Contract provisions

(a) General rule. The contract between the Part D plan sponsor and CMS must contain the provisions specified in paragraph (b) of this section.

(i) Making standard contracts available upon request from interested pharmacies no later than September 15 of each year for contracts effective January 1 of the following year.

(ii) Providing a copy of a standard contract to a requesting pharmacy within 7 business days after receiving such a request from the pharmacy.

(19) Effective contract year 2010, include the prompt payment provisions described in § 423.520.

(20) Effective contract year 2010, provide that pharmacies located in, or having a contract with, a long-term care facility (as defined in § 423.100) must have not less than 30 days, nor more than 90 days, to submit to the Part D sponsor claims for reimbursement under the plan.

(21)(i) Update any prescription drug pricing standard (as defined in § 423.501) based on the cost of the drug used for reimbursement of network pharmacies by the Part D sponsor on January 1 of each contract year and not less frequently than once every 7 days thereafter;

(ii) Indicate the source used for making any such updates; and

(iii) Disclose all individual drug prices to be updated to the applicable pharmacies in advance of their use for reimbursement of claims, if the source for any prescription drug pricing standard is not publicly available.

(22) As described in § 423.129, address and resolve complaints received by CMS against the Part D sponsor in the Complaints Tracking Module.

(23) Maintain a fiscally sound operation by at least maintaining a positive net worth (total assets exceed total liabilities).

(24) Provide applicable discounts on applicable drugs when dispensed to applicable beneficiaries in accordance with the requirements in subpart W of part for the Coverage Gap Discount Program and the requirements in subpart AA of part for the Manufacturer Discount Program.

(25) Maintain administrative and management capabilities sufficient for the organization to organize, implement, and control the financial, communication, benefit administration, and quality assurance activities related to the delivery of Part D services.

(26) Maintain a Part D summary plan rating score of at least 3 stars under the 5-star rating system specified in subpart 186 of this part 423. A Part D summary plan rating is calculated as provided in § 423.186.

(27) Pass an essential operations test prior to the start of the benefit year. This provision only applies to new sponsors that have not previously entered into a Part D contract with CMS and neither it, nor another subsidiary of the applicant's parent organization, is offering Part D benefits during the current year.

(c) Communication with CMS. The Part D plan sponsor must have the capacity to communicate with CMS electronically in accordance with CMS requirements.

(d) Maintenance of records. The Part D plan sponsor agrees to maintain, for 10 years, books, records, documents, and other evidence of accounting procedures and practices that-

(1) Are sufficient to do the following:

(i) Accommodate periodic auditing of the financial records (including data related to Medicare utilization, costs, and computation of the bid of part D plan sponsors).

(ii) Enable CMS to inspect or otherwise evaluate the quality, appropriateness, and timeliness of services performed under the contract and the facilities of the organization.

(iii) Enable CMS to audit and inspect any books and records of the Part D plan sponsor that pertain to the ability of the organization to bear the risk of potential financial losses, or to services performed or determinations of amounts payable under the contract.

(iv) Except for fallback entities, properly reflect all direct and indirect costs claimed to have been incurred and used in the preparation of the Part D plan sponsor's bid and necessary for the calculation of gross covered prescription drug costs, allowable reinsurance costs, and allowable risk corridor costs (as defined in § 423.308).

(v) Except for fallback entities, establish the basis for the components, assumptions, and analysis used by the Part D plan in determining the actuarial valuation of standard, basic alternative, or enhanced alternative coverage offered in accordance with the CMS guidelines specified in § 423.265(c)(3).

(vi) Enable CMS to review original format documentation or information utilized from all written, electronic, and verbal communications between the plan sponsor and the pharmacist, prescriber, enrollee, or other relevant stakeholders, in addition to what is included on the pharmacy claim, that is relied upon by the Part D plan sponsor to make a coverage determination or otherwise permit a point-of-sale claim adjudication that determine a drug's coverage under the Part D benefit. In instances when a coverage determination is extended, the original coverage determination must be maintained as documentation. The documentation covered by these standards must be made available to CMS during Part D program integrity prescription drug event (PDE) record review audits. Failure to produce sufficient documentation to support Part D coverage will result in an improper Part D audit determination and will be subject to PDE record deletion in accordance with § 423.325(a)(2).

