Medicare Program; Revisions to the Medicare Advantage and Part D Prescription Drug Contract Determinations, Appeals, and Intermediate Sanctions Processes, 68700-68741 [07-5946]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 72, Number 233 (Wednesday, December 5, 2007)]
[Rules and Regulations]
[Pages 68700-68741]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 07-5946]



[[Page 68699]]

-----------------------------------------------------------------------

Part V





Department of Health and Human Services





-----------------------------------------------------------------------



Centers for Medicare & Medicaid Services



-----------------------------------------------------------------------



42 CFR Parts 422 and 423



Medicare Program; Revisions to the Medicare Advantage and Part D 
Prescription Drug Contract Determinations, Appeals, and Intermediate 
Sanctions Processes; Final Rule

Federal Register / Vol. 72, No. 233 / Wednesday, December 5, 2007 / 
Rules and Regulations

[[Page 68700]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Parts 422 and 423

[CMS-4124-FC]
RIN 0938-AO78


Medicare Program; Revisions to the Medicare Advantage and Part D 
Prescription Drug Contract Determinations, Appeals, and Intermediate 
Sanctions Processes

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Final rule with comment period.

-----------------------------------------------------------------------

SUMMARY: This rule with comment period finalizes the Medicare program 
provisions relating to contract determinations involving Medicare 
Advantage (MA) organizations and Medicare Part D prescription drug plan 
sponsors, including eliminating the reconsideration process for review 
of contract determinations, revising the provisions related to appeals 
of contract determinations, and clarifying the process for MA 
organizations and Part D plan sponsors to complete corrective action 
plans. In this final rule with comment period, we also clarify the 
intermediate sanction and civil money penalty (CMP) provisions that 
apply to MA organizations and Medicare Part D prescription drug plan 
sponsors, modify elements of their compliance plans, retain voluntary 
self-reporting for Part D sponsors and implement a voluntary self-
reporting recommendation for MA organizations, and revise provisions to 
ensure HHS has access to the books and records of MA organizations and 
Part D plan sponsors' first tier, downstream, and related entities. 
Although we have decided not to finalize the mandatory self-reporting 
provisions that we proposed, CMS remains committed to adopting a 
mandatory self-reporting requirement. To that end, we are requesting 
comments that will assist CMS in crafting a future proposed regulation 
for a mandatory self-reporting requirement.

DATES: Effective date: These regulations are effective on January 4, 
2008, except for the amendments to Sec. Sec.  422.503, 422.504, 
423.504, and 423.505, which are effective January 1, 2009.
    Comment Period: We will consider comments on the mandatory self-
reporting provisions discussed in section II of this final rule with 
comment period at the appropriate address, as provided below, no later 
than February 4, 2008.

ADDRESSES: In commenting, please refer to file code CMS-4124-FC. 
Because of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    You may submit comments in one of four ways (no duplicates, 
please):
    1. Electronically. You may submit electronic comments on specific 
issues in this regulation to https://www.cms.hhs.gov/eRulemaking. Click 
on the link ``Submit electronic comments on CMS regulations with an 
open comment period.'' (Attachments should be in Microsoft Word, 
WordPerfect, or Excel; however, we prefer Microsoft Word.)
    2. By regular mail. You may mail written comments (one original and 
two copies) to the following address ONLY: Centers for Medicare & 
Medicaid Services, Department of Health and Human Services, Attention: 
CMS-4124-FC, P.O. Box 8020, Baltimore, MD 21244-8020.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments (one 
original and two copies) to the following address ONLY: Centers for 
Medicare & Medicaid Services, Department of Health and Human Services, 
Attention: CMS-4124-FC, Mail Stop C4-26-05, 7500 Security Boulevard, 
Baltimore, MD 21244-1850.
    4. By hand or courier. If you prefer, you may deliver (by hand or 
courier) your written comments (one original and two copies) before the 
close of the comment period to one of the following addresses. If you 
intend to deliver your comments to the Baltimore address, please call 
telephone number (410) 786-9994 in advance to schedule your arrival 
with one of our staff members.

Room 445-G, Hubert H. Humphrey Building, 200 Independence Avenue, SW., 
Washington, DC 20201; or
7500 Security Boulevard, Baltimore, MD 21244-1850.

