General provisions

(a) General rule. Subject to the provisions at § 423.265 of this part concerning submission of bids, to enroll beneficiaries in any Part D drug plan it offers and be paid on behalf of Part D eligible individuals enrolled in those plans, a Part D plan sponsor must enter into a contract with CMS. The contract may cover more than one Part D plan.

(i) A policy making body that exercises oversight and control over the Part D plan sponsor's policies and personnel to ensure that management actions are in the best interest of the organization and its enrollees.

(ii) Personnel and systems sufficient for the Part D plan sponsor to organize, implement, control, and evaluate financial and communication activities, the furnishing of prescription drug services, the quality assurance, medical therapy management, and drug and or utilization management programs, and the administrative and management aspects of the organization.

(iii) At a minimum, an executive manager whose appointment and removal are under the control of the policy making body.

(iv) A fidelity bond or bonds, procured and maintained by the Part D sponsor, in an amount fixed by its policymaking body but not less than $100,000 per individual, covering each officer and employee entrusted with the handling of its funds. The bond may have reasonable deductibles, based upon the financial strength of the Part D plan sponsor.

(v) Insurance policies or other arrangements, secured and maintained by the Part D plan sponsor and approved by CMS to insure the Part D plan sponsor against losses arising from professional liability claims, fire, theft, fraud, embezzlement, and other casualty risks.

(vi) Adopt and implement an effective compliance program, which must include measures that prevent, detect, and correct noncompliance with CMS' program requirements as well as measures that prevent, detect, and correct fraud, waste, and abuse. The compliance program must, at a minimum, include the following core requirements:

(A) Written policies, procedures, and standards of conduct that—

(1) Articulate the Part D plan sponsor's commitment to comply with all applicable Federal and State standards;

(2) Describe compliance expectations as embodied in the standards of conduct;

(3) Implement the operation of the compliance program;

(4) Provide guidance to employees and others on dealing with potential compliance issues;

(5) Identify how to communicate compliance issues to appropriate compliance personnel;

(6) Describe how potential compliance issues are investigated and resolved by the Part D plan sponsor; and

(7) Include a policy of non-intimidation and non-retaliation for good faith participation in the compliance program, including but not limited to reporting potential issues, investigating issues, conducting self-evaluations, audits and remedial actions, and reporting to appropriate officials.

(B) The designation of a compliance officer and a compliance committee who report directly and are accountable to the Part D plan sponsor's chief executive or other senior management.

(1) The compliance officer, vested with the day-to-day operations of the compliance program, must be an employee of the Part D plan sponsor, parent organization or corporate affiliate. The compliance officer may not be an employee of the Part D plan sponsor's first tier, downstream or related entity.

(2) The compliance officer and the compliance committee must periodically report directly to the governing body of the Part D plan sponsor on the activities and status of the compliance program, including issues identified, investigated, and resolved by the compliance program.

(3) The governing body of the Part D plan sponsor must be knowledgeable about the content and operation of the compliance program and must exercise reasonable oversight with respect to the implementation and effectiveness of the compliance programs.

(C)(1) Each Part D plan sponsor must establish and implement effective training and education for its compliance officer and organization employees, the Part D sponsor's chief executive and other senior administrators, managers and governing body members.

(2) Such training and education must occur at a minimum annually and must be made a part of the orientation for a new employee, and new appointment to a chief executive, manager, or governing body member.

(D) Establishment and implementation of effective lines of communication, ensuring confidentiality, between the compliance officer, members of the compliance committee, the Part D plan sponsor's employees, managers and governing body, and the Part D plan sponsor's first tier, downstream, and related entities. Such lines of communication must be accessible to all and allow compliance issues to be reported including a method for anonymous and confidential good faith reporting of potential compliance issues as they are identified.

(E) Well-publicized disciplinary standards through the implementation of procedures which encourage good faith participation in the compliance program by all affected individuals. These standards must include policies that—

(1) Articulate expectations for reporting compliance issues and assist in their resolution;

(2) Identify non-compliance or unethical behavior; and

(3) Provide for timely, consistent, and effective enforcement of the standards when non-compliance or unethical behavior is determined.

(F) Establishment and implementation of an effective system for routine monitoring and identification of compliance risks. The system should include internal monitoring and audits and, as appropriate, external audits, to evaluate the Part D plan sponsors, including first tier entities', compliance with CMS requirements and the overall effectiveness of the compliance program.

