Health Care Transparency Amendments, the official text

Health Care Transparency Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Katy Hall
Senate Sponsor: Chris H. Wilson

LONG TITLE
General Description:
This bill addresses transparency in the Medicaid program.
Highlighted Provisions:
This bill: requires the Division of Integrated Healthcare (division) to maintain a dashboard of certain Medicaid data;
requires the division to publish certain data and reports on the division's website;
requires certain participants in the Medicaid program to: identify, report on, and repay improper payments; and
develop corrective action plans to address improper payments;

requires the Department of Health and Human Services (department) to publish reports of improper payments and corrective action plans on the department's website;
provides rulemaking authority, including for sanctions for violations of the provisions of this bill;
defines terms; and
makes technical and conforming changes.

Money Appropriated in this Bill: None Other Special Clauses: None Utah Code Sections Affected: ENACTS:
26B-3-1201, Utah Code Annotated 1953
26B-3-1202, Utah Code Annotated 1953
26B-3-1203, Utah Code Annotated 1953

Be it enacted by the Legislature of the state of Utah:
Section 1. Section 26B-3-1201 is enacted to read:
12. Managed Care Transparency 26B-3-1201. Definitions.
As used in this part: (1) "Agent" means a person that has express or implied authority to obligate or act on behalf of another person.
(2) "Affiliated person" means: (a) a subcontractor, subsidiary, or parent organization o f a risk contractor; or
(b) a party with a substantial relationship to a risk contractor, including: (i) an officer, director, trustee, general partner, managing employee, or other individual who holds a similar position of authority or responsibility, whether through employment or by contract;
(ii) a shareholder, member, or equity holder that owns, directly or indirectly, 5% or more of any class of equity interest, or any person who would own that interest upon conversion, exercise, or exchange of a convertible security, option, warrant, or similar instrument;
(iii) a risk contractor's key employee;
(iv) an immediate family member of a person described in Subsections (2)(b)(i) through (iii);
(v) an entity in which a person described in Subsections (2)(b)(i) through (iv) has an ownership interest of 5% or more, or for which an individual described in Subsections (2)(b)(i) through (iv) serves as an officer, director, or key employee; or
(vi) a person acting on behalf of, in concert with, or as an agent of a risk contractor with respect to: (A) any duties, functions, activities, or decision-making under the risk contractor's contract with the department; or
(B) compliance with state or federal laws, regulations, or guidance.

(3) "Claim" means a request or demand for payment for a service provided to an enrollee.
(4) "Conflict of interest" means a circumstance or appearance of a circumstance where an interest in, or arising from, an arrangement, relationship, transaction, or activity could or does adversely affect a risk contractor's ability to, as viewed by a reasonable person with knowledge of the relevant facts: (a) diligently, effectively, and efficiently perform the risk contractor's duties and responsibilities under the risk contractor's contract with the department;
(b) comply with federal and state law; or
(c) act impartially and in the best interest of the Medicaid program, taxpayers, and Medicaid enrollees.

(5) "Control" means a person's authority or significant influence over another person's: (a) decisions;
(b) governance;
(c) management;
(d) operations;
(e) finances;
(f) policies;
(g) business arrangements;
(h) staffing;
(i) Medicaid participation or contracts; or
(j) compliance with federal and state law.

(6) "Covered service" means a health or medical service or benefit covered through the Medicaid program.
(7) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936, as amended.
(8) "Immediate family member" means the same as that term, or the term " member of household ", is defined in 42 C.F.R. Sec. 1001.2.
(9) "Improper payment" means: (a) a payment: (i) the state makes to a risk contractor in error, or in excess;
(ii) a risk contractor makes, or another person makes on behalf of a risk contractor: (A) that should not be made;
(B) that is made in an incorrect or duplicate amount;
(C) that is inconsistent with the risk contractor's contract with the department, applicable federal and state law, evidence-based clinical guidelines the division approves, generally accepted accounting principles, or guidance issued by the division;
(D) to or on behalf of a Medicaid provider, or the Medicaid provider's affiliated person, agent, or subcontractor who was deceased on the date the cost was accrued; or
(E) for a covered service that is: (I) for an individual who, on the date of service, was deceased or incarcerated;
(II) not a Medicaid-covered service within the scope of the risk contractor's contract;
(III) not received by the intended individual as indicated on the claim;
(IV) not medically necessary;
(V) in a setting or place of service contrary to the Medicaid program;
(VI) not clearly, accurately, and sufficiently supported by the medical record of the individual receiving the covered service; or
(VII) not supported by a clean claim that is complete, accurate, timely, properly coded and formatted, and submitted consistent with applicable claims standards and billing instructions; or