    (Because access to the interior of the HHH Building is not readily 
available to persons without Federal Government identification, 
commenters are encouraged to leave their comments in the CMS drop slots 
located in the main lobby of the building. A stamp-in clock is 
available for persons wishing to retain a proof of filing by stamping 
in and retaining an extra copy of the comments being filed.)
    Comments mailed to the addresses indicated as appropriate for hand 
or courier delivery may be delayed and received after the comment 
period.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT:
    Christine Reinhard, (410) 786-2987.
    Kevin Stansbury, (410) 786-2570.
    Stephanie Kaisler, (410) 786-0957, for issues regarding voluntary 
self-reporting, access to records, and compliance.

SUPPLEMENTARY INFORMATION:
    Submitting Comments: We welcome comments from the public on 
mandatory self-reporting to assist us in fully considering issues and 
developing policies. You can assist us by referencing the file code 
CMS-4124-FC and ``self-reporting.''
    Inspection of Public Comments: All comments received before the 
close of the comment period are available for viewing by the public, 
including any personally identifiable or confidential business 
information that is included in a comment. We post all comments 
received before the close of the comment period on the following Web 
site as soon as possible after they have been received: https://
www.cms.hhs.gov/eRulemaking. Click on the link ``Electronic Comments on 
CMS Regulations'' on that Web site to view public comments.
    Comments received timely will also be available for public 
inspection as they are received, generally beginning approximately 3 
weeks after publication of a document, at the headquarters of the 
Centers for Medicare & Medicaid Services, 7500 Security Boulevard, 
Baltimore, Maryland 21244, Monday through Friday of each week from 8:30 
a.m. to 4 p.m. To schedule an appointment to view public comments, 
phone 1-800-743-3951.

Abbreviations

    Because of the many terms to which we refer by abbreviation in this 
final rule with comment period, we are listing these abbreviations and 
their corresponding terms in alphabetical order below:

ALJ Administrative Law Judge
BBA Balanced Budget Act of 1997
CAP Corrective Action Plan
CMP Civil Money Penalty
CMS Centers for Medicare & Medicaid Services
DAB Departmental Appeals Board
FWA Fraud, Waste, and Abuse
HHS U.S. Department of Health and Human Services
MA Medicare Advantage
MMA Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003
M+C Medicare + Choice
OIG Office of the Inspector General

[[Page 68701]]

PBM Pharmaceutical Benefit Manager
PDE Prescription Drug Event

I. Background

    On May 25, 2007, we published a proposed rule in the Federal 
Register (72 FR 29368, hereafter referred to as the proposed rule), 
setting forth the proposed provisions relating to contract 
determinations involving Medicare Advantage (MA) organizations and 
Medicare Part D prescription drug plan sponsors, intermediate sanction 
and civil money penalty (CMP) provisions, compliance plans, mandatory 
self-reporting, and provisions to ensure the Department of Health and 
Human Services (HHS) has access to the books and records of MA 
organizations and Part D plan sponsors' first tier, downstream, and 
related entities. In this final rule with comment period we are 
finalizing the majority of the provisions of the proposed rule, with 
some clarifications in response to public comments. At this time, we 
are not finalizing the proposed provision for mandatory self-reporting 
of potential fraud and abuse, but we intend to issue future rulemaking 
on this topic, as discussed below in section II.

A. Overview of the Medicare Prescription Drug, Improvement, and 
Modernization Act of 2003 (MMA)

    The President signed the Medicare Prescription Drug, Improvement, 
and Modernization Act of 2003 (MMA) (Pub. L. 108-173) into law on 
December 8, 2003. The MMA established the Medicare prescription drug 
benefit program and renamed the Medicare+Choice (M+C) program the 
Medicare Advantage (MA) program. In accordance with the MMA, we revised 
the existing Medicare regulations applicable to the MA program at 42 
CFR part 422 and published regulations governing the prescription drug 
benefit program at 42 CFR part 423.
    As we have gained more experience with MA organizations and Part D 
prescription drug plan sponsors, we proposed clarifications to the 
Medicare program provisions relating to contract determinations 
involving MA organizations and Medicare Part D prescription drug plan 
sponsors, including eliminating the reconsideration process for review 
of contract determinations; revising the provisions related to appeals 
of contract determinations and clarifying the process for MA 
organizations and Part D plan sponsors to complete corrective action 
plans. We proposed clarifications to the intermediate sanction and 
civil money penalty (CMP) provisions that apply to MA organizations and 
Medicare Part D prescription drug plan sponsors. We also proposed 
changes in both programs to clarify elements of the compliance plan 
requirements, such as training and education, and changes to clarify 
our access to the books and records of a MA organization or Part D 
sponsor's first tier, downstream, and related entities. Finally, we 
proposed a self-reporting requirement as part of both MA organization 
and Part D sponsor's compliance plans. We have decided at this time not 
to finalize the provision requiring mandatory self-reporting of 
potential fraud and misconduct. Until such time as such a provision is 
finalized, we have chosen to retain voluntary self-reporting for Part D 
sponsors and implement a recommendation for voluntary self-reporting 
for MA Organizations.

