Stuck in the Middle: Employers’ Challenges In Accessing Their Health Data

Self-funded employers are finding themselves in a difficult position of late.

Employers have a fiduciary responsibility to make sure they’re offering employees the best medical benefits for the lowest price. And they need access to their medical claims data to do this. 

However, on one hand, many employers are struggling to access their health data from third-party administrators (TPAs), making it difficult for employers to fulfill their fiduciary responsibilities and act in the best interests of their employees. This was evident in the Kraft Heinz/Aetna case, in which Kraft Heinz sued Aetna for cherry-picking data, among other reasons. The case went to arbitration in December. 

On the other hand, some employees are starting to sue their employers for not fulfilling their fiduciary duties, evident in the Johnson & Johnson case in which an employee sued the company for allegedly overpaying for prescription drugs through pharmacy benefit manager Express Scripts, leading to higher insurance premiums and out-of-pocket costs for employees.

“We have to get out of this box where we are the only ones who are being held responsible for things that other people are doing that are violating our ability to actually do our job [as fiduciary],” said Shawn Gremminger, president and CEO of the National Alliance of Healthcare Purchaser Coalitions.

Experts say there are steps employers can take to ensure they are fulfilling their fiduciary duties, however. And some are calling for legislation to make sure employers aren’t the only ones held responsible.

The lawsuits

Since the Employee Retirement Income Security Act  (ERISA) was established in 1974, self-funded employers have had a fiduciary duty to their employees. Then the Consolidated Appropriations Act of 2021 gave employers better access to their claims data so they can make sure they are meeting their fiduciary responsibilities.

The law says that employers can’t enter into an agreement with a third party administrator that would limit their access to its own claims data, Chris Deacon, founder of VerSan Consulting, previously told MedCity News.

“What it does is it inherently recognizes that the claims data is the employer’s and it says you can’t contract with a party that limits your access to that data,” Deacon said. “The onus is really on the employer to make sure that they’re not party to such agreements. The implication there is very direct that the employer has an obligation and responsibility to be looking at that data … to make sure that they’re spending their plan assets prudently.”

However, despite the law saying the data is the employer’s, third party administrators aren’t always giving them full access. This is what allegedly happened in the Kraft Heinz/Aetna case. Kraft Heinz made a formal request of Aetna for its medical claims data, but Aetna gave the company “some self-selected and edited medical claims data for 2016 through part of 2022,” according to the complaint. The data was missing information on the actual payments to providers, prior authorization number and type, and coverage beginning and termination dates, among other things.

The parties agreed to take the case to arbitration, meaning it will be settled without going to court. Ultimately, the results of the case won’t be publicly known, Deacon said this week.

While this case went to arbitration, new cases have been filed, according to Deacon. In a lawsuit filed in May, W.W. Grainger alleged that Aetna “abused its authority to enrich itself to Grainger’s detriment,” according to the complaint. The plaintiff also contends that Aetna “engaged in active deception to conceal its breaches of its duties to the Plans,” including preventing Grainger from accessing its data.

Employers need access to this data to understand which benefits will have the greatest ROI for their members’ healthcare dollars, according to Gremminger. He noted that with the volume of claims TPAs are managing, they will sometimes miss cost savings “no matter how hard they try.” And considering it’s the self-funded employer and not the TPA that would be held accountable for these oversights, it’s “imperative that the employer have access to sufficient data to provide an additional layer of oversight,” he said.

It’s not just TPAs that employers are struggling with. Employers are also facing challenges with their brokers and consultants, who employers often rely on for advice because they’re not healthcare experts. Sometimes PBMs and TPAs give consultants and brokers financial incentives to direct employers to their companies, Deacon declared. 

“If you’re a mid-sized employer, small-sized employer, your HR department is probably going to heavily rely on the expertise of a third party broker and consultant because your internal HR department just doesn’t have the capacity to become a healthcare claims expert or an actuary,” Deacon said. “So they rely on these brokers and consultants in my opinion, blindly, oftentimes.” 

And those consultants may not always have employers’ best interests at heart.