(iii) made to a Medicaid provider under a sub-capitation or risk-sharing arrangement where the Medicaid provider failed to submit timely, complete, and accurate data necessary to support encounter data reporting;
(iv) made to a Medicaid provider that, on the date of service: (A) was not properly enrolled or certified to participate in the Medicaid program;
(B) did not have a valid Medicaid provider agreement; or
(C) was not certified as meeting applicable requirements or conditions of participation; or

(v) made to a Medicaid provider for a covered service associated with missing, incomplete, erroneous, or unvalidated encounter data;

(b) a cost or expense a risk contractor, or risk contractor's subcontractor or agent on the risk contractor's behalf, incurs: (i) in error;
(ii) by omission;
(iii) as a result of a deficiency in: (A) claims adjudication;
(B) accounting systems and procedures;
(C) internal controls over financial reporting;
(D) information systems; or
(E) electronic data interchange with Medicaid providers; or

(iv) as a result of incomplete or inadequate adherence to generally accepted accounting principles;

(c) a payment, incurred expense, transfer, or other transaction for which an independent auditor, the inspector general, or the department determines, consistent with generally accepted accounting principles and generally accepted auditing standards, that: (i) a risk contractor lacks sufficient audit evidence; or
(ii) financial information about the payment, expense, transfer, or transaction is misrepresented, misstated, unreliable, falsified, erroneous, incomplete, or missing, regardless of the pervasiveness or materiality to the risk contractor's financial statements or financial position;

(d) (i) a risk contractor's payment, incurred expense, transfer, or transaction during the period covered by an independent auditor's adverse opinion; or
(ii) the payments, expenses, transfers, and transactions an independent auditor who gives an adverse opinion, in consultation with the state Medicaid director, is able to reasonably determine resulted in the adverse opinion;

(e) if an independent auditor issues a disclaimer of opinion, all payments made, expenses incurred, transfers, and transactions of a risk contractor during the intended period of the uncompleted or prevented audit, unless, no more than 60 days after the date on which the independent auditor issues the disclaimer: (i) all impediments to the performance of an independent audit are eliminated to the satisfaction of the independent auditor and the Medicaid director;
(ii) the independent auditor conducts and completes a full, independent audit consistent with generally accepted auditing standards; and
(iii) the independent auditor issues a complete audit report with a qualified or unqualified opinion;

(f) a payment, expense incurred, transfer, or transaction incident to or contributing to, directly or indirectly, the exceptions or qualified matters identified in an independent auditor's qualified opinion;
(g) a payment, incurred expense, transfer, or transaction made as a result, in whole or in part, of a conflict of interest;
(h) the excess amount of a payment that a Medicaid provider makes to a related party as a result of higher rates, favorable reimbursement policies or practices, financial incentives, more favorable terms and conditions, a preference in medical and utilization management practices, or preferences in market shares;
(i) a payment made: (i) for goods or services, or intracompany or intercompany services, determined on any basis other than or higher than a market-competitive, arm's length arrangement, with no financial favoritism; and
(ii) by or on behalf of a risk contractor for the risk contractor's: (A) parent organization;
(B) subcontractor;
(C) supplier;
(D) manufacturer;
(E) distributor; or
(F) vendor; or

(j) a payment made to, or for the costs of, a person listed in: (i) the United States Department of Health and Human Services' Office of Inspector General's List of Excluded Individuals/Entities;
(ii) the CMS National Plan and Provider Enumeration System exclusion list;
(iii) the United States Social Security Administration death master file;
(iv) exclusions or disqualifications from the General Services Administration's System for Award Management; or
(v) another database described in: (A) an agreement between the division and a managed care organization to provide goods and services in the Medicaid program; or
(B) federal or state law or regulations.