B. Relevant Legislative History and Overview

    The Balanced Budget Act of 1997 (BBA) (Pub. L. 105-33) established 
the M+C program. Under section 1851(a)(1) of the Social Security Act 
(the Act), every individual with Medicare Parts A and B, except for 
individuals with end-stage renal disease (ESRD), could elect to receive 
benefits either through the original Medicare program or an M+C plan, 
if one was offered where the beneficiary lived. The primary goal of the 
M+C program was to provide Medicare beneficiaries with a wider range of 
health plan choices.
    The Medicare, Medicaid, and State Children's Health Insurance 
Program (SCHIP) Balanced Budget Refinement Act of 1999 (BBRA) (Pub. L. 
106-113), amended the M+C provisions of the BBA. Further amendments 
were made to the M+C program by the Medicare, Medicaid, and SCHIP 
Benefits Improvement and Protection Act of 2000 (BIPA) (Pub. L. 106-
554), enacted December 21, 2000.
    The President signed the MMA into law on December 8, 2003. Title I 
of the MMA added new sections 1860D-1 through 1860D-42 to the Act 
creating the Medicare Prescription Drug Benefit program, a landmark 
change to the Medicare program since its inception in 1965.
    Sections 201 through 241 of Title II of the MMA made significant 
changes to the M+C program. As directed by Title II of the MMA, we 
renamed the M+C program the MA program. We also revised our regulations 
to include new payment and bidding provisions based largely on risk, to 
recognize the addition of regional Preferred Provider Organization 
(PPO) plans, to address the provision of prescription drug benefits 
under the Medicare Part D regulations, and to make other changes.
    The MMA, at section 1860D-12(b)(3) of the Act, directed that 
specific aspects of the MA contracting requirements apply to the 
prescription drug plan benefit program. Consequently, the processes for 
contract determinations and the administrative appeal rights in the two 
programs are virtually identical.
    We published the regulations implementing the MA and prescription 
drug benefit regulations separately, though their development and 
publication were closely coordinated. On August 3, 2004, we published 
proposed rules for the MA program (69 FR 46866) and prescription drug 
benefit program (69 FR 46632). The final regulations implementing both 
the MA and prescription drug programs were published on January 28, 
2005 (70 FR 4588 and 70 FR 4194, respectively). We revised some of our 
proposed provisions in the final rules in response to public comments. 
For further discussion of the revisions we made to our proposed rules, 
see the final rules cited above. We have not issued previous guidance, 
other than regulatory requirements regarding contract determinations, 
corrective action plans, contract determination appeals, intermediate 
sanctions, or CMPs. However, we have published guidance on how to 
develop an effective fraud, waste and abuse (FWA) prevention program. 
This guidance is found in Chapter 9 of the Prescription Drug Benefit 
Manual entitled ``Part D Program to Control Fraud, Waste and Abuse.'' 
This rule makes further revisions to the MA and prescription drug 
regulations.

II. Summary of the Provisions of the Proposed Rule and Analysis of and 
Response to Public Comments

    In response to the publication of the May 25, 2007 proposed rule, 
we received 58 timely items of correspondence from the public. We 
received numerous comments from various trade associations and health 
insurance providers. Comments also originated from other providers, 
suppliers, and practitioners, health care consulting firms, and private 
citizens.
    Brief summaries of each proposed provision, a summary of the public 
comments we received (with the exception of specific comments on the 
paperwork burden or the impact analysis), and our responses to the 
comments are set forth below. Comments related to the paperwork burden 
and the impact analysis are addressed in the Collection of Information 
and Impact Analysis Sections in this preamble.