(2) Include records of the following:

(i) Ownership and operation of the Part D sponsor's financial, medical, and other record keeping systems.

(ii) Financial statements for the current contract period and 10 prior periods.

(iii) Federal income tax or informational returns for the current contract period and 10 prior periods.

(iv) Asset acquisition, lease, sale, or other actions.

(v) Agreements, contracts, and subcontracts.

(vi) Franchise, marketing, and management agreements.

(vii) Matters pertaining to costs of operations.

(viii) Amounts of income received by source and payment.

(ix) Cash flow statements.

(x) Any financial reports filed with other Federal programs or State authorities.

(xi) All prescription drug claims for the current contract period and 10 prior periods.

(xii) All price concessions (including concessions offered by manufacturers) for the current contract period and 10 prior periods accounted for separately from other administrative fees.

(xiii) Documentation or information from all written, electronic, and verbal communications between the plan sponsor and the pharmacist, prescriber, enrollee, or other relevant stakeholders, in addition to what is included on the pharmacy claim, that is relied upon when Part D plan sponsors make coverage determinations or otherwise permit a point-of-sale claim adjudication that determines coverage of a drug under the Part D benefit, consistent with paragraph (d)(1)(vi) of this section. This includes:

(A) Date and time the request for a coverage determination or point-of-sale claim adjudication was received and, when available, the identity of the individual or entity who submitted the request.

(B) Name and title, as applicable if additional outreach is made, of the individual the Part D plan contacted to obtain the information needed to complete the request (for example, pharmacist, prescriber, enrollee, or enrollee representative).

(C) Information obtained, including the questions asked and responses received, and the final decision rendered.

(D) Diagnosis for a coverage determination or point-of-sale claim adjudication when used to determine Part D coverage for a medically accepted indication.

(E) Any other information that the Part D plan sponsor utilized to determine the final outcome of the coverage determination or point-of-sale claim adjudication request.

(e) Access to facilities and records. The Part D plan sponsor agrees to the following:

(1) HHS, the Comptroller General, or their designee may evaluate, through audit, inspection, or other means—

(i) The quality, appropriateness, and timeliness of services furnished to Medicare enrollees under the contract;

(ii) Compliance with CMS requirements for maintaining the privacy and security of protected health information and other personally identifiable information of Medicare enrollees;

(iii) The facilities of the Part D sponsor to include computer and other electronic systems; and

(iv) The enrollment and disenrollment records for the current contract period and 10 prior periods.

(2) The Part D plan sponsor agrees to make available to HHS, the Comptroller General, or their designees, for the purposes specified in paragraph (d) of this section, its premises, physical facilities and equipment, records relating to its Medicare enrollees, and any additional relevant information that CMS may require. The Part D plan sponsor also agrees to make available any books, contracts, records and documentation of the Part D plan sponsor, first tier, downstream and related entity(s), or its transferee that pertain to any aspect of services performed, reconciliation of benefit liabilities, and determination of amounts payable under the contract, or as the Secretary may deem necessary to enforce the contract.

(3) The Part D plan sponsor agrees to make available, for the purposes specified in paragraph (d) of this section, its premises, physical facilities and equipment, records relating to its Medicare enrollees, and any additional relevant information that CMS may require.

(4) HHS, the Comptroller General, or their designee's right to inspect, evaluate, and audit extends through 10 years from the end of the final contract period or completion of audit, whichever is later unless—

(i) CMS determines there is a special need to retain a particular record or group of records for a longer period and notifies the Part D plan sponsor at least 30 days before the normal disposition date;

(ii) There is a termination, dispute, or allegation of fraud or similar fault by the Part D plan sponsor, in which case the retention may be extended to 6 years from the date of any resulting final resolution of the termination, dispute, or fraud or similar fault; or

(iii) CMS determines that there is a reasonable possibility of fraud or similar fault, in which case CMS may inspect, evaluate, and audit the Part D plan sponsor at any time.

