1.  High-cost claims data.  Upon request of a plan sponsor that has certified its compliance with the use and disclosure requirements of 45 Code of Federal Regulations, Section 164.504(f), an administrator shall provide data on a high-cost claim so that a plan sponsor may perform an audit to ensure compliance with the plan sponsor's contract prior to payment of the high-cost claim. The data must include any itemized billing statements and medical records associated with the claim in the possession of the administrator or the administrator's agents. The plan sponsor or the plan sponsor's designee shall make a request for data on a high-cost claim within 2 business days of receipt of the claim and the administrator must provide the requested information within 30 business days of the request. For the purposes of this subsection, "high-cost claim" means any claim related to an individual provided health coverage by a plan sponsor that exceeds $100,000.  

2.  Claims data; right to audit.  An administrator that contracts with a plan sponsor to provide health coverage shall permit a plan sponsor to perform a post-payment audit of all claims paid to ensure compliance with the contract at least once in a calendar year as long as the request is not earlier than 6 months following a previously requested audit. Upon request of a plan sponsor as part of an audit, an administrator shall disclose within 30 business days to a plan sponsor that has certified its compliance with the use and disclosure requirements of 45 Code of Federal Regulations, Section 164.504(f) or, to the extent permitted by law and if requested by the plan sponsor, to the plan sponsor's designated business associate the following information specific to the plan sponsor:  

3.  No conditions or fees on audit.  An administrator may not impose on a plan sponsor:  

4.  Nondisclosure and data use agreement.  An administrator may require that the plan sponsor and the plan sponsor's designated business associate execute a nondisclosure and data use agreement that reasonably restricts the auditor's use of data provided by the administrator to the sole purpose of conducting an audit on behalf of a plan sponsor. The coverage limits of any cybersecurity insurance or liability insurance policy required under the nondisclosure and data use agreement may not exceed the administrator's limit of liability under the services agreement between the plan sponsor and the administrator, if such limit applies. In addition, an administrator is not required to provide data to an auditor selected by a plan sponsor if the auditor has previously breached a nondisclosure and data use agreement with that administrator or refuses to execute a nondisclosure and data use agreement.  

5.  Compliance with federal law.  Information provided by an administrator to a plan sponsor in accordance with this section must comply with any applicable requirements of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104‑191, and the federal Health Information Technology for Economic and Clinical Health Act of 2009, Title XIII, Subtitle D, Public Law 111-5, and any regulations promulgated under those laws.  

6.  Application.  An administrator may not enter into, issue, amend or renew any contract or network services agreement with a plan sponsor on or after January 1, 2026 that contains any provision that violates this section.  

7.  Exclusive enforcement; violation.  Notwithstanding section 12‑A, a violation of this section is subject to exclusive enforcement under the Maine Unfair Trade Practices Act, including any of the remedies provided for in the Act. A violation is committed each time a prohibited act under this section occurs. Investigations of violations by administrators may include a 3rd party that may possess evidence supporting such investigation.