Health DATA Act of 2026

Key Points

• Group health plans and their sponsors get a legal right to audit insurers, provider networks, and pharmacy benefit managers to check pricing, overpayments, and compliance, and vendors can no longer block or unreasonably limit these audits.
• It becomes illegal for an employer, plan sponsor, administrator, or fiduciary to fire, discipline, or otherwise discriminate against a worker based on their health plan data.
• Any data shared for audits must be stripped of identifying details and handled according to existing HIPAA privacy rules to protect patients.
• Providers, networks, third-party administrators, and pharmacy benefit managers that violate the new audit and transparency rules can be fined $10,000 for every day the violation continues.
• The bill also makes clear that people who manage health plan data as fiduciaries, such as employers and administrators, have a formal legal duty to safeguard it, similar to how they must safeguard plan money.
• Employers found discriminating against workers using health data face fines of $100 per day for each affected employee, and workers do not have to exhaust internal appeals before suing.