(f) Disclosure of information. The Part D plan sponsor agrees to submit to CMS—

(1) Certified financial information that must include the following:

(i) Information as CMS may require demonstrating that the organization has a fiscally sound operation.

(ii) Information as CMS may require pertaining to the disclosure of ownership and control of the Part D plan sponsor.

(2) All information to CMS that is necessary for CMS to administer and evaluate the program and to simultaneously establish and facilitate a process for current and prospective beneficiaries to exercise choice in obtaining prescription drug coverage. This information includes, but is not limited to:

(i) The benefits covered under a Part D plan.

(ii) The Part D plan monthly basic beneficiary premium and Part D plan monthly supplemental beneficiary premium, if any, for the plan. Fallback entities submit the monthly beneficiary premium for standard prescription drug coverage.

(iii) The service area of each plan.

(iv) Plan quality and performance indicators for the benefits under the plan including—

(A) Disenrollment rates for Medicare enrollees electing to receive benefits through the plan for the previous 2 years;

(B) Information on Medicare enrollee satisfaction;

(C) The recent records regarding compliance of the plan with requirements of this part, as determined by CMS; and

(D) Other information determined by CMS to be necessary to assist beneficiaries in making an informed choice regarding Part D plans.

(v) Information about beneficiary appeals and their disposition, and formulary exceptions.

(vi) Information regarding all formal actions, reviews, findings, or other similar actions by States, other regulatory bodies, or any other certifying or accrediting organization.

(vii) Information on other matters that CMS may require, including, but not limited to, program monitoring and oversight, performance measures, quality assessment, research and evaluation, CMS outreach activities, payment-related oversight*, and fraud, abuse, and waste*, as specified in CMS guidelines.

(viii) Any other information deemed necessary to CMS for the administration or evaluation of the Medicare program.

(3) All data elements included in all its drug claims for purposes deemed necessary and appropriate by the Secretary, including, but not limited to the following:

(i) Reporting to Congress and the public on overall statistics associated with the operation of the Medicare prescription drug program.

(ii) Conducting evaluations of the overall Medicare program, including the interaction between prescription drug coverage under Part D of Title XVIII of the Social Security Act and the services and utilization under Parts A, B, and C of title XVIII of the Act and under titles XIX and XXI of the Act, as well as other studies addressing public health questions.

(iii) Making legislative proposals to the Congress regarding Federal health care programs and related programs.

(iv) Conducting demonstration and pilot projects and making recommendations for improving the economy, efficiency, or effectiveness of the Medicare program.

(v) Supporting care coordination and disease management programs.

(vi) Supporting quality improvement and performance measurement activities.

(vii) Populating personal health care records.

(viii) Supporting program integrity purposes, including coordination with the States.

(4) To its enrollees, all informational requirements under § 423.128 and, upon an enrollee's request, the financial disclosure information required under § 423.128(c)(4).

(g) Beneficiary financial protections. The Part D plan sponsor agrees to comply with the following requirements:

(1) Each Part D plan sponsor must adopt and maintain arrangements satisfactory to CMS to protect its enrollees from incurring liability for payment of any fees that are the legal obligation of the Part D sponsor. To meet this requirement, the Part D plan sponsor must—

(i) Ensure that all contractual or other written arrangements prohibit the sponsor's contracting agents from holding any beneficiary enrollee liable for payment of any such fees; and

(ii) Indemnify the beneficiary enrollee for payment of any fees that are the legal obligation of the Part D plan sponsor for covered prescription drugs furnished by non-contracting pharmacists, or that have not otherwise entered into an agreement with the Part D plan sponsor, to provide services to the organization's beneficiary enrollees.

(2) In meeting the requirements of this paragraph, other than the provider contract requirements specified in paragraph (g)(1)(i) of this section, the Part D plan sponsor may use—

(i) Contractual arrangements;

(ii) Insurance acceptable to CMS;

(iii) Financial reserves acceptable to CMS; or

(iv) Any other arrangement acceptable to CMS.

