; or (D) restricts other group health plans or health insurance issuers not party to the contract, from paying a lower rate for items or services than the contracting plan or issuer pays for such items or services. (2) Additional requirement for self-insured plans A self-insured group health plan shall not enter into an agreement with a provider, network or association of providers, third-party administrator, or other service provider offering access to a network of providers if such agreement, directly or indirectly requires the group health plan to certify, attest, or otherwise confirm in writing that the group health plan is bound by the terms of the contract between the service provider and a third-party administrator that the group health plan is not party to and is not allowed to review. (3) Exception for certain group model issuers Paragraph (1)(A) shall not apply to a group health plan or a health insurance issuer offering group or individual health insurance coverage with respect to a health maintenance organization (as defined in section 2791(b)(3)) if such health maintenance organization operates primarily through exclusive contracts with multi-specialty physician groups, nor to any arrangement between such a health maintenance organization and its affiliates. (4) Attestation A group health plan or a health insurance issuer offering group or individual health insurance coverage shall annually submit to, as applicable, the applicable authority described in section 2723 or the Secretary of Labor, an attestation that such plan or issuer is in compliance with the requirements of this subsection. (c) Maintenance of existing HIPAA, GINA, and ADA protections Nothing in this section shall modify, reduce, or eliminate the existing privacy protections and standards provided by reason of State and Federal law, including the requirements of parts 160 and 164 of title 45, Code of Federal Regulations (or any successor regulations). (d) Regulations The Secretary, in coordination with the Secretary of Labor and the