Health Care Transparency Amendments

31
26B-3-1201
26B-3-1202
26B-3-1203
0
Health Care Transparency Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Katy Hall
Senate Sponsor: Chris H. Wilson
LONG TITLE
General Description:
This bill addresses transparency in the Medicaid program.
Highlighted Provisions:
This bill:
requires the Division of Integrated Healthcare (division) to maintain a dashboard of
certain Medicaid data;
requires the division to publish certain data and reports on the division's website;
requires certain participants in the Medicaid program to:
identify, report on, and repay improper payments; and
develop corrective action plans to address improper payments;
requires the Department of Health and Human Services (department) to publish reports of
improper payments and corrective action plans on the department's website;
provides rulemaking authority, including for sanctions for violations of the provisions of
this bill;
defines terms; and
makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
ENACTS:
26B-3-1201
, Utah Code Annotated 1953
26B-3-1202
, Utah Code Annotated 1953
26B-3-1203
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section
26B-3-1201
is enacted to read:
12. Managed Care Transparency
26B-3-1201
. Definitions.
As used in this part:
(1)
"Agent" means a person that has express or implied authority to obligate or act on
behalf of another person.
(2)
"Affiliated person" means:
(a)
a subcontractor, subsidiary, or parent organization o
f a risk contractor; or
(b)
a party with a substantial relationship to a risk contractor, including:
(i)
an officer, director, trustee, general partner, managing employee, or other
individual who holds a similar position of authority or responsibility, whether
through employment or by contract;
(ii)
a shareholder, member, or equity holder that owns, directly or indirectly, 5% or
more of any class of equity interest, or any person who would own that interest
upon conversion, exercise, or exchange of a convertible security, option, warrant,
or similar instrument;
(iii)
a risk contractor's key employee;
(iv)
an immediate family member of a person described in Subsections
(2)(b)(i)

through
(iii)
;
(v)
an entity in which a person described in
Subsections

(2)(b)(i)
through
(iv)
has an
ownership interest of 5% or more, or for which an individual described in
Subsections
(2)(b)(i)
through (iv) serves as an officer, director, or key employee;
or
(vi)
a person acting on behalf of, in concert with, or as an agent of a risk contractor
with respect to:
(A)
any duties, functions, activities, or decision-making under the risk contractor's
contract with the department; or
(B)
compliance with state or federal laws, regulations, or guidance.
(3)
"Claim" means a request or demand for payment for a service provided to an enrollee.
(4)
"Conflict of interest" means a circumstance or appearance of a circumstance where an
interest in, or arising from, an arrangement, relationship, transaction, or activity could or
does adversely affect a risk contractor's ability to, as viewed by a reasonable person with
knowledge of the relevant facts:
(a)
diligently, effectively, and efficiently perform the risk contractor's duties and
responsibilities under the risk contractor's contract with the department;
(b)
comply with federal and state law; or
(c)
act impartially and in the best interest of the Medicaid program, taxpayers, and
Medicaid enrollees.
(5)
"Control" means a person's authority or significant influence over another person's:
(a)
decisions;
(b)
governance;
(c)
management;
(d)
operations;
(e)
finances;
(f)
policies;
(g)
business arrangements;
(h)
staffing;
(i)
Medicaid participation or contracts; or
(j)
compliance with federal and state law.
(6)
"Covered service" means a health or medical service or benefit covered through the
Medicaid program.
(7)
"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub.
L. No. 104-191, 110 Stat. 1936, as amended.
(8)
"Immediate family member" means the same as that term, or the term
"
member of
household
"
, is defined in 42 C.F.R. Sec. 1001.2.
