# Medicare Program; Contract Year 2016 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2015-02671 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** February 12, 2015 - **Citation:** 80 FR 7912 ## Text Department of Health and Human Services Centers for Medicare & Medicaid Services 42 CFR Parts 417, 422, and 423 [CMS-4159-F2] RIN 0938-AS20 Medicare Program; Contract Year 2016 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS. ACTION: Final rule. SUMMARY: This final rule amends the Medicare Advantage (MA) program (Part C) regulations and Medicare Prescription Drug Benefit Program (Part D) regulations to implement statutory requirements; improve program efficiencies; strengthen beneficiary protections; clarify program requirements; improve payment accuracy; and make various technical changes. Additionally, this rule finalizes two technical changes that reinstate previously approved but erroneously removed regulation text sections. DATES: This rule is effective March 16, 2015, except amendments to § 423.154, which are effective January 1, 2016. Applicability Dates: Except as specified in Table 1, the applicability date of these provisions is January 1, 2016. In the Supplemental section of this final rule, we provide a table (Table 1) that lists changes in this final rule that have either an effective date other than March 16, 2015 or an applicability date other than January 1, 2016, for Contract Year 2016. FOR FURTHER INFORMATION CONTACT: Christopher McClintick, (410) 786-4682, Part C issues. Marie Manteuffel, (410) 786-3447, Part D issues. Kristy Nishimoto, (206) 615-2367, Part C and D enrollment and appeals issues. Whitney Johnson, (410) 786-0490, Part C and D payment issues. Joscelyn Lissone, (410) 786-5116, Part C and D compliance issues. SUPPLEMENTARY INFORMATION: The majority of the provisions listed in this rule are intended for implementation for contract year 2016. Changes in the Code of Federal Regulations (CFR) will be consistent with the effective date of the applicable provision. Table 1 lists those provisions with effective dates other than 30 days after the date of publication of this final rule or applicability dates other than January 1, 2016 for contract year 2016. The applicability and effective dates are discussed in the preamble for each of these items. Table 1—Applicability and Effective Dates of Select Provisions of the Final Rule Preamble section Section title Effective date Applicability date II.A.2. Enrollment Eligibility for Individuals Not Lawfully Present in the United States (§§ 417.2, 417.420, 417.422, 417.460, 422.1, 422.50, 422.74, 423.1, 423.30, and 423.44) June 1, 2015. II.A.5. Efficient Dispensing in Long-Term Care Facilities and Other Changes (§ 423.154) January 1, 2016 Table of Contents I. Executive Summary and Background A. Executive Summary 1. Purpose 2. Summary of the Major Provisions a. Changes To Audit and Inspection Authority (§§ 422.503(d)(2), 423.504(d)(2)) b. Enrollment Eligibility for Individuals Not Lawfully Present in the United States (§§ 417.2, 417.420, 417.422, 417.460, 422.1, 422.50, 422.74, 423.1, 423.30, 423.44) c. Business Continuity for MA Organizations & PDP Sponsors (§§ 422.504(o) and 423.505(p)) d. Efficient Dispensing in Long Term Care Facilities and Other Changes (§ 423.154) 3. Summary of Costs and Benefits B. Background 1. General Overview and Regulatory History 2. Issuance of the Proposed Rule 3. Public Comments Received in Response to the Contract Year 2015 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs Proposed Rule II. Provisions of the Proposed Regulations A. Clarifying Various Program Participation Requirements 1. Changes to Audit & Inspection Authority (§§ 422.503(d)(2), 423.504(d)(2)) 2. Enrollment Eligibility for Individuals Not Lawfully Present in the United States (§§ 417.2, 417.420, 417.422, 417.460, 422.1, 422.50, 422.74, 423.1, 423.30, 423.44) 3. Part D Notice of Changes (§ 423.128(g)) 4. Business Continuity for MA Organizations & PDP Sponsors (§§ 422.504(o), 423.505(p)) 5. Efficient Dispensing in Long Term Care Facilities and Other Changes (§ 423.154) 6. Medicare Coverage Gap Discount Program and Employer Group Waiver Plans (§ 423.2325) 7. Transfer of TrOOP Between PDP Sponsors Due To Enrollment Changes During the Coverage Year (§ 423.464) 8. Expand Quality Improvement Program Regulations (§ 422.152) B. Improving Payment Accuracy 1. Determination of Payments (§ 423.329) 2. Reopening (§ 423.346) 3. Payment Appeals (§ 423.350) 4. Payment Processes for Part D Sponsors (§ 423.2320) 5. Risk Adjustment Data Requirements—Proposal Regarding Annual Deadline for MAO Submission of Final Risk Adjustment Data (§ 422.310 (g)(2)(ii)) C. Strengthening Beneficiary Protections 1. MA-PD Coordination Requirements for Drugs Covered Under Parts A, B, and D (§ 422.112) 2. Good Cause Processes (§§ 417.460, 422.74, 423.44) 3. MA Organizations' Extension of Adjudication Timeframes for Organization Determinations and Reconsiderations (§§ 422.568, 422.572, 422.590, 422.618, 422.619) D. Strengthening Our Ability To Distinguish Stronger Applicants for Part C and D Program Participation and To Remove Consistently Poor Performers 1. Two-Year Prohibition When Organizations Terminate Their Contracts (§ 422.502, § 422.503, § 422.506, § 422.508, § 422.512) 2. Withdrawal of Stand-Alone Prescription Drug Plan Bid Prior to Contract Execution (§ 423.503) 3. Essential Operations Test Requirement for Part D (§ 423.503(a) and (c), § 423.504(b)(10), § 423.505(b)(28), § 423.509) E. Implementing Other Technical Changes 1. Requirements for Urgently Needed Services (§ 422.113) 2. Agent and Broker Training and Testing Requirements (§§ 422.2274, 423.2274) 3. Deemed Approval of Marketing Materials (§§ 422.2262, 422.2266, 423.2262, 423.2266) 4. Cross-Reference Change in the Part C Disclosure Requirements (§ 422.111) 5. Managing Disclosure and Recusal in P&T Conflicts of Interest (§ 423.120(b)(1)) 6. Thirty-Six Month Coordination of Benefits (COB) Limit (§ 423.466(b)) 7. Application and Calculation of Daily Cost-Sharing Rates (§ 423.153) 8. Technical Change To Align Regulatory Requirements for Delivery of Standardized Pharmacy Notice (§ 423.562) 9. MA Organization Responsibilities in Disasters and Emergencies (§ 422.100) 10. Technical Changes To Align Part C and Part D Contract Determination Appeal Provisions (§§ 422.641, 422.644) 11. Technical Changes To Align Parts C and D Appeal Provisions (§§ 422.660, 423.650) 12. Technical Change to the Restrictions on Use of Information Under Part D (§ 423.322) 13. Technical Changes to Regulation Text at § 423.104—Requirements Related to Qualified Prescription Drug Coverage 14. Technical Changes to Regulation Text at § 423.100—Definition of Supplemental Benefits III. Collection of Information Requirements A. ICRs Related to Eligibility of Enrollment for Individuals Not Lawfully Present in the United States (§§ 417.2, 417.420, 417.422, 417.460, 422.1, 422.50, 422.74, 423.1, 423.30, and 423.44) B. ICRs Related to Good Cause Processes (§§ 417.460, 422.74, 423.44) C. ICRs Related To Expanding Quality Improvement Program Regulations (§ 422.152) D. ICRs Related To Changes to Audit and Inspection Authority (§§ 422.503(d)(2) and 423.504(d)(2)) E. ICRs Related to Business Continuity for MA Organizations and PDP Sponsors (§§ 422.504(o) and 423.505(p)) F. Submission of PRA-Related Comments IV. Regulatory Impact Statement Regulations Text Acronyms ADS Automatic Dispensing System AHFS American Hospital Formulary Service AHFS-DI American Hospital Formulary Service-Drug Information AHRQ Agency for Health Care Research and Quality ANOC Annual Notice of Change AO Accrediting Organization ALR Assisted Living Residence BBA Balanced Budget Act of 1997 (Pub. L. 105-33) BBRA [Medicare, Medicaid and State Child Health Insurance Program] Balanced Budget Refinement Act of 1999 (Pub. L. 106-113) BIPA [Medicare, Medicaid, and SCHIP] Benefits Improvement Protection Act of 2000 (Pub. L. 106-554) BLA Biologics License Application BLS Bureau of Labor Statistics CAHPS Consumer Assessment Health Providers Survey CAP Corrective Action Plan CCIP Chronic Care Improvement Program CC/MCC Complication/Comorbidity and Major Complication/Comorbidity CCS Certified Coding Specialist CDC Centers for Disease Control CGDP Coverage Gap Discount Program CHIP Children's Health Insurance Programs CMP Civil Money Penalty CMR Comprehensive Medical Review CMS Centers for Medicare & Medicaid Services CMS-HCC CMS Hierarchal Condition Category CTM Complaints Tracking Module COB Coordination of Benefits CORF Comprehensive Outpatient Rehabilitation Facility CPC Certified Professional Coder CY Calendar Year DEA Drug Enforcement Administration DIR Direct and Indirect Remuneration DHS Department of Homeland Security DME Durable Medical Equipment DMEPOS Durable Medical Equipment, Prosthetic, Orthotics, and Supplies D-SNPs Dual Eligible SNPs DOL U.S. Department of Labor DUR Drug Utilization Review EAJR Expedited Access to Judicial Review EGWP Employer Group/Union-Sponsored Waiver Plan EOB Explanation of Benefits EOC Evidence of Coverage ESRD End-Stage Renal Disease FACA Federal Advisory Committee Act FDA Food and Drug Administration FDR First-tier, Downstream, and Related Entities FEHBP Federal Employees Health Benefits Plan FFS Fee-For-Service FIDE Fully-integrated Dual Eligible FIDE SNPs Fully-integrated Dual Eligible Special Needs Plans FMV Fair Market Value FY Fiscal Year GAO Government Accountability Office HAC Hospital-Acquired Conditions HCPP Health Care Prepayment Plans HEDIS HealthCare Effectiveness Data and Information Set HHS [U.S. Department of] Health and Human Services HIPAA Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191) HMO Health Maintenance Organization HOS Health Outcome Survey HPMS Health Plan Management System ICFs/IID Intermediate care facilities for the mentally retarded ICL Initial Coverage Limit ICR Information Collection Requirement ID Identification IMD Institutes for mental disease IT Information Technology I/T/U Pharmacies Indian Health Service, Tribes and Tribal organizations, and urban Indian organizations (collectively referred to as “I/T/U”). IVC Initial Validation Contractor LCD Local Coverage Determination LEP Late Enrollment Penalty LIS Low-Income Subsidy LPPO Local Preferred Provider Organization LTC Long Term Care MA Medicare Advantage MAAA Member of the American Academy of Actuaries MA-PD Medicare Advantage-Prescription Drug Plan MCO Managed Care Organization MIPPA Medicare Improvements for Patients and Providers Act of 2008 (Pub. L. 110-275) MOC Medicare Options Compare MOOP Maximum Out-of-Pocket MPDPF Medicare Prescription Drug Plan Finder MMA Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 108-173) MS-DRG Medicare Severity Diagnosis Related Group MSA Metropolitan Statistical Area MSAs Medical Savings Accounts MSP Medicare Secondary Payer MTM Medication Therapy Management MTMP Medication Therapy Management Program NAIC National Association of Insurance Commissioners NCPDP National Council for Prescription Drug Programs NCQA National Committee for Quality Assurance NDA New Drug Application NDC National Drug Code NGC National Guideline Clearinghouse NIH National Institutes of Health NOMNC Notice of Medicare Non-Coverage NPI National Provider Identifier OES Occupational Employment Statistics OIG Office of Inspector General OMB Office of Management and Budget OPM Office of Personnel Management OTC Over the Counter PACE Programs of the All-Inclusive Care for the Elderly Part C Medicare Advantage Part D Medicare Prescription Drug Benefit Program Part D IRMAA Part D Income Related Monthly Adjustment Amount PBM Pharmacy Benefit Manager PDE Prescription Drug Event PDP Prescription Drug Plan PFFS Private Fee For Service Plan POA Present on Admission (Indicator) POS Point-of-Sale PPO Preferred Provider Organization PPS Prospective Payment System P&T Pharmacy & Therapeutics QRS Quality Review Study PACE Programs of All Inclusive Care for the Elderly PRWORA Personal Responsibility and Work Opportunity Reconciliation Act of 1996 RADV Risk Adjustment Data Validation RAC Recovery Audit Contractor RAPS Risk Adjustment Payment System RPPO Regional Preferred Provider Organization RTO Return to Operations/Recovery Time Objective SBA Small Business Association SCORM Sharable Content Object Reference Model SEP Special Enrollment Period SHIP State Health Insurance Assistance Programs SNF Skilled Nursing Facility SNP Special Needs Plan SNP MOC Special Needs Plan Model of Care SPAP State Pharmaceutical Assistance Programs SSA Social Security Administration SSI Supplemental Security Income T&C Terms and Conditions TPA Third Party Administrator TrOOP True Out-Of-Pocket U&C Usual and Customary UPIN Uniform Provider Identification Number USP U.S. Pharmacopoeia ZPIC Zone Program Integrity Contractor I. Executive Summary and Background A. Executive Summary 1. Purpose The purpose of this final rule is to revise the Medicare Advantage (MA) program (Part C) regulations and Medicare Prescription Drug Benefit Program (Part D) regulations to implement statutory requirements, improve program efficiencies, strengthen beneficiary protections, clarify program requirements, improve payment accuracy, and make various technical changes for contract year 2016. 