New Prescription Drug Reporting Requirement

As previously reported in December 2021, Section 204 of the Consolidated Appropriations Act, 2021 (“CAA”) requires plan sponsors of group health plans to submit information annually about prescription drugs and health care spending to Centers for Medicare and Medicaid Services (“CMS”) on behalf of the departments of Health and Human Services (“HHS”), Labor (“DOL”), and the Treasury (collectively, the “Departments”). The first deadline is December 27, 2022. CMS recently updated guidance related to this reporting requirement that provides some helpful clarification.

What Must Be Reported?

Plan name
Plan number
Plan year
Employer size
Plan sponsor’s principal place of business
Premiums (for self-funded plans, the premium equivalents)
Average monthly premiums paid by the employer and the enrollees
States in which the plan is offered
Number of enrollees
50 most common brand prescription drugs dispensed
50 most costly drugs to total annual spending
50 drugs with the greatest year-over-year cost increase for the plan
Total spending by the plan broken down by:

Types of cost (e.g., hospital, primary care, specialty care, medical benefit drugs, and other medical costs and services
Plan and enrollee spending on prescription drugs

Impact on premiums and out-of-pocket cots associated with rebates, fees, or other payments by drug manufacturers to the plan (narrative response)

Includes prescription drug rebates, fees, and any other remuneration paid by drug manufacturers to the plan or its administrators or service providers, with respect to prescription drugs prescribed for each therapeutic class of drugs, as well as for each of the 25 drugs that yielded the highest amount of rebates and other remuneration under the plan or coverage from drug manufacturers during the plan year

Who Must Report?

Employers with fully insured or self-funded (includes level funded) group health plans, including grandfathered plans, church plans subject to the Internal Revenue Code, and governmental plans.

The term “group health plan” does not include excepted benefits such as onsite clinics and accident-only policies. It also does not include account-based plans (e.g., HRAs or health FSAs).

Periods That Must Be Reported

Information is reported on a calendar year basis, regardless of plan year. This is referred to as a “reference year.”

How is Reporting Done?

Data is reported through the RxDC module in the Health Insurance Oversight System (“HIOS”). An account must be created unless the employer:

already has a HIOS account; or
is not uploading anything because another vendor is handling the full filing; or
where the employer is uploading partial data, not including any files.

NOTE: It can take up to two weeks to create an account so plan sponsors should plan accordingly.

The instructions to create a CMS Enterprise Portal and HIOS accounts are in the HIOS Portal User Manual. The instructions for using the RxDC module are in the RxDC HIOS User Manual. To log in to HIOS, go to the CMS Enterprise Portal at https://portal.cms.gov/portal/.

Can a Vendor Submit Information on an Employer’s Behalf?

Yes.

Insured plans may enter into a written agreement with their carriers to transfer responsibility and liability for reporting to the carrier.

Self-funded plans may enter into a written agreement with their third-party administrator (“TPA”), pharmacy benefit manager (“PBM”), or other vendor to fulfill reporting function on behalf of the plan; however, the plan sponsor remains liable for any failures.

An entity that submits some or all required information is called a “reporting entity.” Reporting entities may charge additional fees for compiling and filing the data.

A plan, issuer, or carrier can allow multiple reporting entities to submit on its behalf. For example, a self-funded group health plan may contract with a TPA to submit the Spending by Category data file and separately contract with a PBM to submit the Top 50 Most Costly Drugs file. Plans, issuers, carriers, and their reporting entities must work together so that each data file submitted in HIOS contains all required information. If one reporting entity is responsible for only some of the fields in a data file, it should fill out those fields and then give the data file to the other reporting entity to complete the remaining information before submitting the data file in HIOS.

Some of the above-listed data points may not be known by the issuer, TPAs, PBMs, or other vendors. Employers should be prepared to receive a request for information from the carrier, TPA, or PBM and either timely provide the information or prepare to do a partial filing.

Some carriers, TPAs, and PBMs have started to release information as it relates to this reporting. For example:

UnitedHealthcare has indicated they will submit the full report for fully insured business. For self-funded business:

UnitedHealthcare will submit the full report where coverage is integrated with UnitedHealthcare (includes UMR and All Savers).
If UHC is not the PBM (carve-out, including OptumRx Direct) or stop loss administrator, plan sponsors must ensure their vendors submit the appropriate files.

CVS (a PBM) offers an option where it will submit certain data files (D3-D8) on behalf of the plan, but the employer remains responsible for submitting all Plan Files, Data Files D1-D2, and the narrative response (likely in coordination with the medical plan TPA).

If a plan, issuer, or carrier changes vendors during the reference year (such as changing a TPA or PBM), there are two reporting options:

The previous vendor reports the data from earlier in the year and the new vendor reports the data from later in the year; or
The previous vendor provides the data to the new vendor and the new vendor reports the entire year of data.

Either way, the plan sponsor must ensure that all their data is reported and that it is not double reported.

For mixed-funded plans, which generally self-fund some benefits and fully insure other benefits, the self-funded business is reported in the self-funded market segment and the fully insured business is reported in the fully insured market segment. For example, suppose a large employer self-funds the pharmacy benefit of a plan and purchases insurance for the medical benefits. In this case, the pharmacy benefits would be attributed to the market segment for self-funded large employer plans and the medical component of the same plan would be attributed to the fully insured large group market.

Currently, CMS does not have a mechanism to notify plans, issuers, or carriers when data has been submitted on their behalf. To confirm submission, plans should contact their reporting entities directly.

Fully-Insured to Self-Insured (or vice versa) during the Reference Year

The fully insured business is reported in the small group or large group market segments and the self-funded business is reported in the self-funded small employer or large employer market segments.

Deadline

The last day to submit data for the 2020 and 2021 reference years is December 27, 2022. The deadline for subsequent reference years is June 1st of the calendar year immediately following the reference year. So, June 1, 2023, is the second deadline, reporting calendar year 2022 information.

Penalty for Noncompliance

The penalty is $100 per affected individual. In addition, the DOL can enforce compliance.

Relief

For the 2020 and 2021 reference years only, the Departments will not take enforcement action related to the requirement to report average monthly premium paid by employers versus members for the 2020 and 2021 reference years if those data elements are not available and they are reported for the 2022 reference year and all future reference years.