Update – Employer Group Health Plan: Prescription Drug and Medical Reporting Requirement

UPDATE: The December 27, 2022 deadline for group health plans to report certain prescription drug and medical spending information to the Centers for Medicare & Medicaid Services (“CMS”) as required by the Consolidated Appropriations Act, 2021 (“CAA”) is just around the corner.

During a training webinar hosted by CMS on December 7, 2022, CMS provided helpful guidance for plan sponsors, TPAs, PBMs, and issuers reporting on behalf of group health plans.

First, CMS noted that the deadline to report for the 2020 and 2021 reference years remains December 27, 2022, but the HIOS portal for submissions will remain open until January 31, 2023. Although reporting entities should strive to complete their submissions by December 27, submissions will be accepted through January 31, 2023. Additionally, CMS stated that for the 2020 and 2021 reference years, plans are not required to report the average monthly premiums/premium equivalents paid by the employer or the average monthly premiums/premium equivalents paid by participants and beneficiaries as part of the plan’s D1 File. This information will be required for future reference years, but can be left blank for 2020 and 2021.

There is currently a backlog of one to four weeks for CMS to respond to policy-related questions on the requirements. Given this backlog and the sheer number of questions regarding the requirements, CMS emphasized that plans and reporting entities should implement a reasonable interpretation of the requirements when completing their submissions. Good faith efforts are key for the upcoming initial report deadline.

INFORMATION FROM PRIOR LEGALCURRENTS: December 27, 2022 is the deadline date by which employers who maintain group health plans must report certain prescription drug and medical spending information to the Centers for Medicare & Medicaid Services (“CMS”) to satisfy a requirement imposed by the Consolidated Appropriations Act, 2021 (“CAA”). This requirement applies to insured and self-insured group health plans. It does not apply to plans structured as separate “retiree-only” plans, health reimbursement arrangements (“HRAs”), health flexible spending accounts (“FSAs”), group health plans that constitute “excepted benefits” (such as standalone dental and vision plans and onsite medical clinics). Compliance with the requirement should be relatively easy for employers whose group health plans provide medical and prescription drug benefits on an insured basis. Employers who self-insure medical and/or prescription drug benefits are likely to face complications and should begin to discuss the requirements with their third-party claims administrators (“TPA”) and pharmacy benefit managers (“PBM”). Some PBMs have recently begun to reach out to employers with service proposals for the reporting requirement and have set short deadlines for employers to provide information regarding their intended reporting approach. Unfortunately, the reporting assistance service offerings from some PBMs, like the reporting guidance itself, are not very clear.


The CAA added this new reporting requirement to the Employee Retirement Income Security Act of 1974 (“ERISA”), the Internal Revenue Code (“IRC”), and the Public Health Service Act. Although the title of the provisions added to the law is “Reporting on Pharmacy Benefits and Drug Costs,” the actual information that must be reported goes beyond pharmacy and drug costs and includes non-pharmacy (medical) costs, as well as information regarding premiums paid by employers and enrollees, and enrollment information. Regulations issued jointly by the Department of Labor, Internal Revenue Service, and Department of Health and Human Services (the “Agencies”), along with detailed reporting instructions[1] (the “Reporting Instructions”) published by CMS attempt to explain the requirements. The Reporting Instructions contain detailed information about each of the data elements that are required to be reported.


The initial data report deadline specified by the CAA was December 27, 2021, for data relating to 2020, and June 1, 2022, for data relating to 2021. The Agencies delayed the initial filing deadlines to December 27, 2022. Data for 2020 and 2021 will need to be submitted by that deadline date. Thereafter, data must be submitted by June 1st of the calendar year following the “reference year.” So, for example, data for the 2022 reference year must be reported by June 1, 2023.

Required Data

Employer group health plans must report (or have a third party report on their behalf, as described below) certain basic identifying information (plan name, plan year, EIN information), which the Reporting Instructions refer to as “Plan Lists.” Employer plans are referred to using the code “P2” in the Reporting Instructions. In addition to the basic information, employer plans must report the following data:

  • Premium and “Life Years” data as follows:
    • Average monthly premiums/premium equivalent paid by the employer
    • Average monthly premiums/premium equivalent paid by participants and beneficiaries
    • Total annual premium/premium equivalent to provide the coverage
    • “Life Years”- the average number of members (counting participants and beneficiaries) throughout the year

The Reporting Instructions refer to this data report as the “D1 File.”