2. Summary of the Major Provisions a. Changes to Audit and Inspection Authority (§§ 422.503(d)(2), 423.504(d)(2)) We proposed three changes to our audit and inspection authority. Due to significant concerns raised during the public comment period, we are finalizing only two of those three proposals. First, under section 6408 of the Affordable Care Act, new authority was provided to the Secretary that now requires that each contract provide the right to “timely” inspection and audit. We are revising both §§ 422.503(d)(2) and 423.504(d)(2) to insert the word “timely” at the end of both of the introductory paragraphs. We are also adding language to §§ 422.503(d)(2) and 423.504(d)(2) that will allow us to require that a sponsoring organization hire an independent auditor, working in accordance with CMS specifications, to validate if the deficiencies that were found during a CMS full or partial program audit have been corrected and provide CMS with a copy of the audit findings. The proposal to require MA organizations and Part D plan sponsors to hire an independent auditor to conduct full or partial program audits will not be finalized. b. Enrollment Eligibility for Individuals Not Lawfully Present in the United States (§§ 417.2, 417.420, 417.422, 417.460, 422.1, 422.50, 422.74, 423.1, 423.30, 423.44) After consideration of the public comments, we are finalizing the policies mostly as proposed, with the exception of changes to the regulation text at §§ 417.422, 417.460, 422.50, 423.1, 423.3 and 423.44 to clarify that any individual not lawfully present is no longer eligible to remain enrolled in a cost, MA, or Part D plan, to establish the disenrollment effective date to be the first of the month following notice by CMS of ineligibility, and to delete the term “qualified alien.” Further, we are redesignating the current text at § 417.460(b)(2)(iv) as paragraph (b)(2)(v) and finalizing the provision establishing a lack of lawful presence as a basis for disenrollment from a cost plan at paragraph (b)(2)(iv). This provision is consistent with the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 (PRWORA) and with recommendations made by the Office of the Inspector General (OIG) in its January 2013 and October 2013 reports. c. Business Continuity for MA Organizations & PDP Sponsors (§§ 422.504(o) and 423.505(p)) To respond to concerns raised during the comment period, we revised the regulation text by providing a 72, rather than 24 hour, restoration time period for MA organizations and Part D sponsors after a systems failure. We also revised text as necessary to make clear that we require MA organizations and sponsors to “plan to” restore essential functions within the 72-hour time period, rather than guarantee complete restoration within the timeframe. Some commenters thought our intent was to require continuous operations under all conditions, and we revised language from the proposed regulation to make clear that that was not the case in our final rule. Lastly commenters distinguished between Part C and D operations and noted, for instance, that provider payments are not a 24-hour critical function for MA plans since payment is allowed to be made within 30 days and that health and safety would not be put at risk by failure of Part C claims processing and appeals processing. We removed language related to that requirement for MA plans. d. Efficient Dispensing in Long Term Care Facilities and Other Changes (§ 423.154) We are finalizing changes to the rule requiring efficient dispensing to Medicare Part D enrollees in long term care (LTC) facilities. Some Part D sponsors (or their pharmacy benefit managers) implemented the short-cycle dispensing requirement by pro-rating monthly dispensing fees, which penalize the offering and adoption of more efficient LTC dispensing techniques compared to less efficient LTC dispensing techniques. This is because when a medication is discontinued before a month's supply has been dispensed, a pharmacy that dispenses the maximum amount of the medication at a time permitted under § 423.154 (which is 14 days' supplies), collects more in dispensing fees than a pharmacy that utilizes dispensing techniques that result in less than maximum quantities being dispensed at a time. In other words, a less efficient pharmacy collects more in dispensing fees than a more efficient pharmacy. This is contrary to the Congress' intent in enacting section 3310 of the Affordable Care Act, which is to reduce medication waste. Therefore, we have finalized a prohibition on payment arrangements that penalize the offering and adoption of more efficient LTC dispensing techniques by prorating dispensing fees based on days' supply or quantity dispensed. We have also finalized a requirement to ensure that any difference in payment methodology among LTC pharmacies incentivizes more efficient dispensing techniques. Other changes to the rule requiring efficient dispensing to Medicare Part D enrollees in LTC facilities are eliminating language that has been misinterpreted as requiring the proration of dispensing fees and making a technical change to the requirement that Part D sponsors report on the nature and quantity of unused brand and generic drugs. We are not finalizing an additional waiver for LTC pharmacies using restock and reuse dispensing methodologies under certain conditions at this time. 3. Summary of Costs and Benefits Table 2—Summary of Costs and Benefits Provision Total costs Transfers Changes to Audit and Inspection We estimate that this change would require an annual cost of $2 million for the time and effort for all MA organizations or Part D sponsors with audit results that reveal noncompliance with CMS requirements to hire independent auditors to validate that correction has occurred. The total cost for 2015-2019 is estimated to be $10 million Eligibility of enrollment for individuals not lawfully present in the U.S N/A We estimate that this change could save the MA program up to $5 million in 2015, increasing to $8 million in 2019 (total of $32 million over this period), and could save the Part D program (includes the Part D portion of MA-PD plans) up to $5 million in 2015, increasing to $9 million in 2019 (total of $35 million over this period). Business Continuity Operations We estimate that this change would require a first year cost of $8 million in 2015, for the time and effort for affected organizations to comply with the business continuity requirements. In subsequent years, 2016-2019, the cost for maintaining the business continuity is estimated to be $4 million. The total cost over the period 2015-2019 is estimated to be $24 million B. Background 1. General Overview and Regulatory History The Balanced Budget Act of 1997 (BBA) (Pub. L. 105-33) created a new “Part C” in the Medicare statute (sections 1851 through 1859 of the Social Security Act (the Act)) which established what is now known as the MA program. The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173), enacted on December 8, 2003, added a new “Part D” to the Medicare statute (sections 1860D-1 through 42 of the Act) entitled the Medicare Prescription Drug Benefit Program (Part D), and made significant changes to the existing Part C program, which it named the Medicare Advantage (MA) Program. The MMA directed that important aspects of the Part D program be similar to, and coordinated with, regulations for the MA program. Generally, the provisions enacted in the MMA took effect January 1, 2006. The final rules implementing the MMA for the MA and Part D prescription drug programs appeared in the Federal Register on January 28, 2005 (70 FR 4588 through 4741 and 70 FR 4194 through 4585, respectively). Since the inception of both Parts C and D, we have periodically revised our regulations either to implement statutory directives or to incorporate knowledge obtained through experience with both programs. For instance, in the September 18, 2008 and January 12, 2009 Federal Register (73 FR 54226 and 74 FR 1494, respectively), we issued Part C and D regulations to implement provisions in the Medicare Improvement for Patients and Providers Act (MIPPA) (Pub. L. 110-275). We promulgated a separate interim final rule on January 16, 2009 (74 FR 2881) to address MIPPA provisions related to Part D plan formularies. In the final rule that appeared in the April 15, 2010 Federal Register (75 FR 19678), we made changes to the Part C and D regulations which strengthened various program participation and exit requirements; strengthened beneficiary protections; ensured that plan offerings to beneficiaries included meaningful differences; improved plan payment rules and processes; improved data collection for oversight and quality assessment; implemented new policies; and clarified existing program policy. In a final rule that appeared in the April 15, 2011 Federal Register (76 FR 21432), we continued our process of implementing improvements in policy consistent with those included in the April 2010 final rule, and also implemented changes to the Part C and Part D programs made by recent legislative changes. The Patient Protection and Affordable Care Act (Pub. L. 111-148), as amended by the Health Care and Education Reconciliation Act (Pub. L. 111-152) (collectively the Affordable Care Act or ACA) added a number of new Medicare provisions and modified many existing provisions. The Affordable Care Act included significant reforms to both the private health insurance industry and the Medicare and Medicaid programs. Provisions in the Affordable Care Act concerning the Part C and D programs largely focused on beneficiary protections, MA payments, and simplification of MA and Part D program processes. These provisions affected implementation of our policies regarding beneficiary cost-sharing, assessing bids for meaningful differences, and ensuring that cost-sharing structures in a plan are transparent to beneficiaries and not excessive. In the April 2011 final rule, we revised regulations on a variety of issues based on the Affordable Care Act and our experience in administering the MA and Part D programs. The rule covered areas such as marketing, including agent/broker training; payments to MA organizations based on quality ratings; standards for determining if organizations are fiscally sound; low income subsidy policy under the Part D program; payment rules for non-contract health care providers; extending current network adequacy standards to Medicare medical savings account (MSA) plans that employ a network of providers; establishing limits on out-of-pocket expenses for MA enrollees; and several revisions to the special needs plan requirements, including changes concerning SNP approvals. In a final rule that appeared in the April 12, 2012 Federal Register (77 FR 22072 through 22175), we made several changes to the Part C and Part D programs required by statute, including the Affordable Care Act, and made improvements to both programs through modifications reflecting experience we have obtained administering the Part C and Part D programs. Key provisions of that final rule implemented changes closing the Part D coverage gap, or “donut hole,” for Medicare beneficiaries who do not already receive low-income subsidies from us by establishing the Medicare Coverage Gap Discount Program. We also included provisions providing new benefit flexibility for fully-integrated dual eligible special needs plans, clarifying coverage of durable medical equipment, and combatting possible fraudulent activity by requiring Part D sponsors to include an active and valid prescriber National Provider Identifier on prescription drug event records. 2. Issuance of the Proposed Rule In the proposed rule titled “Contract Year 2015 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs,” which appeared in the January 10, 2014 Federal Register (79 FR 1918), we proposed to revise the MA program (Part C) regulations and Medicare Prescription Drug Benefit Program (Part D) regulations to implement statutory requirements; strengthen beneficiary protections; improve program efficiencies; and clarify program requirements. The proposed rule also included several provisions designed to improve payment accuracy. 3. Public Comments Received in Response to the Contract Year 2015 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs Proposed Rule We received approximately 7,600 timely pieces of correspondence containing multiple comments on the CY 2015 proposed rule. The majority of correspondence received was in reference to provisions that were either finalized in the final rule that appeared in the Federal Register on May 23, 2014 (79 FR 29844) (May 2014 final rule) or that will not be finalized. While we are finalizing in whole or in part approximately 30 of the provisions from the proposed rule in this final rule, there remain a small number of provisions from the proposed rule that were not finalized in the May 2014 final rule and that we are not finalizing in this rule. These provisions are listed later in this section in Table 2. Public comments on the provisions finalized in this rule were submitted between January 10, 2014 and March 7, 2014. We note that some of the public comments were outside of the scope of the proposed rule provisions that we are finalizing here. These out-of-scope public comments are not addressed in this final rule. Summaries of the public comments that are within the scope of the proposed rule and our responses to those public comments are set forth in the various sections of this final rule under the appropriate heading. However, we note that in this final rule we are not addressing comments received with respect to the provisions of the proposed rule that we are not finalizing. Table 2—Provisions Not Being Finalized Proposed Rule January 10, 2014 Federal Register (79 FR 1918), section Topic Clarifying Various Program Participation Requirements III.A.2 Two-year Limitation on Submitting a New Bid in an Area Where an MA has been Required to Terminate a Low-enrollment MA Plan (§ 422.504(a)(19)). III.A.9 Collections of Premiums and Cost Sharing (§ 423.294). III.A.12 Separating the Annual Notice of Change (ANOC) from the Evidence of Coverage (EOC) (§ 422.111(a)(3) and 423.128(a)(3)). III.A.14 Exceptions to Drug Categories or Classes of Clinical Concern (§ 423.120(b)(2)(vi)). III.A.15 Medication Therapy Management Program (MTMP) under Part D (§ 423.153(d)(1)(v)(A))—outreach strategies. III.A.23 Medicare Coverage Gap Discount Program and Employer Group Waiver Plans (§ 423.2325)—disclosure requirement for Part D sponsors. III.A.26 Payments to PDP Plan Sponsors For Qualified Prescription Drug Coverage (§ 423.308) and Payments to Sponsors of Retiree Prescription Drug Plans (§ 423.882). III.A.38 Authorization of Expansion of Automatic or Passive Enrollment Non-Renewing Dual Eligible SNPs (D-SNPs) to another D-SNP to Support Alignment Procedures (§ 422.60). Strengthening Beneficiary Protections III.C.1 Providing High Quality Health Care (§ 422.504(a)(3) and § 423.505(b)(27)). III.C.4 Definition of Organization Determination (§ 422.566). Strengthening our Ability To Distinguish Stronger Applicants for Part C and D Program Participation and To Remove Consistently Poor Performers III.D.4 Termination of the Contracts of Medicare Advantage Organizations Offering PDP for Failure for 3 Consecutive Years to Achieve 3 Stars on Both Part C and Part D Summary Star Ratings in the Same Contract Year (§ 422.510). Implementing Other Technical Changes III.E.2 Skilled Nursing Facility Stays (§§ 422.101 and 422.102). II. Provisions of the Proposed Regulations and Analysis of and Responses to Public Comments A. Clarifying Various Program Participation Requirements 1. Changes to Audit and Inspection Authority (§§ 422.503(d)(2), 423.504(d)(2)) Sections 1857(d)(2)(A) and 1860D-12(b)(3)(C) of the Act specify that each contract under these sections must state that CMS has the right to audit and inspect the facilities and records of each organization. We proposed three changes to our audit and inspection authority. First, under section 6408 of the Affordable Care Act, new authority was provided to the Secretary that now requires that each contract provide the right to “timely” inspection and audit. We proposed to