(10) "Inspector general" means the inspector general of Medicaid services appointed under Section 63A-13-201.
(11) "Key employee" means an employee with authority over: (a) clinical operations;
(b) medical management;
(c) compliance;
(d) reporting;
(e) program integrity;
(f) contracting;
(g) network management;
(h) claims processing;
(i) utilization review;
(j) financial management;
(k) Medicaid provider relations;
(l) government relations; or
(m) any other function material to the administration of a Medicaid risk contract.

(12) "Managed care organization" means a comprehensive full risk managed care delivery system that contracts with the Medicaid program or the Children's Health Insurance Program to deliver health care through a managed care plan.
(13) "Managed care plan" means a risk-based delivery service model authorized by Section 26B-3-202 and administered by a managed care organization.
(14) "Managing employee" means an individual who: (a) exercises operational or managerial control over the employing entity's functions, activities, or units; or
(b) directly or indirectly conducts the employing entity's day-to-day operations, functions, activities, or units.

(15) "Medicaid provider" means a person that furnishes, delivers, supplies, produces, orders, prescribes, administers, or dispenses a covered service.
(16) "National drug code identifier" means the same as that term is defined in 21 C.F.R. Sec. 207.33.
(17) "Ownership interest" means possession of, in an entity: (a) legal or beneficial ownership;
(b) capital interest;
(c) profit interest;
(d) controlling interest;
(e) any combination of the interests described in Subsections (17)(a) through (d);
(f) indirect interest through another entity that has an interest described in Subsections (17)(a) through (d) in the entity; or
(g) the right to acquire an interest described in Subsections (17)(a) through (d) in the entity upon conversion, exercise, or exchange of a convertible security, option, warrant, or similar instrument.

(18) "Parent organization" means an entity that, directly or indirectly, has a majority or greater ownership interest in and control of another entity.
(19) "Pass through payment" means the same as that term is defined in 42 C.F.R. Sec. 438.
(20) "Protected health information" means the same as that term is defined in 45 C.F.R. Sec. 160.103.
(21) "Related party" means: (a) a risk contractor's parent organization;
(b) the subordinate holding company, subsidiary, agent, instrumentality, partnership, joint venture, affiliated person, or subordinate business unit of: (i) a risk contractor;
(ii) a risk contractor's parent organization;
(iii) a subcontractor;
(iv) a risk contractor's agent; or
(v) a Medicaid provider that is an entity described in Subsections (21)(a), (b)(i) through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection (21)(f), or Subsection (21)(g);

(c) an entity that controls, is controlled by, or is in common control with: (i) a risk contractor;
(ii) a risk contractor's parent organization;
(iii) a subcontractor;
(iv) a risk contractor's agent; or
(v) a Medicaid provider that is an entity described in Subsections (21)(a), (b)(i) through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection (21)(f), or Subsection (21)(g);

(d) an entity that, directly or indirectly, has an ownership interest in: (i) a risk contractor;
(ii) a risk contractor's parent organization;
(iii) a subcontractor;
(iv) a risk contractor's agent; or
(v) a Medicaid provider that is an entity described in Subsections (21)(a), (b)(i) through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection (21)(f), or Subsection (21)(g);

(e) a Medicaid provider that, directly or indirectly, has an ownership interest in: (i) a risk contractor;
(ii) a risk contractor's parent organization;
(iii) a subcontractor;
(iv) a risk contractor's agent; or
(v) a Medicaid provider that is an entity described in Subsections (21)(a), (b)(i) through (iv), (c)(i) through (iv), (d)(i) through (iv), (e)(i) through (iv), Subsection (21)(f), or Subsection (21)(g);

(f) a Medicaid provider with a sub-capitation, risk-sharing, or shared-savings payment arrangement with a risk contractor; or
(g) an entity described in Subsections (21)(a) through (f) that is identified in: (i) disclosures;
(ii) financial statements;
(iii) an audit;
(iv) regulatory filings;
(v) administrative proceedings;
(vi) court proceedings;
(vii) federal or state: (A) oversight activities;
(B) compliance activities;
(C) enforcement activities; or
(D) investigative activities; or

(viii) state legislative oversight activities.