(h) Requirements of other laws and regulations. The Part D plan sponsor agrees to comply with—

(1) Federal laws and regulations designed to prevent fraud, waste, and abuse, including, but not limited to applicable provisions of Federal criminal law, the False Claims Act (31 U.S.C. 3729 et seq.), and the anti-kickback statute (section 1128B(b) of the Act).

(2) HIPAA Administrative Simplification rules at 45 CFR parts 160, 162, and 164.

(i) Relationship with first tier, downstream, and related entities. (1) Notwithstanding any relationship(s) that the Part D plan sponsor may have with first tier, downstream, and related entities, the Part D sponsor maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with CMS.

(2) The Part D sponsor agrees to require all first tier, downstream, and related entities to agree that—

(i) HHS, the Comptroller General, or their designees have the right to audit, evaluate, collect, and inspect any books, contracts, computer or other electronic systems, including medical records and documentation of the first tier, downstream, and related entities related to CMS' contract with the Part D sponsor.

(ii) HHS, the Comptroller General or their designees have the right to audit, evaluate, collect, and inspect any records under paragraph (i)(2)(i) of this section directly from any first tier, downstream, or related entity.

(iii) For records subject to review under paragraph (i)(2)(ii) of this section, except in exceptional circumstances, CMS will provide notification to the Part D sponsor that a direct request for information has been initiated.

(iv) HHS', the Comptroller General's, or their designee's right to inspect, evaluate, and audit any pertinent information for any particular contract period exists through 10 years from the final date of the contract period or from the date of completion of any audit, whichever is later.

(3) Each and every contract governing Part D sponsors and first tier, downstream, and related entities, must contain the following:

(i) Enrollee protection provisions that provide, consistent with paragraph (g)(1) of this section, arrangements that prohibit pharmacies or other providers from holding an enrollee liable for payment of any fees that are the obligation of the Part D plan sponsor.

(ii) Accountability provisions that indicate that the Part D sponsor may delegate activities or functions to a first tier, downstream, or related entity only in a manner consistent with requirements set forth at paragraph (i)(4) of this section.

(iii) A provision requiring that any services or other activity performed by a first tier, downstream, and related entity in accordance with a contract are consistent and comply with the Part D sponsor's contractual obligations.

(iv) Each and every contract must specify that first tier, downstream, and related entities must comply with all applicable Federal laws, regulations, and CMS instructions.

(v) A provision requiring prompt payment of clean claims by the Part D sponsor, consistent with § 423.520.

(vi) A provision that establishes timeframes, consistent with § 423.505(b)(20), for long-term care pharmacies to submit claims to the Part D sponsor for reimbursement under the plan.

(vii) If applicable, provisions addressing the drug pricing standard requirements of § 423.505(b)(21).

(4) If any of the Part D plan sponsors' activities or responsibilities under its contract with CMS is delegated to other parties, the following requirements apply to any first tier, downstream, and related entity:

(i) Each and every contract must specify delegated activities and reporting responsibilities.

(ii) Each and every contract must either provide for revocation of the delegation activities and reporting responsibilities described in paragraph (i)(4)(i) of this section or specify other remedies in instances when CMS or the Part D plan sponsor determine that the parties have not performed satisfactorily.

(iii) Each and every contract must specify that the Part D plan sponsor on an ongoing basis monitors the performance of the parties.

(iv) Each and every contract must specify that the related entity, contractor, or subcontractor must comply with all applicable Federal laws, regulations, and CMS instructions.

(5) If the Part D plan sponsor delegates selection of its prescription drug providers to another organization, the Part D sponsor's written arrangements with that organization must state that the CMS-contracting Part D plan sponsor retains the right to approve, suspend, or terminate any such arrangement.

(6) If the Part D plan sponsor delegates any of the following functions to a first tier, downstream, or related entity, the Part D sponsor's written arrangements must state that a termination initiated by such entity must provide, at minimum, 60-days' prior notice and have an effective termination date that coincides with the end of a calendar month:

(i) Authorization, adjudication, and processing of prescription drug claims at the point of sale.

(ii) Administration and tracking of enrollees' drug benefits in real time, including automated coordination of benefits with other payers.

(iii) Operation of an enrollee appeals and grievance process.

(iv) Contracting with or selection of prescription drug providers for inclusion in the Part D sponsor's network.