revise both §§ 422.503(d)(2) and 423.504(d)(2) to reflect this change. Specifically, we proposed to insert the word “timely” at the end of both of the introductory paragraphs for §§ 422.503(d)(2) and 423.504(d)(2). We also proposed to add language to §§ 422.503(d)(2) and 423.504(d)(2) that will allow us to require an MA organization or Part D plan sponsor to hire an independent auditor, working in accordance with CMS specifications, to perform full or partial program audits to determine compliance with CMS requirements and provide to CMS an attestation affirming that the audit has been completed as required. Lastly, we proposed to add language to §§ 422.503(d)(2) and 423.504(d)(2) that would allow us to require that a sponsoring organization hire an independent auditor, working in accordance with CMS specifications, to validate if the deficiencies that were found during a CMS full or partial program audit have been corrected and provide CMS with a copy of the audit findings. We received the following comments and our responses follow: Comment: Some commenters requested that CMS define “timely” as it is being added to § 422.503(d)(2) and § 423.504(d)(2) and that CMS define the existing language from paragraph (2) in that same section, specifically: “when there is reasonable evidence for some need for such inspection.” Response: We are following the exact working of the statute in adding the word “timely” to our current audit and inspection authority. We believe that the Congress recognized that what would be considered “timely” is based on a reasonableness standard that may change based on the specific circumstances leading up to the audit. For example, we currently give sponsors 4-weeks notice prior to the start of a routine program audit and we do not envision this change altering that practice. However, if we were to become aware of a situation where beneficiaries' health or safety may be at risk based on a plan's poor performance, we will reserve the right to request records or any needed documentation in an expedited fashion. Therefore, we will not put restrictions on the broadly stated statutory language and believe that this is in line with the spirit and intent of the statutory change. Similarly, the language in paragraph (2) in that same section is not a change, but existing language from our regulations. Again, we believe that the wording is appropriate and does not require additional definition or explanation. Comment: One commenter suggested we utilize the NCPDP audit standard as a means of standardizing audit communications. Response: We appreciate the commenter's suggestion and believe this would be a more appropriate approach if our audits largely focused on claim level audits between MA and Part D organizations and the providers or entities they pay. However, program audits cover a wide range of our program areas and corresponding programmatic requirements, many of which go well beyond claim determinations. We have received positive feedback from MA and Part D organizations in the past regarding the level of detail and useful information and feedback in our audit reports, which sponsors rely upon as they work towards implementing any necessary corrective actions. By limiting the communication to the codes and auditing standards used by NCPDP, we believe that—(1) many of our findings would not be adequately covered by these standards; and (2) they would not provide enough detail in many cases to allow for an organization to undertake meaningful correction. Comment: A commenter suggested that CMS specify that the same organization that performed the audit also perform the validation in order to ensure consistency in interpretation and try to keep costs down, or at the very least require at least one member from the original audit team be a member of the validation team. Response: We will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing the proposal that we may require an organization to hire an independent auditor to validate correction of audit deficiencies. We will consider the recommendation to include a member from the original audit team in any validation activities whether they be performed by CMS internally or by an independent auditor hired by the MA or Part D organization at CMS' request. Comment: Some commenters' requested if CMS would set a time limit in which audits must be completed or conducted. Response: We will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing our proposal that we may require an organization to hire an independent auditor to validate correction of audit deficiencies. We will establish a timeframe in subregulatory guidance based on our current internal validation audit timeline. However, we recognize that some correction activities require more time than others, we will reserve the right to alter those timelines for deficiencies that we believe—(1) a more immediate correction is warranted due to the potential for beneficiary harm; or (2) require a longer correction timeline due to the technical or difficult nature of correction (for example, rebuilding or completely restructuring systems infrastructure). Comment: A commenter requested if CMS would pay for the cost to hire an independent auditor. Response: Our proposal was that an MA or Part D organization would retain the independent auditing firm to conduct the audit, but that the plan could account for the costs in their bid. However, we will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing our proposal that we may require an organization to hire an independent auditor to validate correction of audit deficiencies. Comment: Some commenters requested that CMS cap fees that independent audit firms would charge MA and Part D organizations to perform program audits. Response: If we decide to pursue this proposal in the future, we will explore our ability to cap the costs of performing these audit activities. Comment: Many commenters suggested that instead of requiring MA and Part D organizations to hire independent auditors to expand the number of audits conducted each year that we look to the various other compliance and monitoring activities the Agency engages in, which could be used to better target audits or results could be utilized in lieu of audit activities. Response: We do utilize the data and information obtained about sponsor performance to target our audit efforts as part of the overall risk assessment used to select sponsors for audit. We have also utilized data and information from our various monitoring efforts to assist in determining if certain deficiencies discovered during an audit may have been corrected (for example, if a sponsor had multiple deficiencies in a program area that will at a later date be the subject of a monitoring activity, we may use passing results from that monitoring activity as proof of correction). Comment: A commenter requested that CMS release the data driven elements of the risk assessment and define a sponsor who is high risk. Response: We believe that this comment is outside the scope of this final rule. However, we use a variety of existing data points from Medicare Star ratings, past performance and plan reported data, as a few examples, to develop our risk assessment. We focus on metrics that have the potential to affect beneficiary access to medications and services, and also look for operational metrics that program experience has demonstrated can cause contracting organizations to develop performance problems in core program areas (that is, large increases in enrollment over a short period of time). We do not release our risk assessment in its entirety, but these are the areas we focus on when conducting the analysis. Organizations should note that it is our goal to audit all organizations in the MA and Part D program, and the risk assessment is one way plans are selected for audit. Comment: Some commenters raised concerns over their available recourse if they disagreed with an independent auditor's findings, given the impact on Medicare Star ratings and past performance. Response: We will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing the proposal that we may require an organization to hire an independent auditor to validate correction of audit deficiencies. Validation results have no impact on Medicare Star ratings or past performance. However, we stated in the proposal that organizations would have an opportunity to rebut audit findings, this would include during validation efforts, and CMS would be reviewing both draft and final reports from the independent auditor. Therefore, we would give organizations an avenue to dispute findings or policy interpretations that organizations believed to be erroneous, even in the more limited use of an independent auditor to validate correction of deficiencies. Comment: A commenter stated that our proposal did not clarify how organizations hiring an independent auditor to conduct full or partial program audits would affect or involve the Zone Program Integrity Contractors (ZPICs) or the Recovery Audit Contractors (RACs). Response: The proposal to utilize an independent auditor to conduct full or partial program audits or validations has no impact on ZPICs or RACs, which is why they are not mentioned in our proposal. Comment: Several commenters suggested that CMS develop a core set of SNP auditors regardless of whether or not we implement our independent auditor proposal, given what the industry perceives as inexperienced or inconsistent SNP findings amongst auditors, which many SNPs believed would be aggravated if organizations were required to retain an independent audit firm. Some suggested that SNP auditors should be accredited by NCQA prior to being allowed to conduct SNP audits. Response: We believe that this is outside the scope of this proposal, but we thank the commenter for their suggestion to continue to strengthen the CMS MA and Part D audit program. We have conducted additional training and continue to welcome feedback on all of our audit processes and protocols. After the piloting of the SNP MOC protocols in 2013, we conducted specialized feedback sessions with organizations subject to SNP MOC audits and made changes to our protocols, methods of evaluation and training of auditors based on the industry's feedback. We welcome additional feedback and hope that organizations will see continual improvements in our audit processes in 2014 and future years. Comment: A commenter inquired if the independent auditor proposals applied to PACE organizations. Response: No, these proposals do not apply to PACE organizations. These regulatory provisions do not apply to PACE plans because we are only proposing changes to Parts 422 and 423 which govern MA, other Managed care plans, and Part D organizations. PACE plans are governed by the regulations in part 460. With respect to this change applying to cost plans, we select sponsors for audit at their parent organization level, and if they have an 1876 cost plan, that contract would be included in our audit. Therefore, the parent organization may be requested to hire an independent auditor to validate the correction of their audit deficiencies. However, if an organization was a standalone cost plan, with no MA or Part D contracts under parts 422 or 423, this requirement would not apply to those organizations, as cost plans are governed by part 417. Comment: A commenter suggested that CMS develop and implement a robust annual or biannual training program for independent auditors to ensure that they were competent to perform program audits properly. Response: We will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing the proposal that CMS may require an organization to hire an independent auditor to validate correction of audit deficiencies. We will consider this suggestion if we repropose the larger full scale use of independent auditors to conduct full or partial program audits in the future. We will also share whatever materials we have developed and can provide technical assistance if we request an organization to retain an independent auditor to validate correction of audit deficiencies. Comment: A commenter suggested that instead of requiring plans to hire an independent auditor we require plans to conduct a robust internal audit and share the results with CMS. Response: We will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing the proposal that CMS may require an organization to hire an independent auditor to validate correction of audit deficiencies. We currently require organizations to conduct internal auditing and monitoring as part of having an effective compliance program, which we believe for purposes of a healthy and robust compliance program, such activities are appropriate. Comment: A commenter recommended that much like CMS' use of independent auditors to conduct data validation audits, CMS should set criteria regarding who can conduct program audits. For example, the commenter suggested CMS clarify that organizations that currently assist plans with operations, compliance or consulting are disqualified from performing as independent auditors. Response: We will not be finalizing the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing the proposal that CMS may require an organization to hire an independent auditor to validate correction of audit deficiencies. We thank the commenter for their suggestion with respect to whom a contracting organization may retain to perform validation of correction of audit deficiencies. We will consider including any key criteria regarding who can perform these validations in subsequent subregulatory guidance. Comment: A few commenters questioned whether CMS has the statutory authority to require contracting organizations to retain an independent auditor to conduct full or partial program audits. These commenters raised many related issues, such as CMS trying to inappropriately expand their appropriation by requiring contracting organizations to bear the cost of hiring an audit firm to perform a function that the Congress has tasked CMS with performing. Other commenters stated that to the extent these funds expended by plans were later reimbursed by CMS through the bid process, it could implicate the Anti-Deficiency Act. Response: We will not finalize the proposal requiring organizations to hire an independent auditor to conduct full or partial program audits, but we are finalizing the proposal that we may require an organization to hire an independent auditor to validate correction of audit deficiencies. We do not agree that our proposal allowing us the option to request a plan sponsor to retain an independent auditor to verify that deficiencies that we determined existed during our audit have been corrected implicates the concerns that organizations previously raised regarding our current appropriation or statutory authority. The proposal simply mirrors our current authority where we may require organizations under sanction to retain an independent auditor to perform an independent review to validate that the deficiencies upon which the sanction was based have been corrected and are not likely to recur. After consideration of all of the comments received, we are finalizing our proposal to revise both §§ 422.503(d)(2) and 423.504(d)(2) to insert the word “timely” at the end of both of the introductory paragraphs for §§ 422.503(d)(2) and 423.504(d)(2), and our proposal to have the option to require contracting organizations who were found to have deficiencies during a CMS program audit to hire an independent auditor to validate correction of those deficiencies. However, based on the strong opposition and valid concerns raised by contracting organizations, we have decided at this time not to finalize our proposal to require plan sponsors to hire an independent auditor no less than every 3 years to conduct full or partial program audits. 