  • Total annual spending on health care services broken down by the following categories:
    • Hospital
    • Primary care
    • Specialty care
    • Other medical costs and services (including wellness services)
    • Prescription drug costs covered under the plan’s medical benefit, rather than the plan’s pharmacy benefit (e.g., drugs administered to an inpatient in a hospital)

The Reporting Instructions refer to this data report as the “D2 File.”

  • The following prescription drug information for prescription drugs paid under the plan’s pharmacy benefit (i.e., not including prescription drugs paid under the plan’s medical benefit):
    • The 50 brand prescription drugs most frequently dispensed by pharmacies
    • The 50 most costly prescription drugs
    • The 50 prescription drugs with the greatest increase in expenditure between the year immediately preceding the reference year and the reference year
    • Total prescription drug spending
    • Prescription drug rebates broken down by therapeutic class
    • Prescription drug rebates for each of the 25 drugs that have the greatest amount of rebates

The Reporting Instructions refer to this data report as the “D3 – D8 Files.”

A narrative description in PDF or Word format that describes the impact of prescription drug rebates on premium and cost sharing and addresses other issues noted in the Reporting Instructions.

Who Does the Reporting?

Employers may submit the report themselves or may have one or more third parties (e.g., an insurance carrier, TPA and/or PBM) submit the report on their behalf. The ability to use a third party will depend on several factors: the basis on which the employer’s plan provides benefits (insured vs. self-insured); whether a self-insured employer uses more than one TPA and/or PBM to process claims; and whether the third party is willing to undertake reporting on behalf of the employer. In order to submit a report to CMS directly, an employer will need to create an account on the CMS portal at The Reporting Instructions caution that it can take up to two weeks to create an account, so early action is recommended if an employer will submit its own report.  

As noted previously, an employer whose group health plan provides medical and prescription drug benefits on an insured basis will be in the best position to be able to rely on the insurance carrier(s) to submit the required report, since insurance carriers are directly required to submit aggregate reports to CMS on a line of business basis. However, carriers may not be willing to collect and report the D1 File information (described above) from employers.  In that case, an employer would be required to file a report that reported the D1 File information. The regulations require that in order for an employer to take advantage of the carrier’s reporting, the employer must enter into a written agreement with the carrier under which the carrier agrees to do the reporting.

Employers who self-insure their medical and/or prescription drug benefits should contact their TPA and/or PBM to determine what sort of reporting services the TPA and/or PBM are offering. Based on complicated rules in the regulations and Reporting Instructions, it may not be permissible for an employer that uses more than one TPA to process medical claims to fully outsource its reporting obligation, even if a TPA and/or PBM is otherwise willing to submit reports on behalf of the employer. The restrictions and potential variations in reporting approaches are too complicated to describe in this LEGALcurrents. Employers with that situation should begin discussing reporting with their TPAs and/or PBMs as soon as possible. If it is not permissible for a TPA and/or PBM to handle reporting for the employer, or if the TPA and/or PBM will not agree to report all data elements on behalf of the employer, the employer will need to register and directly report the necessary data files to CMS. For example, in some cases, a TPA and/or PBM may report a portion of the information (e.g., the D2 or D3-D8 information) and the employer may have to report the D1 File information. Additional guidance from the agencies would be helpful.

If you have any questions regarding this LEGALcurrents or want to discuss the reporting requirement, please contact any member of the Employee Benefits & Executive Compensation group at 585.232.6500, 716.853.1316, or visit

[1] Accessible on the CMS website here:

Attorney Advertising. Prior results do not guarantee a similar outcome. This publication is provided as a service to clients and friends of Harter Secrest & Emery LLP. It is intended for general information purposes only and should not be considered as legal advice. The contents are neither an exhaustive discussion nor do they purport to cover all developments in the area. The reader should consult with legal counsel to determine how applicable laws relate to specific situations. ©2022 Harter Secrest & Emery LLP