(9)
"Improper payment" means:
(a)
a payment:
(i)
the state makes to a risk contractor in error, or in excess;
(ii)
a risk contractor makes, or another person makes on behalf of a risk contractor:
(A)
that should not be made;
(B)
that is made in an incorrect or duplicate amount;
(C)
that is inconsistent with the risk contractor's contract with the department,
applicable federal and state law, evidence-based clinical guidelines the division
approves, generally accepted accounting principles, or guidance issued by the
division;
(D)
to or on behalf of a Medicaid provider, or the Medicaid provider's affiliated
person, agent, or subcontractor who was deceased on the date the cost was
accrued; or
(E)
for a covered service that is:
(I)
for an individual who, on the date of service, was deceased or incarcerated;
(II)
not a Medicaid-covered service within the scope of the risk contractor's
contract;
(III)
not received by the intended individual as indicated on the claim;
(IV)
not medically necessary;
(V)
in a setting or place of service contrary to the Medicaid program;
(VI)
not clearly, accurately, and sufficiently supported by the medical record of
the individual receiving the covered service; or
(VII)
not supported by a clean claim that is complete, accurate, timely,
properly coded and formatted, and submitted consistent with applicable
claims standards and billing instructions; or
(iii)
made to a Medicaid provider under a sub-capitation or risk-sharing arrangement
where the Medicaid provider failed to submit timely, complete, and accurate data
necessary to support encounter data reporting;
(iv)
made to a Medicaid provider that, on the date of service:
(A)
was not properly enrolled or certified to participate in the Medicaid program;
(B)
did not have a valid Medicaid provider agreement; or
(C)
was not certified as meeting applicable requirements or conditions of
participation; or
(v)
made to a Medicaid provider for a covered service associated with missing,
incomplete, erroneous, or unvalidated encounter data;
(b)
a cost or expense a risk contractor, or risk contractor's subcontractor or agent on the
risk contractor's behalf, incurs:
(i)
in error;
(ii)
by omission;
(iii)
as a result of a deficiency in:
(A)
claims adjudication;
(B)
accounting systems and procedures;
(C)
internal controls over financial reporting;
(D)
information systems; or
(E)
electronic data interchange with Medicaid providers; or
(iv)
as a result of incomplete or inadequate adherence to generally accepted
accounting principles;
(c)
a payment, incurred expense, transfer, or other transaction for which an independent
auditor, the inspector general, or the department determines, consistent with generally
accepted accounting principles and generally accepted auditing standards, that:
(i)
a risk contractor lacks sufficient audit evidence; or
(ii)
financial information about the payment, expense, transfer, or transaction is
misrepresented, misstated, unreliable, falsified, erroneous, incomplete, or missing,
regardless of the pervasiveness or materiality to the risk contractor's financial
statements or financial position;
(d)
(i)
a risk contractor's payment, incurred expense, transfer, or transaction during the
period covered by an independent auditor's adverse opinion; or
(ii)
the payments, expenses, transfers, and transactions an independent auditor who
gives an adverse opinion, in consultation with the state Medicaid director, is able
to reasonably determine resulted in the adverse opinion;
(e)
if an independent auditor issues a disclaimer of opinion, all payments made,
expenses incurred, transfers, and transactions of a risk contractor during the intended
period of the uncompleted or prevented audit, unless, no more than 60 days after the
date on which the independent auditor issues the disclaimer:
(i)
all impediments to the performance of an independent audit are eliminated to the
satisfaction of the independent auditor and the Medicaid director;
(ii)
the independent auditor conducts and completes a full, independent audit
consistent with generally accepted auditing standards; and
(iii)
the independent auditor issues a complete audit report with a qualified or
unqualified opinion;
(f)
a payment, expense incurred, transfer, or transaction incident to or contributing to,
directly or indirectly, the exceptions or qualified matters identified in an independent
auditor's qualified opinion;
(g)
a payment, incurred expense, transfer, or transaction made as a result, in whole or in
part, of a conflict of interest;
(h)
the excess amount of a payment that a Medicaid provider makes to a related party as
a result of higher rates, favorable reimbursement policies or practices, financial
incentives, more favorable terms and conditions, a preference in medical and
utilization management practices, or preferences in market shares;
(i)
a payment made:
(i)
for goods or services, or intracompany or intercompany services, determined on
any basis other than or higher than a market-competitive, arm's length
arrangement, with no financial favoritism; and
(ii)
by or on behalf of a risk contractor for the risk contractor's:
(A)
parent organization;
(B)
subcontractor;
(C)
supplier;
(D)
manufacturer;
(E)
distributor; or
(F)
vendor; or
(j)
a payment made to, or for the costs of, a person listed in:
(i)
the United States Department of Health and Human Services' Office of Inspector
General's List of Excluded Individuals/Entities;
(ii)
the CMS National Plan and Provider Enumeration System exclusion list;
(iii)
the United States Social Security Administration death master file;
(iv)
exclusions or disqualifications from the General Services Administration's
System for Award Management; or
(v)
another database described in:
(A)
an agreement between the division and a managed care organization to
provide goods and services in the Medicaid program; or
(B)
federal or state law or regulations.
(10)
"Inspector general" means the inspector general of Medicaid services appointed under
Section
63A-13-201
.
