Relating to an insurer's responsibility to review and audit a third-party administrator.

Contracts

Critical Action: Review all TPA Master Services Agreements (MSAs).

• Remove "On-Site" Clauses: If your current contracts mirror the old statute and explicitly mandate "on-site" visits, you are contractually bound to travel even though the law no longer requires it. Execute amendments to permit "remote or virtual" audits.
• Access Rights: Insert clauses guaranteeing remote access to TPA systems, secure file transfer protocols, and API integrations necessary for digital verification.

Hiring/Training

• IT Security Training: Compliance staff conducting audits must be trained on secure remote access protocols (VPNs, encrypted portals) to ensure HIPAA and state privacy compliance during data transfer.
• Audit Methodology: Auditors must transition from physical inspection techniques to digital forensics. Training should focus on verifying data integrity without physical file access.

Reporting & Record-Keeping

• Digital Audit Trails: You must replace travel receipts and physical sign-in logs with digital access logs. Retain metadata and system logs proving that your auditors actively accessed and reviewed TPA files independently.
• Semiannual vs. Biennial: Maintain a clear documentation distinction between the mandatory *semiannual review* and the *biennial audit*. Without the physical visit, your records must demonstrate that the biennial audit is significantly more rigorous than the routine review.

Fees & Costs

• Budget Reduction: Eliminate travel and accommodation budgets for TPA audits scheduled after September 1, 2025.
• Reimbursement Negotiation: If your TPA contracts require the TPA to reimburse audit travel costs, expect TPAs to negotiate these clauses out of future renewals.