2. Enrollment Eligibility for Individuals Not Lawfully Present in the United States (§§ 417.2, 417.420, 417.422, 417.460, 422.1, 422.50, 422.74, 423.1, 423.30, and 423.44) a. Basic Enrollment Requirements Sections 226 and 226A of the Act establish the conditions for Medicare Part A entitlement for individuals who have attained age 65, are disabled or have end stage renal disease (ESRD), and are entitled to monthly Social Security benefits under section 202 of the Act; individuals entitled to Part A under these sections do not have to pay premiums for such coverage, and they may, but are not required to, enroll in Medicare Part B. Section 1818 of the Act establishes the conditions for Medicare enrollment for individuals who are not entitled to Medicare Part A without a premium under sections 226 or 226A of the Act. Individuals must have Part B (under section 1836 of the Act) and must also meet citizenship or alien status requirements in order to purchase Part A hospital insurance under section 1818 of the Act; individuals covered under section 1836 of the Act must meet citizenship or alien status requirements, in addition to other requirements, in order to enroll in Part B if they are not entitled to premium-free Medicare under sections 226 or 226A. Sections 1851(a)(3)(B), 1860D 1(a)(3)(A), and 1876(a)(1)(A) of the Act outline the eligibility requirements to enroll in MA (Part C), Medicare prescription drug coverage (Part D), and Medicare cost plans. To be eligible for MA, Part D, or cost plan coverage, individuals must have active Medicare coverage. Specifically, to enroll in MA, an individual must be entitled to benefits under Part A and be enrolled in Part B; to enroll in Part D, an individual must be entitled to Part A and/or enrolled in Part B; to enroll in a Medicare cost plan, an individual must be enrolled in Part B (Part A entitlement is not required). b. Medicare Eligibility and Lawful Presence Section 401 of the PRWORA, amended by section 5561 of the Balanced Budget Act, limits the eligibility of individuals who are not qualified aliens to receive benefits under certain federal programs, including benefits under Title XVIII of the Act (Medicare); these provisions are codified at 8 U.S.C. 1611 and 1641. In general pursuant to 8 U.S.C. 1611(a), an alien who is not a qualified alien is not eligible to receive any federal public benefit. The Congress has established some exceptions to this general rule. One exception, at 8 U.S.C. 1611(b)(3), permits certain aliens to obtain Medicare benefits and applies to an alien who is: (1) Lawfully present in the United States, as determined by the Attorney General and (2) was authorized to be employed with respect to wages attributable to employment, which were counted for the purpose of determining Medicare entitlement under Part A 1 . An alien who is eligible under this exception is able to receive any benefit payable under Medicare. In contrast, an alien that is not lawfully present in the United States is not eligible to receive benefits under Medicare. 1 This includes qualified aliens. As a result, individuals meeting certain criteria are able to earn qualified credits towards Social Security retirement benefits as outlined in 8 U.S.C. 1631 (federal attribution of sponsor's income and resources to alien) and 8 U.S.C. 1645 (Qualifying quarters). Such individuals may earn the total number of qualified credits to be eligible under the Act to receive retirement benefits under sections 226 and 226A of the Act. However, should such individuals be unlawfully present in the United States, under PRWORA they are not eligible to receive the Social Security benefits they have earned for as long as they remain unlawfully present. When they are again lawfully present in the United States, or live outside the United States, they would regain eligibility to receive Social Security payments. Similarly, when those not lawfully present become eligible for Medicare based on age or disability under the Act, they would also automatically be entitled under the Act to premium free Part A benefits and be eligible under the Act to enroll in Part B during a valid enrollment period. Furthermore, if these same individuals were receiving Social Security retirement benefits 4 months prior to turning 65, or are in their 21st month of receiving Social Security disability benefits, they would also automatically be enrolled into both Part A and Part B, consistent with section 1837 of the Act and the enrollment process outlined in § 407.17. However, again under the PRWORA limitations previously discussed, payments for Medicare benefits cannot be made on behalf of these individuals as long as they are not lawfully present in the United States. Only upon becoming lawfully present would they become eligible to receive the Medicare benefits to which they would otherwise be entitled by paying into Social Security for the requisite number of quarters or paying premiums. We note that current regulations at §§ 406.28 and 407.27 outline the reasons for loss of premium Part A and Part B enrollment, and do not include the absence of lawful presence or citizenship as a reason for loss of entitlement. Similarly, individuals who are entitled to Part A and enrolled in Part B based on eligibility for Social Security benefits currently may be enrolled in Medicare even if they are not lawfully present in the United States. However, as previously outlined, Medicare benefits are not payable for individuals who are not lawfully present even if such individuals are enrolled in Medicare. Thus, there is a distinction between being “entitled to Part A” or “enrolled in Part B” as provided for in the Act and being eligible to receive the Part A and Part B benefits that ordinarily flow from such entitlement and enrollment. c. Alignment of MA, Part D, and Cost Plan Eligibility With Fee for Service (FFS) Payment Exclusion Policy In order to implement 8 U.S.C. 1611 and ensure that benefits are not incorrectly paid for individuals who are present in the United States unlawfully, the Social Security Administration (SSA) established internal policies and procedures to suspend Social Security benefits during periods in which individuals are not lawfully present in the United States. Because Medicare entitlement flows from entitlement to Social Security retirement and disability benefits, Medicare has also implemented this provision through its own payment exclusion process. Under Medicare's payment exclusion process, data on lawful presence are transmitted to CMS from the Department of Homeland Security (DHS) via regular data exchanges with SSA. Once the data are received by CMS, lawful presence status is noted on an individual's record and is retained in the FFS claims processing systems. As a result, payment of Part A and Part B claims for non-citizens is denied where lawful presence is not established on their record, and continues to be denied until these individuals regain lawful presence status. Although payment is being denied for claims, individuals who are entitled to Medicare per section 226 of the Act, maintain Part A entitlement and remain enrolled in Part B on Medicare's records as long as Part B premiums are paid. Similarly, individuals who are enrolled in premium Part A or Part B or both under sections 1818 and 1836 of the Act, maintain their enrollment status as long as premiums are paid. We proposed to align eligibility for enrollment in MA, Part D, and cost plans (and resulting Medicare payments to plans and by plans that would violate PRWORA) with the FFS payment exclusion policy to ensure that Medicare is only paying for benefits and services rendered to individuals who are eligible to receive them. These steps align with the recommendations made by the Office of Inspector General (OIG) in its January 2013 report (A-07-12-01116) 2 regarding the need for CMS to maintain adequate controls to detect and prevent improper payments for Medicare services rendered to beneficiaries who are not lawfully present. Accordingly, we proposed to revise the regulations to establish U.S. citizenship and lawful presence as eligibility requirements for enrollment in MA, Part D, and cost plans. Further, we proposed that individuals who are not lawfully present in the United States would be involuntarily disenrolled from MA, Part D, and cost plans, based on the date on which they lose their lawful presence status. Under our proposal, disenrollments would have been effective the first of the month following the loss of lawful presence status, and the disenrollment process would follow the process currently set forth in the regulations for an individual who is no longer eligible to be enrolled in a plan. Such disenrolled individuals would continue to be considered entitled to Medicare Part A and (if enrolled) enrolled in Part B coverage, provided they continue to pay premiums, as applicable, but as noted payment of FFS claims would be denied based on unlawfully present status. 2 Medicare Improperly Paid Providers Millions of Dollars for Unlawfully Present Beneficiaries Who Received Services During 2009 Through 2011 (A-07-12-01116), available at http://oig.hhs.gov/oas/reports/region7/71201116.asp. These proposed regulatory changes were intended to prevent an individual known not to be lawfully present in the United States from enrolling in a Part C, Part D, or cost plan and/or remaining enrolled in such a plan, meaning that payments would not be made to plans or by plans with respect to such individuals during that period. This policy was intended to facilitate compliance with 8 U.S.C. 1611. We proposed the following changes in the regulations to refine the eligibility requirements for the MA and Part D programs and give MA and Part D plans the ability to disenroll individuals who are not lawfully present in the United States: • Sections 417.420, 417.422, 422.50, and 423.30 would be amended to add lawful presence or United States citizenship as eligibility criteria for enrollment in a cost, MA, or Part D plan. • Sections 417.460, 422.74, and 423.44 would be amended to require the involuntary disenrollment of individuals from cost, MA or Part D plans if they lose lawful presence status. • Conforming changes would be made to §§ 417.2, 422.1, and 423.1 to outline the authority for the aforementioned requirements, from 8 U.S.C. 1611 (Aliens who are not qualified aliens ineligible for federal public benefits). We received the following comments on our proposals: Comment: Overall we received general support for our proposal. Many commenters requested clarification about who would be responsible for verifying eligibility based on lawful presence. A few of these commenters stated specifically that CMS should verify this aspect of eligibility and that plans should not be expected or permitted to request proof of lawful presence from individuals. A commenter, who did not agree with the proposed change, expressed concern that plans do not have access to data to validate residency/lawful status for Medicare beneficiaries and requested what source would be used for status changes. Response: We appreciate the support expressed by most commenters. We agree that CMS would have to provide lawful presence information to plans. In most cases, the DHS determines citizenship and lawful presence status and that information is passed to SSA. SSA also has mechanisms to address changes in lawful presence status reported by beneficiaries themselves or other third parties. CMS receives the lawful presence information from SSA after it completes its processes related to such changes in status. Then, we will notify the plan if an individual is not eligible for MA, Part D or cost plan enrollment based on lawful presence and the plan must either deny the enrollment request or process the involuntary disenrollment. Plans are not expected to independently determine lawful presence when processing the enrollment request, nor should they request proof of citizenship from the beneficiary or include lawful presence as an element on the enrollment form. We will notify plans of ineligibility due to unlawful presence, through the same administrative mechanisms currently utilized to notify plans about other involuntary disenrollments. Additionally, we will be providing more detailed information about the necessary processes and procedures in subregulatory guidance. Comment: A few commenters suggested that we amend the regulations to require a notice for the beneficiaries if they are disenrolled for absence or loss of lawful presence status. Other commenters suggested revisions for the content of a disenrollment notice, specifically suggesting that it contain pertinent information regarding loss of eligibility for enrollment and related impacts to unlawfully present individuals. Response: Under existing processes at SSA, individuals are notified of their potential change to lawful presence status and are provided an opportunity to be heard in advance of any final changes in status in SSA records (that is, before the information is transmitted to us 3 ). We believe that this process by SSA provides adequate notification to the beneficiary and, at this time, CMS will not require an additional notice from the plan at the time of disenrollment. This policy on notification from the plan is similar to CMS processes and regulations for other involuntary disenrollments based on information from CMS, 4 but we will take into consideration the possibility of requiring notice in future rulemaking. 3 Social Security Administration Program Operations Manual System (POMS) RS 00204.010 Lawful Presence Payment Provisions and RS 00204.080 Postentitlement Suspension—Alien is no Longer Lawfully Present. 