(j) Additional contract terms. The Part D plan sponsor agrees to include in the contract other terms and conditions as CMS may find necessary and appropriate in order to implement requirements in this part.

(k) Certification of data that determine payment—(1) General rule. As a condition for receiving a monthly payment under subpart G of this part (or for fallback entities, payment under subpart Q of this part),, the Part D plan sponsor agrees that its chief executive officer (CEO), chief financial officer (CFO), or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must request payment under the contract on a document that certifies (based on best knowledge, information, and belief) the accuracy, completeness, and truthfulness of all data related to payment. The data may include specified enrollment information, claims data, bid submission data, and other data that CMS specifies.

(2) Certification of enrollment and payment information. The CEO, CFO, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that each enrollee for whom the organization is requesting payment is validly enrolled in a program offered by the organization and the information CMS relies on in determining payment is accurate, complete, and truthful and acknowledge that this information will be used for the purposes of obtaining Federal reimbursement.

(3) Certification of claims data. The CEO, CFO, or an individual delegated with the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the claims data it submits under § 423.329(b)(3) (or for fallback entities, under § 423.871(f)) are accurate, complete, and truthful and acknowledge that the claims data will be used for the purpose of obtaining Federal reimbursement. If the claims data are generated by a related entity, contractor, or subcontractor of a Part D plan sponsor, the entity, contractor, or subcontractor must similarly certify (based on best knowledge, information, and belief) the accuracy, completeness, and truthfulness of the data and acknowledge that the claims data will be used for the purposes of obtaining Federal reimbursement.

(4) Certification of bid submission information. The CEO, CFO, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the information in its bid submission and assumptions related to projected reinsurance and low income cost sharing subsidies is accurate, complete, and truthful and fully conforms to the requirements in § 423.265.

(5) Certification of allowable costs for risk corridor and reinsurance information. The Chief Executive Officer, Chief Financial Officer, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the information provided for purposes of supporting allowable costs as defined in § 423.308 of this part, including data submitted to CMS regarding direct or indirect remuneration (DIR) that serves to reduce the costs incurred by the Part D sponsor for Part D drugs, is accurate, complete, and truthful and fully conforms to the requirements in § 423.336 and § 423.343 of this part and acknowledge that this information will be used for the purposes of obtaining Federal reimbursement.

(6) Certification of accuracy of data for price comparison. The CEO, CFO, or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to the officer, must certify (based on best knowledge, information, and belief) that the information provided for purposes of price comparison is accurate, complete, and truthful.

(7) Certification of accuracy of data for overpayments. The CEO, CFO, or COO must certify (based on best knowledge, information, and belief) that the information provided for purposes of reporting and returning of overpayments under § 423.360 is accurate, complete, and truthful.

(l) CMS may use the information collected under paragraph (f)(3) of this section. Any restriction set forth by § 423.322(b) of this part must not be construed to limit the Secretary's authority to use the information collected under paragraph (f)(3).

(m) Release of data. (1) CMS may release the minimum data necessary for a given purpose from the data collected under paragraph (f)(3) of this section to Federal executive branch agencies, States, and external entities in accordance with the following:

(i) Applicable Federal laws.

(ii) CMS data sharing procedures.

(iii) Subject, in certain cases, to encryption of beneficiary identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors, in accordance with all of the following principles:

(A) Subject to the restrictions in this paragraph, all elements on the claim are available to HHS, other executive branch agencies, and the States.

(B) Cost data elements on the claim generally are aggregated for releases to other executive branch agencies, States, and external entities. Upon request, CMS excludes sales tax from the aggregation at the individual level if necessary for the project.

(C) Beneficiary identifier elements on the claim generally are encrypted for release, except in limited circumstances, such as the following:

(1) If needed, in the case of release to other HHS entities, Congressional oversight agencies, non-HHS executive agencies and the States.

(2) If needed to link to another dataset, in the case of release to external entities. Public disclosure of research results will not include beneficiary identifying information.

(iv) For purposes of paragraph (m)(1)(iii) of this section, States and executive-branch Federal agencies are not considered to be external entities.