(11)
"Key employee" means an employee with authority over:
(a)
clinical operations;
(b)
medical management;
(c)
compliance;
(d)
reporting;
(e)
program integrity;
(f)
contracting;
(g)
network management;
(h)
claims processing;
(i)
utilization review;
(j)
financial management;
(k)
Medicaid provider relations;
(l)
government relations; or
(m)
any other function material to the administration of a Medicaid risk contract.
(12)
"Managed care organization" means a comprehensive full risk managed care delivery
system that contracts with the Medicaid program or the Children's Health Insurance
Program to deliver health care through a managed care plan.
(13)
"Managed care plan" means a risk-based delivery service model authorized by Section
26B-3-202
and administered by a managed care organization.
(14)
"Managing employee" means an individual who:
(a)
exercises operational or managerial control over the employing entity's functions,
activities, or units; or
(b)
directly or indirectly conducts the employing entity's day-to-day operations,
functions, activities, or units.
(15)
"Medicaid provider" means a person that furnishes, delivers, supplies, produces,
orders, prescribes, administers, or dispenses a covered service.
(16)
"National drug code identifier" means the same as that term is defined in 21 C.F.R.
Sec. 207.33.
(17)
"Ownership interest" means possession of, in an entity:
(a)
legal or beneficial ownership;
(b)
capital interest;
(c)
profit interest;
(d)
controlling interest;
(e)
any combination of the interests described in Subsections
(17)(a)
through (d);
(f)
indirect interest through another entity that has an interest described in Subsections
(17)(a)
through
(d)
in the entity; or
(g)
the right to acquire an interest described in Subsections
(17)(a)
through
(d)
in the
entity upon conversion, exercise, or exchange of a convertible security, option,
warrant, or similar instrument.
(18)
"Parent organization" means an entity that, directly or indirectly, has a majority or
greater ownership interest in and control of another entity.
(19)
"Pass through payment" means the same as that term is defined in 42 C.F.R. Sec. 438.
(20)
"Protected health information" means the same as that term is defined in 45 C.F.R.
Sec. 160.103.
(21)
"Related party" means:
(a)
a risk contractor's parent organization;
(b)
the subordinate holding company, subsidiary, agent, instrumentality, partnership,
joint venture, affiliated person, or subordinate business unit of:
(i)
a risk contractor;
(ii)
a risk contractor's parent organization;
(iii)
a subcontractor;
(iv)
a risk contractor's agent; or
(v)
a Medicaid provider that is an entity described in Subsections
(21)(a)
, (b)(i)
through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection
(21)(f)
, or Subsection
(21)(g)
;
(c)
an entity that controls, is controlled by, or is in common control with:
(i)
a risk contractor;
(ii)
a risk contractor's parent organization;
(iii)
a subcontractor;
(iv)
a risk contractor's agent; or
(v)
a Medicaid provider that is an entity described in Subsections
(21)(a)
, (b)(i)
through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection
(21)(f)
, or Subsection
(21)(g)
;
(d)
an entity that, directly or indirectly, has an ownership interest in:
(i)
a risk contractor;
(ii)
a risk contractor's parent organization;
(iii)
a subcontractor;
(iv)
a risk contractor's agent; or
(v)
a Medicaid provider that is an entity described in Subsections
(21)(a)
, (b)(i)
through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection
(21)(f)
, or Subsection
(21)(g)
;
(e)
a Medicaid provider that, directly or indirectly, has an ownership interest in:
(i)
a risk contractor;
(ii)
a risk contractor's parent organization;
(iii)
a subcontractor;
(iv)
a risk contractor's agent; or
(v)
a Medicaid provider that is an entity described in Subsections
(21)(a)
, (b)(i)
through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection
(21)(f)
, or Subsection
(21)(g)
;
(f)
a Medicaid provider with a sub-capitation, risk-sharing, or shared-savings payment
arrangement with a risk contractor; or
(g)
an entity described in Subsections
(21)(a
)
through
(f)
that is identified in:
(i)
disclosures;
(ii)
financial statements;
(iii)
an audit;
(iv)
regulatory filings;
(v)
administrative proceedings;
(vi)
court proceedings;
(vii)
federal or state:
(A)
oversight activities;
(B)
compliance activities;
(C)
enforcement activities; or
(D)
investigative activities; or
(viii)
state legislative oversight activities.