The biggest shift since the Kraft Heinz case is employees starting to sue their employers for breach of fiduciary duty, Deacon said. In the Johnson & Johnson case, Plaintiff Ann Lewandowski filed the suit in February alleging that the company breached its “fiduciary duties and mismanaged Johnson and Johnson’s prescription-drug benefits program, costing their ERISA plans and their employees millions of dollars in the form of higher payments for prescription drugs, higher premiums, higher deductibles, higher coinsurance, higher copays, and lower wages or limited wage growth,” according to the complaint.

Getting sued by employees while also not having access to data is putting employers in a frustrating position, Gremminger argued.

“We are the ones who are supposed to act as a fiduciary,” he said. “If we don’t have access to the data we need to have as a fiduciary, we’re the ones who get sued, not necessarily the third party administrator who was withholding the information.”

Another employer expert echoed Gremminger’s comments.

“I’m really concerned that it’s the employer as fiduciary that’s going to get in trouble,” said Cheryl Larson, president and CEO of the Midwest Business Group on Health, in an interview. “It’s like the government threw them under the bus because they couldn’t have an impact on the other stakeholders, they couldn’t get them to move. … I am shocked that the hospitals and the carriers and the TPAs and the benefits consultants have all dug their feet in because it’s gonna affect their bottom line. And it’s unethical, what they’re doing. It’s egregious.”

What employers can do

Employers need to start asking questions and launch investigations into their brokers and TPAs, Deacon said.

“The question will be, are you going to be on the receiving end of that complaint? And if you don’t want to be on the receiving end of that complaint, you need to begin to do things differently,” she said. “That is going to be very uncomfortable and not easy, but possible. It is often going to take a willingness to move a carrier or a partner you’ve been with for 20-plus years.”

For example, employers can ask why a benefits consultant recommended a particular PBM, according to a checklist by Jonathan Levitt, founding partner of Frier Levitt, that was shared with MedCity News. Employers can also have a “no conflict of interest” pledge with their benefits consultant.

Gremminger agreed with this, saying it’s best to eliminate brokers and TPAs with clear conflicts of interest. And if the employer can’t eliminate these players, then they at least have to know what the conflicts of interest are so they can mitigate them.

He also recommended creating a fiduciary committee that can help from a legal standpoint and make sure nobody is doing anything “untoward.” In addition, employers should invest in internal and external resources to better understand their data.

“You can have all the information in the world, but if you don’t actually have somebody who is digging through the literal reams of information across all of your different benefits, you’re not really going to be able to fulfill your obligation,” he said. “Invest in hiring a data scientist, whether that’s somebody you hire internally, or whether you hire another person.”

And in the case of a TPA or carrier withholding data, employers “have to have a paper trail showing they tried” to get the data, Larson added. When conducting an audit into their TPA or PBM, employers should also make sure to use an outside auditor rather than one connected to the TPA or PBM.

Beyond the employer

There are some bills that are trying to fix these issues, according to Deacon. She’s a proponent of the Health Care Prices Revealed and Information to Consumers Explained Transparency Act.

“It actually sets forth the format in which the claims data would have to be made available and the frequency. That would be most helpful to not only big employers, but small and mid,” she said. “Once these things become standardized, they could really leverage the power of technology to be able to analyze claims data without having to have a team of data scientists on their staff.”

Gremminger would also like to see ERISA changed to clarify that TPAs and PBMs also have a fiduciary responsibility to self-funded health plans.

“It’s not a complete silver bullet, but we think it would go a long way, and certainly give us a stronger grounding if we see a PBM that is … encouraging higher list prices and then taking a big rebate and holding on to it,” he said. “That’s clearly not to our benefit. We think it’d be much easier for us to then sue the PBM and say, ‘You’re a fiduciary, it’s in the law, this is clearly not to our benefit.’”

There is also the Lower Costs, More Transparency Act, which asks a lot of questions about who the fiduciary is and who owns the data, Deacon said. However, she isn’t in full agreement with this bill.

“I remain concerned that asking the question throws it into doubt,” she said. “It shouldn’t be a question. An employer’s data and their employees’ data should be their property and their asset.”

Photo: Natali_Mis, Getty Images