4 Notices are required from the plans in cases of certain disenrollments. See 42 CFR.417.430, 422.74(c), and 423.44(c). In our existing subregulatory guidance, MA, Part D and cost plans are strongly encouraged to send confirmation of disenrollment to members even when it is not required. We agree that a notice regarding the reason for involuntary disenrollment and the impact unlawful presence status has on the payment of Medicare services would reinforce the messages already provided by SSA, and CMS encourages plans to send such notices in this situation. Sending a confirmation of disenrollment would ensure that these beneficiaries understand the restrictions of their Medicare coverage as they transfer to the FFS program. We appreciate the suggested notice language provided by the commenters and will consider it as we establish a model notice in Chapter 2 and Chapter 17-Subchapter D of the Medicare Managed Care Manual and Chapter 3 of the Medicare Prescription Drug Benefit Manual. Further, for instances where an unlawfully present individual is denied enrollment into a MA, Part D, or cost plan due to ineligibility, we currently require that the plan provide written notice of the denial. 5 We will consider the suggested language as we modify the existing model denial notices in these subregulatory chapters. 5 Notices are required from the plans in cases of enrollment denials. See 42 CFR 417.430(b)(3), 422.50(e)(3), and 423.32(d). Comment: Several commenters expressed concern about the effective date of disenrollment if it is based on the date of loss of lawful presence status. Specifically, commenters suggested that involuntary disenrollments be prospective because the plan provides coverage on the reasonable assumption of eligibility to receive services. Further, commenters were concerned about the recoupment of capitation payments as a result of these retroactive disenrollments. Response: In the proposed rule, we proposed that disenrollments would be effective the first of the month following the loss of eligibility to receive federal benefits because this is in line with the statutory requirement that individuals not receive federal benefits when they are not lawfully present in the United States. Operationally, we did not believe it was feasible to maintain enrollment in a Part C, Part D or cost plan for a period for which we would be required to recoup capitations retroactively. Therefore, we proposed a procedural mechanism to default enrollment for such individuals to Original Medicare, where the FFS payment exclusion policy would be applied. Any retroactive disenrollments would under our proposed approach result in recoupment of payments, as supported by existing regulations in §§ 417.464(a)(1), 422.308(f)(1), 423.315(f) and 423.343(a), which require CMS to retroactively adjust plan payments due to changes in enrollment status. At the time we made this proposal, it was consistent with the approach adopted under FFS Medicare, which also made retroactive recoupments in cases in which someone receiving Medicare benefits is determined not to have been eligible for them. While we believed that this approach was the best way to implement our obligation to comply with PRWORA, in considering comments received on the proposal, we are reconsidering the issue of retroactive disenrollment. First, while our proposal was consistent at the time it was made with FFS policy on retroactive recoupments, we have revised that policy, based on section 1870 of the Act, and are now denying payments only prospectively. We are also aware of due process arguments that may apply to retroactive recoupment. Because, under our systems, retroactive disenrollment would automatically result in retroactive recoupment, and we are reconsidering the issue of whether such retroactive recoupment in the case of Part C, Part D and cost plans is appropriate, we are not finalizing the retroactive aspect of our proposal on disenrollment, and at this time are finalizing only the prospective period of disenrollment provided for in the proposed rule. We are moving forward with finalizing prospective disenrollment while reconsidering the issue of retroactive enrollment because we believe that prospective disenrollment should be put in place as soon as possible, both to implement the prohibition on benefit payments to individuals who are unlawfully present in the United States, and minimize the period of any potential retroactive recoupment in the event we decide at a future point to proceed with our original proposal to disenroll individuals retroactively. Therefore, we are finalizing text different from our original proposal to make all disenrollments effective the first of the month following the loss of eligibility to receive federal benefits (that is, retroactively), and instead at this time will revise §§ 417.460(j), 422.74(d)(8), and 423.44(d)(8) to provide that disenrollments are effective the first of the month following notice by CMS that the individual is ineligible. This adjustment will ensure that CMS establishes the required mechanisms to permit prospective enrollment into MA, Part D and cost plans only for individuals eligible to receive Medicare benefits, and prospectively disenroll beneficiaries currently enrolled in plans as of this provision's applicability date. As discussed in the proposed rule, the OIG noted in a January 2013 report that CMS needed to increase efforts to detect and prevent improper payments for Medicare services rendered to unlawfully present beneficiaries. In a subsequent report published in October 2013 6 , the OIG specifically recommended that CMS develop and implement controls to ensure that Medicare does not pay for prescription drugs for unlawfully present beneficiaries and that CMS do so by preventing enrollment of unlawfully present beneficiaries, disenrolling any currently enrolled unlawfully present beneficiaries, and automatically rejecting PDE records submitted by sponsors for prescription drugs provided to this population. We believe that prospective disenrollments address these recommendations, and serve as an initial step in ensuring that payment is made for only individuals eligible to receive services. As we move forward with implementation, we will carefully consider enrollment retroactivity and resulting recoupments, and if determined appropriate, propose changes or additional regulations through future rulemaking. 6 Medicare Improperly Paid Providers Millions of Dollars for Prescription Drugs Provided to Unlawfully Present Beneficiaries During 2009 Through 2011 (A-07-12-006038) ( http://oig.hhs.gov/oas/reports/region7/71206038.pdf ). Lastly, we believe it is important to note while CMS is dependent upon the data received by the DHS through SSA, we ensure that the data are passed to the plans within 24 hours of receipt via the Daily Transaction Reply Report. In addition, we will work with these agencies to explore options for receiving these data in the most efficient and timely means possible. Comment: A few commenters suggested that beneficiaries who are involuntarily disenrolled due to unlawful presence should be entitled to appeal their disenrollment. Response: We thank these commenters for their suggestion to ensure that affected individuals have the opportunity to appeal the reason for their disenrollment from their plan. Currently, there is no right of appeal associated with MA, Part D or cost plans eligibility or enrollment, because enrollment in such plans is voluntary and involuntary disenrollments are not considered initial determinations as outlined in § 405.924(a). We reiterate that individuals disenrolled from MA, cost or Part D plans are defaulted to coverage under FFS Medicare unless Parts A and B entitlement and enrollment ends under 42 CFR part 406, subpart B and §§ 406.28 and 407.27. However, individuals who are subject to involuntary disenrollment from these plans due to lawful presence status are provided with due process prior to any change in their status by SSA and exchange of any data to CMS and loss of MA, Part D, or cost coverage (or denial of claims for an individual enrolled in the FFS program). These individuals are provided with advance notification in writing of the possible status change and an opportunity to respond or submit the necessary documentation to maintain a lawful presence status under existing SSA processes. 7 Following a status change to lawful presence status by SSA, individuals are also provided an opportunity to appeal the determination as outlined in 20 CFR 404.902. SSA has existing processes to accept and review evidence from individuals who believe that they are lawfully present and to update SSA's records. These individuals, based on the date of regaining lawful presence status, would then have the opportunity to re-enroll and, in certain cases of government error, be reinstated into their former plans. As we prepare for implementation of this rule, we intend to consider these issues carefully to ensure beneficiaries are notified of the consequences to Medicare coverage that flow from changes in lawful presence status. 7 Social Security Administration, Policy and Operations Manual System (POMS): RS 00204.010. Lawful Presence Payment Provisions, GN 03001.005 Notice Requirements for Title II Due Process Actions, and GN 03001.015 Notices Required Before And After Taking a Title II Adverse Action. Comment: A few commenters requested that CMS put in place a special enrollment period (SEP) for individuals who are disenrolled from their MA or Part D plan based on unlawful presence and then later regain lawful presence status and wish to re-enroll in a Part D or MA plan. In addition, commenters requested that if an individual is involuntarily disenrolled from a Part D plan due to unlawful presence, and that individual later regains lawful presence status, the individual should not be subject to a late enrollment penalty (LEP) for the period of time they did not have Part D (or other creditable) coverage. Response: We appreciate the concern expressed by the commenters about ensuring access to Medicare coverage and limiting financial consequences after a beneficiary gains, or regains, lawful presence status. Medicare beneficiaries may incur an LEP for Part D if there is a continuous period of 63 days or more at any time after the end of the individual's Part D initial enrollment period (IEP) during which they were eligible for, but did not enroll in, a Medicare Part D plan and were not covered under any creditable prescription drug coverage. If an individual is disenrolled from a Part D plan because of loss of lawful presence status, this is not considered a break in creditable prescription drug coverage because the individual is not eligible for Part D benefits during this time. Therefore, an LEP would not apply for that period of time. If an individual regains lawful presence status and, as a result, also regains Part C and/or Part D eligibility, the individual does not get a new IEP, but we acknowledge that an SEP is warranted to allow these individuals to enroll in an MA or Part D plan, including a cost plan's optional supplemental Part D benefit, under §§ 422.62(b)(4) and 423.36(c)(8)(ii) if the individual is not otherwise eligible for an SEP. The change in lawful presence status of an individual necessary to trigger a change in eligibility under these rules is extraordinary enough to justify the provision of a SEP under the existing authority of §§ 422.62(b)(4) and 423.36(c)(8)(ii), even without the additional concern that late enrollment penalties could be incurred by beneficiaries who are not able to enroll following their regained eligibility for Part D coverage. The parameters of this SEP will be outlined in subregulatory guidance. However, we note that in this scenario if the newly eligible individual does not take advantage of the SEP to enroll in a plan providing Part D coverage and has no other creditable prescription drug coverage, the individual may be subject to an LEP for any future Part D enrollment. Comment: A few commenters provided feedback regarding the proposed use of the term “qualified alien” in the proposed text at §§ 417.422, 417.460, 422.50, 423.1, 423.3, and 423.44. Commenters suggested changing it to more accurately reflect the lawful presence eligibility requirements for Medicare benefits outlined in 8 CFR 1.3 so that we are not restricting eligibility to only qualified noncitizens to enroll in or maintain their benefits. The broader term “lawfully present” for this purpose includes “qualified aliens” as well as several other categories of non-citizens, whereas the proposed terminology only included “qualified aliens” which is one of the subcategories included in those lawfully present. Response: We agree with the concern raised by commenters and are finalizing the regulatory language at §§ 417.422(h), 417.460(b)(2)(iv), 417.460(j), 422.50(a)(7), 422.74(b)(2)(v), 422.74(d)(8), 423.1(a)(3), 423.30(a)(1)(iii), 423.44(b)(2)(iv), and 423.44(d)(8) without references to qualified aliens; the final regulatory language encompasses all individuals who are lawfully present consistent with 8 CFR 1.3. After consideration of the public comments received, we are finalizing the policies and regulations text as proposed, with the following exceptions: • At §§ 417.422, 417.460, 422.50, 423.1, 423.3 and 423.44, we are deleting the term “qualified alien.” • At §§ 417.460(j), 422.74(d)(8), and 423.44(d)(8), we are modifying the effective date of the involuntary disenrollment to be the first of the month following notification by CMS. • At § 417.460, we are redesignating paragraph (b)(2)(iv) as paragraph (b)(2)(v) and finalizing the provision establishing a lack of lawful presence as a basis for disenrollment from a cost plan at paragraph (b)(2)(iv). 