIOS (through the CMS portal) and submit the plan-identifying information on their own.
The TPA/PBM does not submit prescription drug cost data on behalf of the plan and only provides the raw data to the plan.
Action Items and Comments:
Bottom Line: The plan will need to set up an account in HIOS (through the CMS portal) and submit the plan-identifying information and prescription drug cost data on their own.
Employers and vendors face many challenges in completing the required Rx reporting, and CMS understands that the data will not be perfect, especially the first time it is submitted. Vendors will also likely coalesce around more common processes as the industry gains experience with the CMS reporting system and additional guidance is issued. At this point, employers should be actively working with their vendors to determine how much of the reporting will be done by the vendor, and what, if anything, the employer will need to do to complete the process.
We anticipate that as long as an employer is making a good faith attempt to comply, the regulatory agencies will be trying to assist employers and vendors in completing the reporting rather than taking enforcement actions, at least for the first couple of years of the requirement.
Please do not hesitate to reach out to your dedicated Cottingham & Butler service team to guide you through this reporting process and ensure clear communication with your plan’s vendor partner.