(22) "Risk contractor" means a person that has, or is seeking to qualify for, a contract with the department to provide or arrange for covered services to Medicaid program enrollees as: (a) a managed care organization;
(b) a health insuring organization, a prepaid ambulatory health plan, or a prepaid inpatient health plan, as those terms are defined in 42 C.F.R. Sec. 438.2;
(c) a highly integrated dual eligible special needs plan or a fully integrated dual eligible special needs plan, as those terms are defined in 42 C.F.R. Sec. 422.2; or
(d) another type of state-licensed risk-bearing entity that: (i) meets federal and state statutory and regulatory requirements;
(ii) assumes full, partial, or shared risk for the cost of covered services; and
(iii) may incur loss if the cost of providing the covered services exceeds payments under the entity's agreement with the division to provide goods or services under the Medicaid program.

(23) "State directed payment" means a contract arrangement that directs the expenditures of a managed care organization, including to implement value-based purchasing models for: (a) Medicaid provider reimbursement;
(b) multi-payer reform;
(c) Medicaid-specific delivery system reform; or
(d) performance improvement incentives, which may include, for Medicaid providers that provide a specific service under the agreement: (i) a minimum fee schedule;
(ii) a uniform dollar amount or percentage increase in reimbursement; or
(iii) a maximum fee schedule.

(24) "Subcontractor" means a person that contracts with a risk contractor to provide, arrange for, manage, or perform a good or service under the risk contractor's agreement with the division, including: (a) a pharmacy benefit manager;
(b) a behavioral health organization;
(c) a dental benefit administrator;
(d) a transportation broker;
(e) a utilization management organization; or
(f) an entity that performs: (i) financial management services;
(ii) claims processing;
(iii) decision support and analytics;
(iv) care management;
(v) medical policy and utilization review services;
(vi) quality improvement activities;
(vii) provider network management;
(viii) member services;
(ix) information systems and technology services;
(x) marketing;
(xi) staffing services; or
(xii) government relations.

(25) "Value add benefits" means benefits offered by a managed care organization in addition to standard coverage offered through the Medicaid program.
(26) "Value-based purchasing model" means a model for Medicaid provider reimbursement that recognizes value or outcomes over volume of services, including: (a) pay for performance; or
(b) bundled payments.

Section 2. Section 26B-3-1202 is enacted to read:
26B-3-1202. Medicaid managed care quality data -- Dashboard-- Reporting requirements -- Rulemaking authority.
(1) (a) By December 31, 2026, the division shall establish and maintain a dashboard to report the data described in this Subsection (1) that is: (i) online on the division's website;
(ii) easily accessible to the public through a link posted in a conspicuous place on the division's website;
(iii) organized by managed care plan;
(iv) searchable;
(v) machine readable; and
(vi) able to be downloaded or printed.

(b) For each managed care plan, the division shall publish and quarterly update on the dashboard described in Subsection (1)(a), the following data: (i) the total count of services rendered, by billing code type, Medicaid provider type, and care setting;
(ii) total spending on medical claims, non-claims expenditures, and non-benefit services by managed care organization;
(iii) total spending on pass through payments and state directed payments by facility;
(iv) total spending: (A) by billing code type;
(B) by Medicaid provider type, including public and private Medicaid providers, and care setting type;
(C) on mandatory Medicaid benefits; and
(D) on optional Medicaid benefits, including value add benefits;

(v) total number and share of enrollees receiving care in an emergency room;
(vi) total claims and spending on services delivered in an emergency room;
(vii) total spending on services delivered by a subcontractor or managed care organization's related party, by service type;
(viii) total spending on prescription drugs by active ingredient; and
(ix) total number and share of enrollees for whom no claims were filed.

(c) When publishing the data described in Subsection (1)(b)(iv), the division shall identify whether the source of funding for the reported spending is federal or state funds.
(d) The division may use existing databases or other tools to fulfill the requirements of this Subsection (1).
(e) By December 31, 2026, the dashboard shall inclu de t he data described in Subsection (1)(b) from January 1, 2023, through September 30, 2026.