(2) Any restriction set forth by § 423.322(b) of this part must not be construed to limit the Secretary's authority to release the information collected under paragraph (f)(3) of this section.

(3)(i) CMS must make available to Congressional support agencies (the Congressional Budget Office, the Government Accountability Office, the Medicare Payment Advisory Commission, and the Congressional Research Service when it is acting on behalf of a Congressional committee in accordance with 2 U.S.C. 166(d)(1)) all information collected under paragraph (f)(3) of this section for the purposes of conducting congressional oversight, monitoring, making recommendations, and analysis of the Medicare program.

(ii) The Congressional Research Service is considered an external entity when it is not acting on behalf of a Congressional committee in accordance with 2 U.S.C. 166(d)(1) for the purposes of paragraph (m)(1) of this section.

(n) Issuance of compliance actions for failure to comply with the terms of the contract. The Part D plan sponsor acknowledges that CMS may take compliance actions as described in this section or intermediate sanctions as defined in subpart O of this part.

(1) CMS may take compliance actions as described in paragraph (n)(3) of this section if it determines that the Part D plan sponsor has not complied with the terms of a current or prior Part D contract with CMS.

(i) CMS may determine that a Part D plans sponsor is out of compliance with a Part D requirement when the organization fails to meet performance standards articulated in the Part D statutes, regulations in this chapter, or guidance.

(ii) If CMS has not already articulated a measure for determining noncompliance, CMS may determine that a Part D plan sponsor is out of compliance when its performance in fulfilling Part D requirements represents an outlier relative to the performance of other Part D plan sponsors.

(2) CMS bases its decision on whether to issue a compliance action and what level of compliance action to take on an assessment of the circumstances surrounding the noncompliance, including all of the following:

(i) The nature of the conduct.

(ii) The degree of culpability of the Part D plan sponsor.

(iii) The adverse effect to beneficiaries which resulted or could have resulted from the conduct of the Part D plan sponsor.

(iv) The history of prior offenses by the Part D plan sponsor or its related entities.

(v) Whether the noncompliance was self-reported.

(vi) Other factors which relate to the impact of the underlying noncompliance or the lack of the Part D plan sponsor's oversight of its operations that contributed to the noncompliance.

(3) CMS may take one of three types of compliance actions based on the nature of the noncompliance.

(i) Notice of noncompliance. A notice of noncompliance may be issued for any failure to comply with the requirements of the Part D plan sponsor's current or prior Part D contract with CMS, as described in paragraph (n)(1) of this section.

(ii) Warning letter. A warning letter may be issued for serious and/or continued noncompliance with the requirements of the Part D plan sponsor's current or prior Part D contract with CMS, as described in paragraph (n)(1) of this section and as assessed in accordance with paragraph (n)(2) of this section.

(iii) Corrective action plan. (A) Corrective action plans are issued for particularly serious and/or continued noncompliance with the requirements of the Part D plan sponsors' current or prior Part D contract with CMS, as described in paragraph (n)(1) of this section and as assessed in accordance with paragraph (n)(2) of this section.

(B) CMS issues a corrective action plan if CMS determines that the Part D plan sponsor has repeated or not corrected noncompliance identified in prior compliance actions, has substantially impacted beneficiaries or the program with its noncompliance, and/or must implement a detailed plan to correct the underlying causes of the noncompliance.

(o) Acknowledgements of CMS release of data—(1) Summary CMS payment data. The contract must provide that the Part D sponsor acknowledges that CMS releases to the public summary reconciled Part D payment data after the reconciliation of Part D payments for the contract year as follows:

(i) The average per member per month Part D direct subsidy standardized to the 1.0 (average risk score) beneficiary for each Part D plan offered.

(ii) The average Part D risk score for each Part D plan offered.

(iii) The average per member per month Part D plan low-income cost sharing subsidy for each Part D plan offered.

(iv) The average per member per month Part D Federal reinsurance subsidy for each Part D plan offered.

(v) The actual Part D reconciliation payment data summarized at the Parent Organization level including breakouts of risk sharing, reinsurance, and low income cost sharing reconciliation amounts.