(G) Establishment and implementation of procedures and a system for promptly responding to compliance issues as they are raised, investigating potential compliance problems as identified in the course of self-evaluations and audits, correcting such problems promptly and thoroughly to reduce the potential for recurrence, and ensure ongoing compliance with CMS requirements.

(1) If the Part D sponsor discovers evidence of misconduct related to payment or delivery of prescription drug items or services under the contract, it must conduct a timely, reasonable inquiry into that conduct;

(2) The Part D sponsor must conduct appropriate corrective actions (for example, repayment of overpayments and disciplinary actions against responsible individuals) in response to the potential violation referenced above.

(3) The Part D plan sponsor should have procedures to voluntarily self-report potential fraud or misconduct related to the Part D program to CMS or its designee.

(4) The Part D plan sponsor must have procedures to identify, and must report to CMS or its designee either of the following, in the manner described in paragraphs (b)(4)(vi)(G)(4) through (6) of this section:

(i) Any payment suspension implemented by a plan, pending investigation of credible allegations of fraud by a pharmacy, which must be implemented in the same manner as the Secretary does under section 1862(o)(1) of the Act.

(ii) Any information concerning investigations, credible evidence of suspicious activities of a provider of services (including a prescriber) or supplier, and other actions taken by the plan related to the inappropriate prescribing of opioids.

(5) The Part D plan sponsor must submit data, as specified in this section, in the program integrity portal when reporting payment suspensions pending investigations of credible allegations of fraud by pharmacies; information related to the inappropriate prescribing of opioids and concerning investigations and credible evidence of suspicious activities of a provider of services (including a prescriber) or supplier, and other actions taken by the plan sponsor; or if the plan reports a referral, through the portal, of substantiated or suspicious activities of a provider of services (including a prescriber) or a supplier related to fraud, waste or abuse to initiate or assist with investigations conducted by CMS, or its designee, a Medicare program integrity contractor, or law enforcement partners. The data categories, as applicable, include referral information and actions taken by the Part D plan sponsor on the referral. (6)(i) The plan sponsor is required to notify the Secretary, or its designee, of a payment suspension described in paragraph (b)(4)(vi)(G)(4) of this section 7 days prior to implementation of the payment suspension. The MA organization may request an exception to the 7day prior notification to the Secretary, or its designee, if circumstances warrant a reduced reporting time frame, such as potential beneficiary harm.

(ii) The plan sponsor is required to submit the information described in paragraph (b)(4)(vi)(G)(4)(ii) of this section no later than January 30, April 30, July 30, and October 30 of each year for the preceding periods, respectively, of October 1 through December 31, January 1 through March 31, April 1 through June 30, and July 1 through September 30. For the first reporting period (January 30, 2022), the reporting will reflect the data gathered and analyzed for the previous quarter in the calendar year (October 1-December 31).

(7)(i) CMS provides plan sponsors with data report(s) or links to the information described in paragraphs (b)(4)(vi)(G)(4)(i) and (ii) of this section no later than April 15, July 15, October 15, and January 15 of each year based on the information in the portal, respectively, as of the preceding October 1 through December 31, January 1 through March 31, April 1 through June 30, and July 1 through September 30.

(ii) Include administrative actions, pertinent information related to opioid overprescribing, and other data determined appropriate by the Secretary in consultation with stakeholders.

(iii) Are anonymized information submitted by plans without identifying the source of such information.

(iv) For the first quarterly report (April 15, 2022), that the report reflect the data gathered and analyzed for the previous quarter submitted by the plan sponsors on January 30, 2022.

(5) Not have non-renewed a contract under § 423.507 within the past 2 years unless—

(i) During the 6-month period, beginning on the date the entity notified CMS of the intention to non-renew the most recent previous contract, there was a change in the statute or regulations that had the effect of increasing Part D sponsor payments in the payment area or areas at issue; or

(ii) CMS has otherwise determined that circumstances warrant special consideration.

(6) Not have terminated a contract by mutual consent under which, as a condition of the consent, the Part D plan sponsor agreed that it was not eligible to apply for new contracts or service area expansions for a period up to 2 years per § 423.508(e) of this subpart.

(7) For a full risk or limited risk PDP applicant, not submitted a bid or offered a fallback prescription drug plan in accordance with the following rules.