(2) (a) A managed care organization shall submit to the division complete copies of all data, reports, and disclosures the managed care organization submits to CMS related to the managed care organization's participation in the Medicaid program no later than 30 days after the day on which the managed care organization submits the data, report, or disclosure to CMS.
(b) No later than 30 days after the day on which the division receives a submission described in Subsection (2)(a), the division shall post the submission on the division's website: (i) in a format that is searchable and machine readable; and
(ii) through a link that is easily accessible to the public and posted in a conspicuous place on the division's website.

(c) The division shall redact protected health information from a submission before posting the submission on the division's website as described in Subsection (2)(b).

(3) A managed care organization shall certify in writing that the data, reports, and disclosures the managed care organization submits to the division under Subsection (2) are accurate and complete.
(4) The department shall require that each managed care contract includes a provision that requires a managed care plan to comply with this section and rules the department makes under this section, subject to sanctions provided in accordance with Section 26B-3-108.
(5) If the division, under rules made by the department in accordance with Section 26B-3-108, or the federal government, sanctions a managed care organization with termination from the Medicaid program, the managed care organization is not eligible to enter into a new contract with the department: (a) until five years after the date on which the managed care organization was terminated; and
(b) unless the managed care organization submits to the department a written explanation of action the managed care organization has taken to ensure the managed care organization's compliance with this section.

(6) (a) The division shall annually publish a report that includes a summary of, and managed care organization-specific measures of, managed care organizations' financial performance and service utilization.
(b) The division shall annually submit the report described in Subsection (6)(a), on or before November 1 each year, to the Health and Human Services Interim Committee and the Social Services Appropriations Subcommittee.

(7) (a) The division shall make publicly available on the division's website: (i) the data described in Subsection (1) in the dashboard described in Subsection (1)(a);
(ii) medical loss ratio audited reports; and
(iii) the report described in Subsection (6).

(b) The division shall ensure that data that is published as described in this section, including financial data and data described in Subsection (1), is deidentified.

(8) (a) Unless otherwise provided by applicable state or federal law, a submission a managed care organization submits to the division in accordance with this section is a public record under Title 63G, Chapter 2, Government Records Access and Management Act.
(b) Except as provided in Subsection (8)(c), a risk contractor, subcontractor, or an affiliated person of the risk contractor or subcontractor, may not make a claim of business confidentiality under Section 63G-2-309 for any data, information, report, or disclosure submitted to the division under this section.
(c) Subsection (8)(b) does not apply to commercial information or nonindividual financial information described in Subsection 63G-2-305(2).
(d) If a person described in Subsection (8)(b) makes a claim of business confidentiality in accordance with Subsection 63G-2-305(2) as described in Subsection (8)(c), the division shall redact the information that is subject to the claim of business confidentiality before publishing, posting, or otherwise making the submission public.

(9) Nothing in this section shall be construed to alter or preempt the requirements for protecting health information under HIPAA.
(10) The department shall make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to implement this section.

Section 3. Section 26B-3-1203 is enacted to read:
26B-3-1203. Identifying improper payments -- Repayment -- Prevention.
(1) Each risk contractor and subcontractor shall quarterly: (a) identify and document all improper payments;
(b) conduct a root cause analysis for each type of improper payment;
(c) repay all improper payments that are due to the Medicaid program no later than 30 days after the day on which the report described in Subsection (2) is due; and
(d) develop and implement a corrective action plan that includes improvements in policies, procedures, accounting, financial management, internal controls, information systems, reporting, staffing, or training necessary to address improper payments.

(2) (a) Each risk contractor and subcontractor shall quarterly submit to the division a report of the risk contractor's or subcontractor's improper payments, root cause analyses, and corrective action plan.
(b) The department shall publish the reports described in Subsection (2)(a) on the department's website, unless posting a report would interfere with an ongoing investigation of the: (i) Office of Inspector General of Medicaid Services created in Section 63A-13-301; or
(ii) Utah Medicaid Fraud Control Unit of the attorney general's office.

(3) The department shall make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to establish: (a) due dates for the submission of reports described in Subsection (2); and
(b) sanctions for a risk contractor's or subcontractor's failure to repay as described in Subsection (1)(c), consistent with Section 26B-3-108.

Section 4. Effective Date.
This bill takes effect on May 6, 2026.

3-6-26 10:45 PM