3. Part D Notice of Changes (§ 423.128(g)) Section 1860D-4(a) of the Act requires Part D sponsors to disclose to beneficiaries information about their Part D drug plans in standardized form. The Act further directs Part D sponsors to include, as appropriate, information that MA organizations must disclose under section 1852(c)(1) of the Act, which includes a detailed description of benefits. (In guidance, we refer to the document containing this information and delivered to beneficiaries as the Evidence of Coverage (EOC).) To make informed decisions, enrollees need to understand how their benefits, including premiums and cost sharing, would change from one year to the next, should they reenroll in the same plan. (In guidance, we refer to the documents containing this information and delivered to beneficiaries as the Annual Notice of Change (ANOC).) Enrollees also need to be aware of changes that may take place during the course of the year as well. Part D regulations currently do not include language found in the Part C regulations at § 422.111(d) requiring notice of changes to the plan to be provided to CMS for review pursuant to procedures for marketing material review and to all enrollees at least 15 days prior to the annual coordinated election period. Given that guidance applicable to both programs discusses notice of changes, we proposed to require, for Part D, delivery of an ANOC. Specifically, we proposed to adopt in Part D, with modifications, the language contained in § 422.111(d). As is the case with the MA regulation, proposed § 423.128(g) would require that Part D sponsors submit their changes to us under the procedures contained in subpart V of part 423, and, for those changes taking effect on January 1, provide a notice of changes to all enrollees 15 days before the beginning of the annual election period. While part 422 requires a minimum of 30 days notice before the effective date for all other changes, we proposed at § 423.128(g)(3) that Part D sponsors remain subject to all other notice requirements specified elsewhere in the Part D regulations. Our proposal reflected a programmatic difference between Parts C and D: Under Part D it is not unusual for access to drugs listed on a plan's formulary to change during the course of a year. Changes can include changes to formulary status, tier placement, and utilization management or other restrictions. It is vital that beneficiaries currently taking a drug receive timely notice before such changes take place in order that they can decide whether to, for instance, change drugs or request an exception to cover the drug. Accordingly, our regulations currently specify when sponsors must provide notice of these kinds of changes. Our proposal to require the delivery of an ANOC was not intended to disrupt or change those existing notice requirements. In the proposed rule, we also took the opportunity to comment on the particular importance for Part D sponsors to provide notice in the ANOC of any changes they are making that will affect the amount of cost sharing that enrollees must pay for each drug belonging to a specific tier. As has been articulated in guidance for several years, we expect that sponsors will provide notice of such changes to all enrollees, including enrollees moved to a consolidated plan. Generally, sponsors compare information such as cost sharing for the same plan from one year to the next in the ANOC. However, comparing information for the same plan would not benefit individuals moved from one plan to another. For instance, when a sponsor crosswalks members from a non-renewing plan to a consolidated renewal plan from one year to the next, cost sharing may change at the drug-tier level. An enrollee who previously had zero cost sharing for all covered Part D drugs within the preferred generic tier may find that the consolidated plan now requires copays for drugs in that tier depending on how many months' supplies he or she orders, and whether he or she obtains those drugs at a retail level pharmacy or through mail order. We expect that enrollees will receive ANOCs that clearly compare the non-renewed and consolidated plans' copayments or coinsurance for all drugs within each tier. We received the following comments on this proposal and our response follows: Comment: Commenters supported this proposal for informing beneficiaries about their coverage options. Several pointed out that it was important and appropriate for CMS to communicate cost-sharing changes through the Part D ANOC in addition to formulary information. One commenter urged us to perform ongoing monitoring of formulary changes including cost sharing to ensure they are justified and appropriately communicated to beneficiaries. Response: We thank the commenters for the support. While we appreciate the concerns about monitoring, we did not propose any changes with respect to monitoring of formulary changes, and we decline to address that issue in this final rule. Comment: Several commenters observed that, while many Part D sponsors already provide this annual notice under CMS guidance, they thought it important that this requirement be made explicit through rulemaking. In contrast, a commenter noted that developing a Part D ANOC was not necessary because of information provided through other material. Another commenter suggested that, if possible, Part D information should be incorporated into the Part C ANOC to avoid the potential for confusion, missing information, and duplicate costs. Response: We thank the commenters for the support and can confirm that our goal in revising § 423.128(g) is to codify existing guidance. Our existing model ANOC includes sections on both Parts C and D, and CMS produces nine standardized model ANOCs and EOCs for all plan types. Comment: A commenter requested that CMS confirm that this provision would merely codify existing guidance and would not necessitate any changes in practice for Part D sponsors that already deliver ANOCs that address plan changes consistent with existing CMS guidance. Response: Section 423.128(g) will not affect current practice for Part D sponsors that that already deliver ANOCs consistent with our model notices. Comment: A few commenters pointed out that finalizing this revision would add costs due to increased printing and administration requirements, with one commenter noting premiums could possibly increase. Response: We disagree. Because we did not propose here to change existing practices, but rather only to codify existing guidance, we do not believe the revision to § 423.128(g) will increase costs. Comment: A commenter suggested that MA organizations and Part D sponsors be required to share ANOCs with LTC providers in plan networks to enable them to better coordinate and support the beneficiaries in making informed decisions when their health conditions limit their ability to effectively communicate about their coverage. Another commenter suggested that we add language to the Part D ANOC advising beneficiaries for the future that it was important to review the new contract year formulary. Response: We appreciate these suggestions and will take them into consideration for the future for our guidance on the model notices. However we decline to accept the commenter's suggestion to add this to the regulation text because, as previously noted, our proposal was intended to codify existing guidance. After review of the public comments received, we are finalizing this provision as proposed without modification. 4. Business Continuity for MA Organizations and Part D Sponsors (§ 422.504(o) and § 423.505(p)) A variety of events ranging from power outages to disasters and warnings of disasters can disrupt normal business operations, and when these events occur it is important that MA organizations and Part D sponsors have a plan to ensure beneficiary access to health care services and drugs. Sections 1852(d) and 1860D-4(b) of the Act, respectively applicable to Parts C and D, establish access to services and covered Part D drugs as a core beneficiary protection. After Hurricane Sandy it became apparent that a few entities, particularly those with operational centers and/or information technology (IT) resources physically located in the affected areas, did not have consistent continuity plans or back-up systems and processes to ensure ongoing coordinated deployment of critical staff to alternate locations. Sections 1857(e)(1) and 1860D-12(b)(3)(D) of the Act authorize the Secretary to adopt additional contract terms for, respectively, MA organizations and Part D sponsors, including section 1876 cost contracts and Programs of the All-Inclusive Care for the Elderly (PACE) organizations that provide qualified prescription drug coverage, that are not inconsistent with Parts C and D, respectively, of Title XVIII of the Act, when the Secretary finds it necessary and appropriate. While a limited number of beneficiaries were affected by problems on the part of a small number of entities as a result of Hurricane Sandy, we have a goal of consistent disaster response for plans within the scope of our proposal. Therefore, we proposed that all MA organizations and Part D sponsors limit the impact on beneficiaries of unavoidable disruptions and establish a plan to ensure rapid restoration of operations. The scope of our proposal included section 1876 cost contract and PACE organizations that provide qualified prescription drug coverage under Part D. We also proposed to add contract provisions to require that MA organizations and Part D sponsors develop and maintain business continuity plans in order to better anticipate the types of disruptions that could occur and implement policies and procedures to reduce interference with business operations. Our proposal was based on a belief that such planning is appropriate and necessary to better ensure that Medicare beneficiaries have access to the care and coverage contemplated by the statute. The proposed provisions, in §§ 422.504(o)(1) and 423.505(p)(1), would require that every MA organization and Part D sponsor develop, maintain, and implement a business continuity plan that meets certain minimum standards. In §§ 422.504(o)(1)(i) and 423.505(p)(1)(i), we proposed that the business continuity plan assess risks posed to critical business operations by disasters and other disruptions to business as usual; in the preamble, we clarified that our proposal would apply regardless whether the risks, disasters or disruptions be natural, human, or environmental. In paragraph (1)(ii) of §§ 422.504(o) and 423.505(p), we proposed to require MA organizations and Part D sponsors to mitigate those risks through a variety of strategies, at a minimum by: (1) Identifying events (triggers) that would activate the business continuity plan; (2) developing contingency plans to maintain the availability and, as applicable, the confidentiality of hard copy and electronic essential records, including a disaster recovery plan for IT and beneficiary communication systems; (3) establishing a chain of command, which would better ensure that employees know the rules of succession; (4) creating a communications plan that includes emergency capabilities and means to communicate with employees and third parties; (5) establishing procedures to address management of space and transfer of employee functions; and (6) establishing a restoration plan with procedures to transition back to normal operations. Finally, we also proposed, in §§ 422.504(o)(1)(ii)(G) and 423.505(p)(1)(ii)(G), that the business continuity plan comply with all applicable federal, state, and local laws. In light of the nature of the records an MA organization or Part D sponsor would have in its possession, we proposed to emphasize continuing compliance with the contingency plan requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule (45 CFR parts 160 and 164, subparts A and C) by including a cross-reference to those requirements in paragraph (1)(ii)(B)(2) of each proposed regulation. These areas of responsibility are essential to continuing the business operations that allow beneficiaries to access health care services and covered Part D drugs. To better ensure that a business continuity plan works as a practical matter, we next proposed in §§ 422.504(o)(1)(iii) and (iv) and 423.505(p)(1)(iii) and (iv) to require that on an annual basis, each MA organization and Part D sponsor test and revise the plan as necessary, and train employees on their responsibilities under the plan. Proposed §§ 422.504(o)(1)(v) and 423.505(p)(1)(v) would require that MA organizations and Part D sponsors keep records of their business continuity plans that would be available to CMS upon request. We stated our belief that the broad list of areas that we proposed to cover as part of business continuity plans were not new to MA organizations and Part D sponsors. We stated these topics typically appear in standard business continuity plans and that we also were building on some requirements that already existed under federal and state laws. For instance, with respect to electronic protected health information, health plans have long had to comply with the contingency plan requirements found in the HIPAA Security Rule. We indicated our goal was to provide a list broad enough to align with the business contingency plans that we believed most, if not the vast majority, of MA organizations and Part D sponsors already had in place. In contrast to the aforementioned list of broad content requirements, we stated that the need to protect beneficiary access required a prescriptive approach for some functions. In proposed §§ 422.504(o)(2) and 423.505(p)(2), as part of the proposal that essential functions must be restored within 24 hours of failure (whether due to disaster, emergency, or other disruption), we identified what we believed to be the minimum essential functions for both MA and Part D plans: Benefit authorization, if authorization requirements have not been waived, and claims adjudication and processing; an exceptions and appeals process; and call center operations. We stated that given the mandate of the Act to ensure beneficiary access to health care and covered Part D drugs and the inability of many beneficiaries to pay for services or drugs without the Medicare benefit, we believed that the operations listed in the proposed regulations were the most essential operations because they directly supported the provision of Part C and D benefits. We stated that they ensured immediate electronic communication on the availability and extent of Part C and D benefits and also provided support that makes it more likely that Medicare benefits will be appropriately and timely provided (for example, by providing telephone assistance to beneficiaries with questions on how to obtain benefits and maintaining a forum in which beneficiaries can challenge benefit denials). We observed that without real time provision of Medicare benefits, beneficiaries might not pay for the entire cost of the services or drugs and therefore go without necessary treatment. We also proposed a list of the operations that we believed were essential operations that had to be restored in a rapid time frame. We intended our proposed deadline of the proposed 24 hours to be the outside limit and at that time articulated an expectation that MA organizations and Part D sponsors restore operation of essential functions as soon as possible but not later than 24 hours after they fail or otherwise stop functioning as usual. We stated the clock would begin running in cases of total failure (for example, a computer or telecommunications system crashes or stops working after disruption of