(22)
"Risk contractor" means a person that has, or is seeking to qualify for, a contract with
the department to provide or arrange for covered services to Medicaid program enrollees
as:
(a)
a managed care organization;
(b)
a health insuring organization, a prepaid ambulatory health plan, or
a
prepaid
inpatient health plan, as those terms are defined in 42 C.F.R. Sec. 438.2;
(c)
a highly integrated dual eligible special needs plan or a fully integrated dual eligible
special needs plan, as those terms are defined in 42 C.F.R. Sec. 422.2; or
(d)
another type of state-licensed risk-bearing entity that:
(i)
meets federal and state statutory and regulatory requirements;
(ii)
assumes full, partial, or shared risk for the cost of covered services; and
(iii)
may incur loss if the cost of providing the covered services exceeds payments
under the entity's agreement with the division to provide goods or services under
the Medicaid program.
(23)
"State directed payment" means a contract arrangement that directs the expenditures of
a managed care organization, including to implement value-based purchasing models for:
(a)
Medicaid provider reimbursement;
(b)
multi-payer reform;
(c)
Medicaid-specific delivery system reform; or
(d)
performance improvement incentives, which may include, for Medicaid providers
that provide a specific service under the agreement:
(i)
a minimum fee schedule;
(ii)
a uniform dollar amount or percentage increase in reimbursement; or
(iii)
a maximum fee schedule.
(24)
"Subcontractor" means a person that contracts with a risk contractor to provide,
arrange for, manage, or perform a good or service under the risk contractor's agreement
with the division, including:
(a)
a pharmacy benefit manager;
(b)
a behavioral health organization;
(c)
a dental benefit administrator;
(d)
a transportation broker;
(e)
a utilization management organization; or
(f)
an entity that performs:
(i)
financial management services;
(ii)
claims processing;
(iii)
decision support and analytics;
(iv)
care management;
(v)
medical policy and utilization review services;
(vi)
quality improvement activities;
(vii)
provider network management;
(viii)
member services;
(ix)
information systems and technology services;
(x)
marketing;
(xi)
staffing services; or
(xii)
government relations.
(25)
"Value add benefits" means benefits offered by a managed care organization in
addition to standard coverage offered through the Medicaid program.
(26)
"Value-based purchasing model" means a model for Medicaid provider reimbursement
that recognizes value or outcomes over volume of services, including:
(a)
pay for performance; or
(b)
bundled payments.
Section 2. Section
26B-3-1202
is enacted to read:
26B-3-1202
. Medicaid managed care quality data -- Dashboard-- Reporting
requirements -- Rulemaking authority.
(1)
(a)
By December 31, 2026, the division shall establish and maintain a dashboard to
report the data described in this Subsection
(1)
that is:
(i)
online on the division's website;
(ii)
easily accessible to the public through a link posted in a conspicuous place on the
division's website;
(iii)
organized by managed care plan;
(iv)
searchable;
(v)
machine readable; and
(vi)
able to be downloaded or printed.
(b)
For each managed care plan, the division shall publish and quarterly update on the
dashboard described in Subsection
(1)(a)
, the following data:
(i)
the total count of services rendered, by billing code type, Medicaid provider type,
and care setting;
(ii)
total spending on medical claims, non-claims expenditures, and non-benefit
services by managed care organization;
(iii)
total spending on pass through payments and state directed payments by facility;
(iv)
total spending:
(A)
by billing code type;
(B)
by
Medicaid provider type, including public and private Medicaid providers,
and care setting type;
(C)
on mandatory Medicaid benefits; and
(D)
on optional Medicaid benefits, including value add benefits;
(v)
total number and share of enrollees receiving care in an emergency room;
(vi)
total claims and spending on services delivered in an emergency room;
(vii)
total spending on services delivered by a subcontractor or managed care
organization's related party, by service type;
(viii)
total spending on prescription drugs by active ingredient; and
(ix)
total number and share of enrollees for whom no claims were filed.
(c)
When publishing the data described in Subsection
(1)(b)(iv)
, the division shall
identify whether the source of funding for the reported spending is federal or state
funds.
(d)
The division may use existing databases or other tools to fulfill the requirements of
this Subsection
(1)
.
(e)
By December 31, 2026, the dashboard shall inclu
de

t
he data described in Subsection
(1)(b)
from January 1, 2023, through September 30, 2026.
(2)
(a)
A managed care organization shall submit to the division complete copies of all
data, reports, and disclosures the managed care organization submits to CMS related
to the managed care organization's participation in the Medicaid program no later
than 30 days after the day on which the managed care organization submits the data,
report, or disclosure to CMS.