(i) CMS does not contract with a potential PDP sponsor for the offering of a full risk or limited risk prescription drug plan in a PDP region for a year if the applicant—

(A) Submitted a bid under § 423.863 for the year (as the first year of a contract period under § 423.863 to offer a fallback prescription drug plan in any PDP region;

(B) Offers a fallback prescription drug plan in any PDP region during the year; or

(C) Offered a fallback prescription drug plan in that PDP region during the previous year.

(ii) Construction. For purposes of this paragraph (b)(6), an entity is treated as submitting an application to become qualified to contract as a full risk or limited risk PDP sponsor, if the entity is acting as a subcontractor for an integral part of the drug benefit management activities of a full risk or limited risk PDP sponsor or applicant. The previous sentence does not apply to entities that are subcontractors of an MA organization except insofar as the MA organization is applying to act as a full risk or limited risk PDP sponsor.

(8) If neither the applicant, nor its parent or another subsidiary of the same parent, holds a Part D sponsor contract that has been in effect for at least 1 year at the time it submits an application, the applicant must have arrangements in place such that the applicant and its contracted first tier, downstream, or related entities, in combination, have at least 1 full-benefit year of experience within the 2 years preceding the application submission performing at a minimum all of the following functions in support of the operation of another Part D contract:

(i) Authorization, adjudication, and processing of prescription drug claims at the point of sale.

(ii) Administration and tracking of enrollees' drug benefits in real time, including automated coordination of benefits with other payers.

(iii) Operation of an enrollee appeals and grievance process.

(9) For organizations applying to offer stand-alone prescription drug plans, the organization, its parent, or a subsidiary of the organization or its parent, must have either of the following:

(i) For 2 continuous years immediately prior to submitting an application, actively offered health insurance or health benefits coverage, including prescription drug coverage, as a risk-bearing entity in at least one State.

(ii) For 5 continuous years immediately prior to submitting an application, actively managed prescription drug benefits for an organization that offers health insurance or health benefits coverage, including at a minimum, all of the services listed in paragraph (b)(8) of this section.

(10) Pass an essential operations test prior to the start of the benefit year. This provision only applies to new sponsors that have not previously entered into a Part D contract with CMS when neither it, nor another subsidiary of the applicant's parent organization, is offering Part D benefits during the current year.

(c) Contracting authority. CMS may enter into contracts under this part, or in order to carry out this part, without regard to Federal and Departmental acquisition regulations set forth in Title 48 of the CFR and provisions of law or other regulations relating to the making, performance, amendment, or modification of contracts of the United States if CMS determines that those provisions are inconsistent with the efficient and effective administration of the Medicare program.

(d) Protection against fraud and beneficiary protections. (1) CMS annually audits the financial records (including, but not limited to, data relating to Medicare utilization and costs, including allowable reinsurance and risk corridor costs as well as low income subsidies and other costs) under this part of at least one-third of the Part D sponsors offering Part D drug plans.

(2) Each contract under this section must provide that CMS, or any person or organization designated by CMS, has the right to—

(i) Inspect or otherwise evaluate the quality, appropriateness, and timeliness of services performed under the Part D plan sponsor's contract;

(ii) Inspect or otherwise evaluate the facilities of the Part D sponsor when there is reasonable evidence of some need for the inspection; and

(iii) Audit and inspect any books, contracts, and records of the Part D plan sponsor that pertain to—

(A) The ability of the organization or its first tier or downstream providers to bear the risk of potential financial losses; or

(B) Services performed or determinations of amounts payable under the contract.

(iv) CMS may require that the Part D Plan sponsor hire an independent auditor to provide CMS with additional information to determine if deficiencies found during an audit or inspection have been corrected and are not likely to recur. The independent auditor must work in accordance with CMS specifications and must be willing to attest that a complete and full independent review has been performed.

(e) Severability of contracts. The contract must provide that, upon CMS' request—

(1) The contract could be amended to exclude any State-licensed entity, or a Part D plan specified by CMS; and

(2) A separate contract for any excluded plan or entity must be deemed to be in place when a request is made.

(f) Outlier prescribers of opioids. (1) CMS will identify and send notifications to outlier prescribers of opioids, which includes information about how the prescriber compares to other specified prescribers and resources on proper prescribing methods.

(2) At least annually, CMS will communicate information about persistent outlier prescribers of opioids to all Part D plan sponsors.