the power supply) and also when significant problems occur (for example, a central database is corrupted). We stated that the need to ensure correct claims adjudication and benefit administration of health care services and drugs is no less acute during disasters or other emergencies, and that such disruptions in one part of the country might disable MA organization and Part D sponsor systems that affect enrollees in other regions. We noted that beneficiaries in those unaffected areas who are denied health care or drug benefits (that is, access to drugs or reimbursement for claims paid out of pocket) before the disruption took place should not be denied the right to immediately challenge those denials or to learn timely the resolution of earlier challenges. As proposed, §§ 422.504(o)(2)(i) and 423.505(p)(2)(i) identified benefit authorization (if not waived) and claim adjudication and processing as essential functions which had to be operational within 24 hours. Our proposal required restoration of those operations for services rendered at a hospital, clinic, provider office, or at the point of sale for Part D covered drugs. We also stated in the proposed rule that this function was essential for both MA and Part D plans. In addition, we proposed standards specific to Part D sponsors in § 423.505(p)(2)(ii) and (iii) to ensure that a beneficiary who presents at a pharmacy with an appropriate prescription for a covered Part D drug during a disruption would be more likely to receive the drug at the point of sale. The first three prongs under proposed § 423.505(p)(2) classified as essential the following functions: (i) Authorization, adjudication, and processing of pharmacy claims at the point of sale; (ii) administration and tracking of enrollee's drug benefits in real time, including automated coordination of benefits with other payers; and (iii) provision of pharmacy technical assistance. We noted these essential tasks entail numerous subfunctions. For instance, we stated that Part D sponsors would need to restore within the 24 hour return to operations (RTO) all computer and other systems that meet all privacy and security requirements in order to communicate to pharmacies information about topics including: coverage under Part D and the specific plan; cost-sharing and deductibles; any restrictions such as prior authorization, step therapy, or quantity limit edits; and coordination of benefits from other insurers and any low income subsidies. Additionally, we noted that the sponsor would need to undertake a concurrent drug utilization review (DUR) to address, for instance, safety issues, as well as restore its pharmacy help desk to provide prompt answers to any questions pharmacies might have. (For more detail on some of these functions and sub-functions, as related to Part D, please see section III. A.10, “Requirement for Applicants or their Contracted First Tier, Downstream, or Related Entities to Have Experience in the Part D Program Providing Key Part D Functions” of the May 23, 2014 final rule (79 FR 29867)). Proposed §§ 422.504(o)(2)(ii) and 423.505(p)(2)(iv) each classified as an essential operation an enrollee exceptions and appeals process including coverage determinations. Under these proposed rules we specified that, within 24 hours of failure, MA organizations and Part D sponsors would need to restore all IT and workforce support necessary to maintain the “safety net” that ensures beneficiaries the rights to appeal or to seek a formulary exception. Finally, for both MA organizations and Part D sponsors, we proposed that the operation of the call center be an essential function which must be restored within 24 hours. We stated that by classifying operation of the call center as essential, proposed §§ 422.504(o)(2)(iii) and 423.505(p)(2)(v) would ensure that beneficiaries could receive the information necessary to find out where they need to go to access benefits and learn about any special rules that might apply (for example, whether pre-authorization requirements are waived or beneficiaries can obtain benefits at out-of-network providers or pharmacies). We stated that enabling a beneficiary who has just been denied Part D coverage at his or her usual pharmacy to call immediately and speak to a customer service representative while still standing in that pharmacy could ensure that he or she obtained drugs appropriately covered by his or her Part D plan before returning home or moving to a safer area. Furthermore, in the proposed rule we stated that because it might be difficult during a disaster to get to a provider's office or a pharmacy, we believed it was important that benefit authorization, claims adjudication, and call center operations be restored within 24 hours after failure. While our proposed provisions required both MA organizations and Part D sponsors to coordinate their workforce, facilities, and IT and other systems support to meet a 24 hour RTO, in the preamble to the proposed rule we noted our belief that the vast majority of MA organizations and Part D sponsors already met, or would be able to meet, this requirement with their current resources, based on our knowledge of the industry and as evidenced by the lack of widespread problems with MA organization and Part D operations after recent natural disasters in different parts of the country. We observed that MA organizations and Part D sponsors would not be required to take any prescribed specific actions (for example, there was no requirement for redundant systems located at certain distances apart) to meet these standards. Rather, we stated that the proposed 24-hour RTO would allow MA organizations and Part D sponsors the flexibility to continue to seek their own disaster preparedness solutions (for instance, vendor sites or functions spread across facilities). We stated that our goal in proposing a contractual requirement for business continuity plans was to better ensure beneficiary access to health care services and Part D drugs during disasters and other interruptions to regular business operations, and we viewed prior planning as essential to achieving this goal. We specifically solicited comments regarding which functions should be identified as essential operations and the 24-hour timeframe for RTO and stated that we would appreciate any information unique to the role of MA organizations and Part D sponsors. We received the following comments on these proposals and our response follows: Comment: Some commenters strongly supported the proposed provision and noted that it was absolutely critical that MA organizations develop and test business continuity plans to ensure that beneficiary needs are met and commended CMS for its commitment to ensure beneficiary access to Medicare benefits. A number of commenters specifically approved that part of the proposed regulation that set forth minimum standards. Additionally, several commenters, including some who did not support the specific requirements of the proposed provision, agreed that there was a need for “robust” business continuity plans. Response: We thank those commenters who support the proposal in its entirety or approved the general outline of minimum requirements, as well as those who recognized there is a need for MA organizations and Part D sponsors to have business continuity plans. Comment: Noting that CMS acknowledged in the preamble there were relatively few problems in the past, some commenters stated that industry practices were adequate and questioned the need for detailed provisions that classified certain functions as essential which had to be restored within a 24-hour RTO deadline. A few commenters pointed to the fact, also acknowledged by CMS in the preamble, that the requirements overlapped with other existing federal, state, and local requirements such as the HIPAA Security Rule and stated that they saw no need for an additional layer of regulation. In contrast, another commenter stated that developing a business continuity plan should not be overly burdensome because the HIPAA Security Rule already requires development of such a plan. Response: We appreciate the fact that, as far as we are aware, only a limited number of beneficiaries experienced problems as the result of inadequate continuity planning in the wake of Hurricane Sandy. However, there were some beneficiaries who were unable to access benefits, and contingency planning might have prevented some of those problems. Having a business continuity plan to prepare for business disruptions is an established business practice; the fact that most MA organizations and Part D sponsors successfully handled the disaster does not excuse those entities that did not. We do not believe that requiring a business continuity plan is imposing an unnecessary level of regulation. However, we would like to clarify that HIPAA requirements are distinct from our business continuity provision. As we noted previously, with respect to electronic protected health information, health plans have long had to comply with the contingency plan requirements found in the HIPAA Security Rule. Referencing this rule created no additional burden. Comment: Commenters stated that the regulation was significantly more detailed than necessary. While some commenters pointed to concerns regarding paragraph (1) of §§ 422.504(o) and 423.505(p) which lists basic minimum requirements (addressed later in this section), most commenters noted concern with paragraph (2) of §§ 422.504(o) and 423.505(p) which identified as essential specific functions and required that MA organizations and Part D sponsors restore them within 24 hours of failure or loss of function. • The majority of commenters opposed the requirement that MA organizations and Part D sponsors restore essential functions within 24 hours, with several stating this was not feasible. Many commenters noted that because catastrophes are by their nature hard to predict, out of the control of MA organizations and Part D sponsors, and result in major disruptions that have the potential to last for weeks (for instance, power outages), a 24-hour RTO deadline would hamper the flexibility of MA organizations and Part D sponsors to prioritize. A commenter suggested that we institute a “force majeure” clause to provide relief for causes beyond the control of MA organizations and Part D. • Commenters indicated that they generally agreed with CMS that the emphasis should be on quickly getting care to those beneficiaries who need it, and there was some consensus that providing drugs and services at point-of-sale (POS) should remain an essential function. Several commenters observed that, consistent with industry standards, Part D sponsors were generally able to restore the systems necessary to allow beneficiaries to obtain drugs within approximately 24 hours. For instance, a commenter identified benefit authorization, claims adjudication, and pharmacy services as higher priorities. Some commenters specifically identified call center services as time-sensitive functions requiring a 24-hour recovery. • However, there was no clear consensus on the specific functions that should be considered essential or even how to prioritize among all of them. For instance, a commenter noted normal appeals would fall into a longer category than 24 hours recovery, but that expedited appeals might possibly fall within the 24 hour time line. Several commenters suggested that different functions would require different RTO time frames. Several commenters mentioned a 72-hour timeframe, with one noting it restored functions less critical for health and safety within 72, rather than 24, hours. • In evaluating essential functions, a number of commenters distinguished between the Part C and D programs. Commenters observed, for instance, that provider payments are not a 24-hour critical function for MA plans since payment is allowed to be made within 30 days and that in a disaster or emergency MA organizations should not be required to prioritize claims processing for services already rendered. In contrast, a few commenters agreed that the 24-hour restoration requirement could be applied to Part D point-of-sale claims that require immediate adjudication. Response: These commenters persuaded us that we need to build more flexibility into our business continuity plan requirements for RTO for essential functions and we are accordingly finalizing the regulation with changes from our proposal. In paragraph (2) of §§ 422.504(o) and 423.505(p), we are providing that MA organizations and Part D sponsors must plan to restore essential functions within 72, rather than 24, hours after any one of the essential functions fail or otherwise stop functioning as usual. As discussed in more detail later in this section, we also finalize regulation text to clarify that we require MA organizations and sponsors to “plan to” restore essential functions within the 72-hour time period, rather than guarantee complete restoration within the time frame. Given the lack of a clear consensus on how to prioritize all essential functions, we believe that this will provide MA organizations and Part D sponsors with the flexibility the commenters advocated, and still address our concerns about planning to better ensure beneficiary access to the Medicare benefit. However, we underscore that although we are finalizing a more flexible regulatory mandate, we expect that Part D sponsors will plan for a 24- hour RTO deadline for POS transactions. We are concerned that beneficiaries who are not able to access their Part D drug coverage may in fact suffer adverse health effects. Our decision not to explicitly require a plan for a 24-hour restoration for POS drug transactions is informed by the fact that commenters suggested that a 24-hour RTO for POS transactions is an industry standard already generally met, and that relatively few problems were reported in the aftermath of recent disasters. We want to ensure that that track record not only continues but improves. We will continue to closely monitor the timing of POS transaction in the aftermath of disasters, emergencies, and other disruptions and take any necessary actions. We also will revisit the regulation if necessary. We also agreed with commenters that there are distinctions between the Part C and D programs relative to identifying what services are of the highest priority for speedy restoration. For instance, beneficiaries need to know whether they have Part D Medicare coverage at the POS because usually they rely on the benefit to obtain prescription drugs. For most beneficiaries, such claim denials may mean they leave pharmacies without medications or pay out-of-pocket for costs that are their plans' responsibility. In contrast, this is often not the case for Part C