Reports must follow health privacy rules and carry only summary health information
What the document says“shall ensure that such report contains only summary health information, as defined in section 164.504(a) of title 45, Code of Federal Regulations (or successor regulations).”
The reports must follow the privacy regulations under section 13402(a) of the Health Information Technology for Economic and Clinical Health Act and under the Health Insurance Portability and Accountability Act of 1996, and must contain only summary health information. Nothing in the section changes those regulations or affects other federal or state privacy or civil rights laws. A plan receiving a report may disclose it only to the entity that sent it or that entity's business associates.
What the document actually says“shall ensure that such report contains only summary health information, as defined in section 164.504(a) of title 45, Code of Federal Regulations (or successor regulations).”
The report may hold only one kind of health data. It is the summary kind, as named in a rule about privacy.
The report is about money, not about who was sick. Health privacy rules still apply to all of it.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.