December 27, 2022, Deadline for Mandatory Rx Data Collection Reporting

As group health plan sponsors, employers are responsible for ensuring compliance with the prescription drug data collection (RxDC) reporting requirements added to ERISA by the Consolidated Appropriations Act of 2021 (CAA).  Under ERISA section 725, enforced by the US Department of Labor (DOL), group health plans (not account-based plans, e.g., health reimbursement arrangements and health savings accounts, or excepted benefit arrangements) must report details regarding the plan’s prescription drug benefit utilization, including the drugs most frequently dispensed, the most expensive drugs, and the drugs with the highest cost increase for a given calendar year.  Reporting is to be made annually to the US Department of Health and Human Services’ (HHS) CMS enterprise portal’s Health Insurance Oversight System (HIOS) module, starting with the report due by December 27, 2022, for the 2020 and 2021 calendar years.  After that, annual reporting is due by June 1^st following the calendar year (so, the 2022 calendar year report is due by June 1, 2023).  The DOL must thereafter post aggregated information on its website so that the public can see trends in prescription drug utilization and pricing.        

What’s required.  Under regulations issued jointly by HHS, DOL, and the US Treasury Department, plans must submit RxDC reports which include –

• General information about the plan like the plan sponsor, plan year, number of participants, market segment (small or large group and fully-insured or self-insured), insurer and other vendors, and the states in which coverage is offered, etc. (“plan list” information – see the template document for reporting, using code P2 for group health plans, at this link);
• Eight data files:
  • Premium/cost and life-year (average number of covered members) data (D1),
  • spending by six categories – hospital, primary care, specialty care, other medical costs and services, known medical benefit drugs, and estimated medical benefit drugs (D2),
  • top 50 most frequently dispensed brand name drugs by state and market segment (D3),
  • top 50 most costly drugs by state and market segment (D4),
  • top 50 drugs by spending increase by state and market segment, excluding drugs issued an Emergency Use Authorization or not FDA-approved (D5),
  • prescription drug spending totals (D6),
  • prescription drug rebates by therapeutic class (D7),
  • and prescription drug rebates for the top 25 drugs by state and market segment (D8); and
• A narrative that describes the impact of prescription drug rebates on premium and cost-sharing, how the employer size was estimated (for self-insured plan sponsors), how bundled or alternative payment arrangements attributable to drugs covered under a medical benefit were estimated, and how net payments from government reinsurance and cost-sharing reduction programs were considered (if applicable).  The narrative also is used to identify any drugs prescribed for which a National Drug Code (NDC) was not on the CMS RxDC code crosswalk, and the types of rebates and other remuneration included in or excluded from the D8 data file.     

How to comply.  HIOS issued specific reporting instructions which explain the reporting requirements in detail and assure plan sponsors that submission for a plan “is considered complete if CMS receives all required files, regardless of who submits the files.”  Many group health plan vendors (insurers, third-party administrators, pharmacy benefit managers, etc.) have proactively contacted plan sponsors to assure them that the vendor will report at least some of the information on the plan’s behalf.  However, not all vendors are willing to accept responsibility for the RxDC reporting requirements.  Employers need to know which reporting obligations will be fulfilled by the group health insurer or other vendor and which reporting obligations must be satisfied by the plan sponsor.  Most plan sponsors are wise to be prepared to upload at least some of the data to the HIOS module themselves, which means first setting up a HIOS account on the CMS portal.  HIOS accounts can take a couple of weeks to set up, so it’s important for plan sponsors to act on this now if they’ve not already done so.  CMS has provided detailed instructions for setting up the HIOS account. 

Compliance issues.  The statute and regulations impose the RxDC reporting requirements on group health plans, which, by default, usually means that requirements and liability for noncompliance are imposed on plan sponsors (generally, employers).  Thus, each group health plan sponsor should ensure that all of the RxDC reporting requirements are satisfied for each group health plan subject to the reporting requirements.  Employers should obtain written agreements from plan vendors identifying what data each vendor will upload.  Note that the employer remains liable for noncompliance (and subject to excise tax and potential civil penalties), even if it has an enforceable agreement with its vendor to ensure compliance unless the plan is fully-insured and the agreement is with the insurer.  Unfortunately, only the reporting entity can view the files it uploads to HIOS, so there is no way for an employer to confirm on the HIOS module that a vendor uploaded the file(s) it agreed to upload on behalf of the employer’s group health plan.  Instead, the employer should obtain written assurance from the plan’s vendor(s) and rely on contractual provisions for recourse if a vendor fails to fulfill its RxDC reporting service as agreed.