(b)
No later than 30 days after the day on which the division receives a submission
described in Subsection
(2)(a)
, the division shall post the submission on the division's
website:
(i)
in a format that is searchable and machine readable; and
(ii)
through a link that is easily accessible to the public and posted in a conspicuous
place on the division's website.
(c)
The division shall redact protected health information from a submission before
posting the submission on the division's website as described in Subsection
(2)(b)
.
(3)
A managed care organization shall certify in writing that the data, reports, and
disclosures the managed care organization submits to the division under Subsection
(2)

are accurate and complete.
(4)
The department shall require that
each managed care contract includes a provision that
requires a managed care plan to comply with this section and rules the department
makes under this section, subject to sanctions provided in accordance with Section
26B-3-108
.
(5)
If the division, under rules made by the department in accordance with Section
26B-3-108
, or the federal government, sanctions a managed care organization with
termination from the Medicaid program, the managed care organization is not eligible to
enter into a new contract with the department:
(a)
until five years after the date on which the managed care organization was
terminated; and
(b)
unless the managed care organization submits to the department a written
explanation of action the managed care organization has taken to ensure the managed
care organization's compliance with this section.
(6)
(a)
The division shall annually publish a report that includes a summary of, and
managed care organization-specific measures of, managed care organizations'
financial performance and service utilization.
(b)
The division shall annually submit the report described in Subsection
(6)(a)
, on or
before November 1 each year, to the Health and Human Services Interim Committee
and the Social Services Appropriations
Subcommittee
.
(7)
(a)
The division shall make publicly available on the division's website:
(i)
the data described in Subsection
(1)
in the dashboard described in Subsection
(1)(a)
;
(ii)
medical loss ratio audited reports; and
(iii)
the report described in Subsection
(6)
.
(b)
The division shall ensure that data that is published as described in this section,
including financial data and data described in Subsection
(1)
, is deidentified.
(8)
(a)
Unless otherwise provided by applicable state or federal law, a submission a
managed care organization submits to the division in accordance with this section is a
public record under Title 63G, Chapter 2, Government Records Access and
Management Act.
(b)
Except as provided in Subsection
(8)(c)
, a risk contractor, subcontractor, or an
affiliated person of the risk contractor or subcontractor, may not make a claim of
business confidentiality under Section
63G-2-309
for any data, information, report, or
disclosure submitted to the division under this section.
(c)
Subsection
(8)(b)
does not apply to commercial information or nonindividual
financial information described in Subsection
63G-2-305(2)
.
(d)
If a person described in Subsection
(8)(b)
makes a claim of business confidentiality
in accordance with Subsection
63G-2-305(2)
as described in Subsection
(8)(c)
, the
division shall redact the information that is subject to the claim of business
confidentiality before publishing, posting, or otherwise making the submission public.
(9)
Nothing in this section shall be construed to alter or preempt the requirements for
protecting health information under HIPAA.
(10)
The department shall make rules in accordance with Title 63G, Chapter 3, Utah
Administrative Rulemaking Act, to implement this section.
Section 3. Section
26B-3-1203
is enacted to read:
26B-3-1203
. Identifying improper payments -- Repayment -- Prevention.
(1)
Each risk contractor and subcontractor shall quarterly:
(a)
identify and document all improper payments;
(b)
conduct a root cause analysis for each type of improper payment;
(c)
repay all improper payments that are due to the Medicaid program no later than 30
days after the day on which the report described in Subsection
(2)
is due; and
(d)
develop and implement a corrective action plan that includes improvements in
policies, procedures, accounting, financial management, internal controls,
information systems, reporting, staffing, or training necessary to address improper
payments.
(2)
(a)
Each risk contractor and subcontractor shall quarterly submit to the division a
report of the risk contractor's or subcontractor's improper payments, root cause
analyses, and corrective action plan.
(b)
The department shall publish the reports described in Subsection
(2)(a)
on the
department's website, unless posting a report would interfere with an ongoing
investigation of the:
(i)
Office
of Inspector General of Medicaid Services created in Section
63A-13-301
;
or
(ii)
Utah Medicaid Fraud Control Unit of the attorney general's office.
(3)
The department shall make rules in accordance with Title 63G, Chapter 3, Utah
Administrative Rulemaking Act, to establish:
(a)
due dates for the submission of reports described in Subsection
(2)
; and
(b)
sanctions for a risk contractor's or subcontractor's failure to repay as described in
Subsection
(1)(c)
, consistent with Section
26B-3-108
.
Section 4.
Effective Date.
This bill takes effect on
May 6, 2026
.
3-6-26 10:45 PM