(2) Part D MLR data. The contract must provide that the Part D sponsor acknowledges that CMS releases to the public data as described at § 423.2490.

(p) Business continuity. (1) The Part D sponsor agrees to develop, maintain, and implement a business continuity plan containing policies and procedures to ensure the restoration of business operations following disruptions to business operations during disruptions to business operations which would include natural or man-made disasters, system failures, emergencies, and other similar circumstances and the threat of such occurrences. To meet the requirement, the business continuity plan must, at a minimum, include the following:

(i) Risk assessment. Identify threats and vulnerabilities that might affect business operations.

(ii) Mitigation strategy. Design strategies to mitigate hazards. Identify essential functions in addition to those specified in paragraph (p)(2) of this section and prioritize the order in which to restore all other functions to normal operations. At a minimum, each Part D sponsor must do the following:

(A) Identify specific events that will activate the business continuity plan.

(B) Develop a contingency plan to maintain, during any business disruption, the availability and, as applicable, confidentiality of communication systems and essential records in all forms (including electronic and paper copies). The contingency plan must do the following:

(1) Ensure that during any business disruption the following systems will operate continuously or, should they fail, be restored to operational capacity on a timely basis:

(i) Information technology (IT) systems including those supporting claims processing at point of service.

(ii) Provider and enrollee communication systems including telephone, Web site, and email.

(2) With respect to electronic protected health information, comply with the contingency plan requirements of the Health Insurance Portability and Accountability Act of 1996 Security Regulations at 45 CFR parts 160 and 164, subparts A and C.

(C) Establish a chain of command.

(D) Establish a business communication plan that includes emergency capabilities and procedures to contact and communicate with the following:

(1) Employees.

(2) First tier, downstream, and related entities.

(3) Other third parties (including pharmacies, providers, suppliers, and government and emergency management officials).

(E) Establish employee and facility management plans to ensure that essential operations and job responsibilities can be assumed by other employees or moved to alternate sites as necessary or both.

(F) Establish a restoration plan including procedures to transition to normal operations.

(G) Comply with all applicable Federal, State, and local laws.

(iii) Testing and revision. On at least an annual basis, test and update the business operations continuity plan to ensure the following:

(A) That it can be implemented in emergency situations.

(B) That employees understand how it is to be executed.

(iv) Training. On at least an annual basis, educate appropriate employees about the business continuity plan and their own respective roles.

(v) Records. (A) Develop and maintain records documenting the elements of the business continuity plan described in paragraph (p)(1)(i) through (iv) of this section.

(B) Make the information specified in paragraph (p)(1)(v)(A) of this section available to CMS upon request.

(2) Restoration of essential functions. Every Part D sponsor must plan to restore essential functions within 72 hours after any of the essential functions fail or otherwise stop functioning as usual. In addition to any essential functions that the Part D sponsor identifies under paragraph (p)(1)(ii) of this section, for purposes of this paragraph (p)(2) of this section essential functions include at a minimum, the following:

(i) Benefit authorization (if not waived), adjudication, and processing of prescription drug claims at the point of sale.

(ii) Administration and tracking of enrollees' drug benefits in real time, including automated coordination of benefits with other payers.

(iii) Provision of pharmacy technical assistance.

(iv) Operation of an enrollee exceptions and appeals process including coverage determinations.

(v) Operation of call center customer services.

(q) Enrollment in the Medicare Transaction Facilitator Data Module for the Medicare Drug Price Negotiation Program. For contract year 2026 and all subsequent years, any contract between the sponsor and a pharmacy, or between a first tier, downstream, or related entity and a pharmacy on the sponsor's behalf, for participation in one or more of the Part D sponsor's networks must include a provision requiring the pharmacy to be enrolled in the Medicare Transaction Facilitator Data Module (MTF DM) (or any successor to the MTF DM) in a form and manner determined by CMS. Such provision must also require the pharmacy to maintain and certify up-to-date, complete, and accurate enrollment information with the MTF DM, in accordance with applicable terms and conditions of participation with the MTF DM, including but not limited to contact, third-party support entity or entities, and banking information, in a form and manner determined by CMS.