health care services. Provision of Part C services is not so closely tied to plan authorizations and a provider may not bill the MA organization for services until days or weeks after the service is furnished. Thus, because beneficiary health and safety would not be put at risk by failure of Part C claims processing and appeals processes, we agree with the commenters that those systems are not essential functions to which the 72-hour timeframe would apply. Furthermore, as finalized in section II.E.9. of this final rule (MA Organization Responsibilities in Disasters and Emergencies (§ 422.100)), beneficiary access to health care services is protected in the more limited circumstances of disasters and public health emergencies and we believe that provision, in conjunction with § 422.504(o)(2), ensures, to the extent possible, that beneficiaries enrolled in MA organizations will have continued access to needed health care services when there are disruptions to normal business operations. Accordingly we are finalizing § 422.504(o)(2) to define as essential services, for Part C purposes, benefit authorization (if not waived) for services to be immediately furnished at a hospital, clinic, provider office, or other place of service instead of the broader requirement that was proposed. This final rule text would include benefit authorization to the extent that members and providers contact the MA organization to request such authorizations even when the MA organization has waived that requirement. Similarly, we agree that restoration of Part C claims processing and appeals processes are not essential functions in that beneficiary health and safety is not put at risk by a failure of those systems that lasts for longer than 72 hours. We agree with the commenters that in a disaster or emergency, MA organizations should not be required to prioritize claims for services already rendered, but we do not want beneficiaries to lose access to necessary treatment at provider offices. Accordingly, for Part C, we are no longer characterizing “Operation of an enrollee exceptions and appeals process including coverage determinations” as an essential function and are not finalizing that part of our proposal for § 422.504(o)(2). Lastly, we agree with the commenters that characterized call center services as high priorities for both Part C and Part D plans. In a disaster or other emergency, normal procedures may be disrupted and beneficiaries need to be able to find out how and where they can obtain health care services and drugs by having contact with the plan. In contrast, for Part D we plan to finalize § 423.505(p)(2) as proposed. We discussed the importance of the elements in more detail in the preamble to the proposed rule, but would like to note here that a beneficiary cannot obtain Part D coverage without benefits authorization, adjudication, and processing of drug claims at the point of sale. A pharmacy's inability to obtain, for instance, coordination of benefits information may affect the beneficiary's ability to obtain the drug as well; and pharmacy technical assistance is critical in case the dispensing pharmacy has questions. We also believe the operation of the enrollee exceptions and appeals process is essential—a beneficiary who has been denied Part D coverage will want to resolve quickly any issues so he or she can obtain the drug timely. Lastly, as previously noted, we believe call center operations are essential. Comment: A commenter suggested there was a need for more detail in addition to that provided in the regulation as to exactly when the 24-hour clock would start and that CMS would, for instance, need to clarify if the clock would begin running when the disaster was declared or when it occurred. Another commenter suggested the proposed 24-hour RTO should begin running when the incident management team made the determination of action or after a specified amount of time after the disruption was reported. Response: We believe that the language we proposed, namely that the clock will start running “after any of the essential functions fail or otherwise stop functioning as usual,” provides adequate direction to MA organizations and Part D sponsors. We are finalizing a clearly defined time period—72 hours (rather than the 24-hour time period proposed)—in which MA organizations and Part D sponsors must plan to restore essential operations. In contrast, we deliberately chose to provide more flexibility to MA organizations and Part D sponsors to determine the precise point at which the 72-hour clock starts running. Essential functions could fail in an infinite variety of ways depending on the circumstances and the systems and supports in place (for instance, claims processing systems might fail in different ways than operation of the exceptions and appeals process). We believe that MA organizations and Part D sponsors are in the best position to both learn about failures or disruptions in usual functions or the facts that might potentially cause them and, in the aftermath of such occurrences, gather as much information as possible internally and from outside sources (such as first-tier, downstream and related entities (FDRs) and local authorities and utilities). We will revisit this regulation if problems arise in the future. Comment: A couple of commenters expressed concern that the requirement that MA organizations and Part D sponsors return functions to “normal” operations would not permit them to utilize temporary alternative workflows that could be more effective than normal business operations in preserving member access to care. Response: We disagree with this conclusion. Our proposal does not require MA organizations and Part D sponsors to return immediately to normal operations but rather, views that as an ultimate goal in an ongoing transition process. Paragraph (1)(ii) of §§ 422.504(o) and 423.505(p) requires MA organizations and Part D sponsors to create a mitigation strategy to “prioritize the order in which to restore [essential and] other functions to normal operations”, while paragraph (1)(ii)(F) of §§ 422.504(o) and 423.505(p) requires MA organizations and Part D sponsors to “[e]stablish a restoration plan including procedures to transition to normal operations.” Additionally, we do not define “normal operations.” In fact, depending on the severity of a disaster or emergency, “normal operations” certainly might not be operations performed exactly the same as they were before the event. We do not prescribe when or how normal functions are performed; an MA organization or Part D sponsor may achieve a comparable level of performance (for example, in terms of appeals being heard on a timely basis at the same rate as before the disaster) and consider normal operations achieved even if different personnel or offices now perform those functions. We view “normal operations” as an operational level at which MA organizations and Part D sponsors are able to administer the benefit correctly and fulfill contract requirements. Comment: A commenter stated that the proposed provisions were inconsistent with Executive Order 13563 which requires that proposed rules specify performance objectives rather than the behavior or manner of compliance that regulated entities must adopt. Response: We disagree with this commenter. The first part of our proposed provisions simply lists basic areas that business continuity plans must cover. We also view as performance objectives the list of essential functions for which we require MA organizations and Part D sponsors to plan a 72-hour RTO. As revised, the regulation requires that each entity plan to restore those functions that directly support the timely provision of Part C and D Medicare benefits to beneficiaries. We leave it to the MA organizations and Part D sponsors to determine the manner by which they plan to meet these requirements timely after a failure occurs. Comment: Commenters took issue with the costs associated with the proposal. A number of commenters expressed concerns that we were requiring continuous service which would give rise to enormous costs to create systems redundancy, while several commenters were concerned about the cost of testing IT systems on an annual basis. Response: Although we believe the proposed regulation was clear in paragraphs (1)(ii)(B)( 1 ) of §§ 422.504(o) and 423.505(p) that we do not expect plans to be able to maintain continuous service under all circumstances, we are revising both of these regulation paragraphs in this final rule to clarify the language that we believe caused this confusion. We are revising the language in the proposed paragraph (1) of §§ 422.504(o) and 423.505(p) to require MA organizations and Part D sponsors to plan to restore business operations following disruptions, rather than plan to continue business operations during disruptions. To clarify, we do not expect MA organizations and Part D sponsors to prevent any disruptions on an absolute basis but rather to plan to ensure operations are restored as best they can when business operations fail. It is understood that disasters, emergencies, and other events may cause severe disruptions outside of the control of MA organizations and Part D sponsors; the reason we are requiring business continuity plans is to ensure that MA organizations and Part D sponsors are better equipped to handle those problems when they occur. Additionally, proposed §§ 422.504(o)(2) and 423.505(p)(2) required that MA organizations and Part D sponsors “restore” essential functions within the specified timeframe, which we believe raises the same concerns expressed by the commenter. We want to make it clear that the actual restoration of essential functions within 72 hours is the goal of the business continuity plan, not a requirement that is to be met in all circumstances. Accordingly, the regulation is being finalized to require that MA organizations and Part D sponsors plan to restore essential functions within the 72-hour time period. The business continuity plan must be designed with this 72-hour period as a deadline. As to the commenters' concern about the cost of annual IT training, paragraph (1)(iii) of §§ 422.504(o) and 423.505(p) requires MA organizations and Part D sponsors to test and update the business operations continuity plan on at least an annual basis. This broad description does not detail specific kinds of testing but relies upon MA organizations and Part D sponsor discretion to adequately test and update the business continuity plan. This would include determining exactly what must be tested and how such testing must occur. Comment: A commenter expressed concern that the rule would require annual training for “all” employees, which might not be necessary under all conditions. Response: We agree that it is best left to MA organizations and Part D sponsors to determine which employees would most appropriately require annual training on the business continuity plan. We are finalizing the regulations to require annual training of appropriate employees rather than all employees, as well as making changes to make the language applying to both Parts C and D consistent. Specifically, we are removing the phrase “all employees, including contract staff” from § 422.504(o)(1)(iv) and “all new and existing employees” from § 423.505(p)(1)(iv), and replacing them both with “appropriate employees”. Comment: Several commenters suggested that our regulatory impact analysis (RIA) significantly underestimated costs. Concerns were raised about the high cost of creating systems' redundancy to avoid any disruption of processing of claims; one commenter mentioned that the requirement would necessitate spending millions of dollars. Another commenter mentioned that many business continuity plans currently in place for MA organizations and Part D sponsors would not meet requirements such as the restoration of essential functions within 24 hours. A commenter was concerned that the estimate did not take into account resources needed to ascertain the extent of damage and evaluate options. Response: We believe that the modifications, clarifications, and comments discussed previously about this final rule address the vast majority of concerns raised about the RIA. We are also well aware of the major expense of creating redundant computer systems to ensure there is no interruption in claims processing—and repeat that we are not requiring MA organizations and Part D sponsors to absolutely ensure that systems never fail or to build redundant systems to avoid any potential failure. We are requiring that MA organizations and Part D sponsors plan to avoid such system and other failures and, in the event they do occur, to be prepared to recover essential functions within a certain timeframe. We appreciate that while contracting organizations may plan—even plan well—to avoid such disruptions and to recover from them within 72 hours, there may be scenarios in which a return of functionality for essential operations within the timeframe of paragraph (2) of §§ 422.504(o) and 423.505(p) is impossible . We also believe that providing the greater flexibility to plan for a 72-hour, rather than 24-hour, RTO for MA organizations and Part D sponsors should further alleviate concerns about high costs. In this final rule, we also are revising the regulations to clarify that we require annual training of “appropriate” rather than “all” employees. As noted earlier, our requirement for annual testing of the business continuity plan does not specify exactly what must be tested or how such testing must be conducted. As to the last comment, MA organizations and Part D sponsors need to assess damages and evaluate alternatives regardless of whether they have business continuity plans. Additionally, we have revised our cost estimates to account for costs of what we believe will be, at most, minimal changes to existing business continuity plans. We base this on: (1) The fact that we believe most MA organizations and Part D sponsors with existing business continuity plans already cover the same broad list of areas we require in this rule; and (2) revisions to our rule that provide flexibility that enables most MA organizations and Part D sponsors to follow the same industry standards commenters suggested they currently follow. (See section IV. Regulatory Impact Statement of this final rule.) Comment: A commenter stated that MA organizations and Part D sponsors could incur potentially very large additional costs to come into compliance with the new requirements which would amount to unexpected expenses that would unfairly count against a plan's administrative expenses on its medical loss ra [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2015-02671. Public record. Not legal advice.