A BILL TO BE ENTITLED
AN ACT to allow employers access to information about their group health plans.
The General Assembly of North Carolina enacts:
SECTION 1.  Article 50 of Chapter 58 of the General Statutes is amended by adding a new Part to read:
"Part 8. Reporting of Group Claims Information to Employers.
"§ 58‑50‑300.  Definitions.
In this Part, "protected health information" is as defined in the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104‑191, as amended.
"§ 58‑50‑305.  Access to information by employers.
(a)	An employer shall be entitled to a report of claim information from its health benefits provider for its employee group heath plan. The report shall include the following information for the 36 months prior to the employer's request, subject to the other provisions of this Part:
(1)	Aggregate paid claims experience by month, including claims experience for medical, dental, and pharmacy benefits, as applicable.
(2)	Total premium paid by month.
(3)	Total number of covered employees on a monthly basis by coverage tier, including whether coverage was for:
a.	An employee only.
b.	An employee with dependents only.
c.	An employee with a spouse only.
d.	An employee with a spouse and dependents.
(4)	The total dollar amount of claims pending as of the date of the report.
(5)	A separate description and individual claims report for any individual whose total paid claims exceed fifteen thousand dollars ($15,000) during the 12‑month period preceding the date of the report, including the following information related to the claims for that individual:
a.	A unique identifying number, characteristic, or code for the individual, so as not to identify the individual by name, social security number, subscriber or member identification number, policy number, or other information that could allow the employer to identify the individual.
b.	The amounts paid.
c.	Dates of service.
d.	Applicable procedure codes and diagnosis codes.
(6)	For claims that are not part of the report described by subdivisions (1) through (5) of this subsection, a statement describing precertification requests for hospital stays of five days or longer that were made during the 30‑day period preceding the date of the report.
(b)	In order to receive the information contained in subdivisions (5) through (6) of subsection (a) of this section, an appropriately authorized representative of the employer must issue to the health care benefits provider a certification substantially similar to the following:
	'I hereby certify that the plan documents comply with the requirements of 45 C.F.R. Section 164.504(f)(2) and that the employer will safeguard and limit the use and disclosure of protected health information that the employer may receive from the health care benefits provider only to perform plan administration functions.'
(c)	An employer shall be entitled to request and receive information under this Part up to two years following the termination of the contract with the health care benefits provider to provide health care benefits for the employer's employees.
"§ 58‑50‑310.  Provision of report by health benefits provider.
(a)	Upon written request by an employer under G.S. 58‑50‑305, a health care benefits provider shall, within 30 days of the request, provide the information required under G.S. 58‑50‑305 in one of the following forms:
(1)	In a written report.
(2)	Through an electronic file transmitted by secure electronic mail or a secure file transfer protocol site.
(3)	By making the required information available through a secure Web site or Web portal accessible by the requesting employer.
(b)	A health care benefits provider shall not disclose protected health information in a report of claim information provided under this Part if the health insurance issuer is prohibited from disclosing that information under another State or federal law that imposes more stringent privacy restrictions than those imposed under the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104‑191, as amended. To withhold information in accordance with this subsection, the health insurance issuer must do all of the following:
(1)	Notify the plan, plan sponsor, or plan administrator requesting the report that information is being withheld.
(2)	Provide to the plan, plan sponsor, or plan administrator a list of categories of claim information that the health insurance issuer has determined are subject to the more stringent privacy restrictions under another State or federal law.
(c)	A health care benefits provider shall not be required to provide a report to an employer more than twice in a 12-month period.
"§ 58‑50‑315.  Request for additional information on specific employees.
(a)	An employer may, within 10 days of receipt of the report, make a written request to the health care benefits provider for additional information on specific employees for whom information was provided under G.S. 58‑50‑305(a)(5).
(b)	Following a request under subsection (a) of this section, a health care benefits provider shall provide the following, if they are available:
(1)	Information on the prognosis or recovery.
(2)	For individuals in active case management, the most recent case management information, including any future expected costs and treatment plan, that relate to the claims for that individual.
(c)	The health care benefits provider shall respond within 15 days of the receipt of the request for additional information, unless the employer agrees to a request of the health care benefits provider for additional time.
(d)	The health insurance issuer shall not produce the report described by this section unless the employer provides the certification required under G.S. 58‑50‑305(b).
"§ 58‑50‑320.  Applicability of Part to governmental entities; reports not public record.
(a)	A governmental entity that contracts with a health care benefits provider may request a report under this Part as an employer.
(b)	A report of claim information provided under this Part to a governmental entity shall be confidential and shall not be a public record under Chapter 132 of the General Statutes.
"§ 58‑50‑325.  Compliance with Part does not create liability.
A health care benefits provider issuer that releases information, including protected health information, in accordance with this Part has not violated a standard of care and is not liable for civil damages resulting from, and is not subject to criminal prosecution for, releasing that information.
"§ 58‑50‑330.  Penalty for noncompliance.
A health care benefits provider that does not comply with the provisions of this Part shall be subject to the provisions of G.S. 58‑2‑70."
SECTION 2.  This act becomes effective October 1, 2011.