[[Page 68702]]

A. General Comments on the Proposed Rule

    Comment: We received a question related to the applicability of the 
Part 423 provisions to Medicare cost contractors who offer Part D 
plans.
    Response: Cost plans, per 42 CFR 417.440(b)(2)(ii), which offer a 
Part D prescription drug program as an optional supplemental benefit, 
must offer the benefits ``in accordance with applicable requirements 
under Part 423.'' The current proposed revisions do not change the 
existing regulations. Therefore, the Part 423 regulations would 
continue to apply to cost plans just as they have prior to the 
publication of this rule.

B. Proposed Changes to the Medicare Advantage Program and the 
Prescription Drug Benefit Program

    Our experience involving contract determinations, appeals, 
intermediate sanctions, and CMPs since the enactment of the BBA of 1997 
led us to propose changes to our regulations. In the proposed rule, we 
proposed to simplify the procedures for contract determinations; to 
clarify the procedures regarding submission and review of corrective 
action plans; to clarify the procedures for imposition of intermediate 
sanctions and CMPs; and to clarify the procedures to appeal CMPs 
imposed under the MA and Part D programs.
    In addition, we proposed revisions to the appeal procedures for all 
types of contract determinations, which would make these procedures 
identical for decisions not to contract, nonrenewals, and terminations. 
We proposed to provide for enhanced beneficiary protections when we 
decide to terminate a plan on an expedited basis.
    In the proposed rule, we also proposed changes and clarifications 
to Subpart K, contract requirements under the MA and Part D programs. 
We proposed changes to clarify HHS' access to the books and records of 
a MA organization or Part D sponsor's first tier, downstream, and 
related entities. We also proposed changes to clarify that certain 
elements of the compliance plan apply to first tier, downstream, and 
related entities. We also proposed mandatory self-reporting in both the 
MA and Part D programs, but we are not finalizing the provision at this 
time.
    Below, we set forth the final regulatory changes, and corresponding 
final implementation dates:

------------------------------------------------------------------------
                                                        Implementation
                  Regulation change                          date
------------------------------------------------------------------------
Incorporation of Fraud, Waste, and Abuse Prevention             1/1/2009
 Measures into Compliance Plan......................
Requirement to apply Compliance Plan's training and             1/1/2009
 communication requirements to first tier,
 downstream, and related entities...................
Voluntary procedures for MA organizations for self-             1/1/2009
 reporting potential fraud and misconduct...........
Requirement to obtain access to Part D sponsor's                1/1/2009
 first tier, downstream, and related entity's books
 and records through contractual arrangements.......
Elimination of CMS' requirement to inform                       1/4/2008
 organization of renewal............................
Change date of CMS' notification of non-renewal from            1/4/2008
 May 1 to August 1..................................
Provide for same administrative appeal rights                   1/4/2008
 (including Corrective Action Plans (CAPs)) for all
 contract determinations (non-renewal, expedited
 termination, termination)..........................
Change regarding CAP process may be provided prior              1/4/2008
 to notification of termination, and the imposition
 of time limits on Corrective Action Plans..........
Change immediate termination to expedited                       1/4/2008
 termination with CMS setting the effective date of
 termination........................................
Elimination of Reconsideration Step for contract                1/4/2008
 determination appeals..............................
Implementation of Burden of Proof for contract                  1/4/2008
 determinations.....................................
Ability for a hearing officer to issue summary                  1/4/2008
 judgment...........................................
Request for Administrator review, submission of                 1/4/2008
 information, and timeframe associated with
 Administrator review...............................
Settlement of Civil Money Penalties.................            1/4/2008
Appeal procedures for Civil Money Penalties.........            1/4/2008
------------------------------------------------------------------------

    We did not receive any comments on the implementation dates we 
proposed and are generally finalizing the implementation dates as we 
proposed, with minor modification to reflect that certain provisions 
will be effective on January 4, 2008. However, since we are not 
implementing the proposed mandatory self-reporting requirement at this 
time, we have only included a reference to an implementation date for 
the voluntary self-reporting recommendation for MA organizations in the 
above chart. We are retaining the existing voluntary self-reporting 
recommendation for Part D sponsors so that recommendation is currently 
in effect and will remain in effect in the future.

C. Distribution Table

    The following crosswalk table references the changes we are making 
to the prescription drug and the MA programs. We proposed making the 
same changes to 42 CFR parts 422 and 423 with minimal differences. The 
crosswalk lists the section headings, for parts 422 and 423, and 
indicates if the section is being deleted.

                            Table 1.--Crosswalk of Part 422 and Part 423 CFR Sections
----------------------------------------------------------------------------------------------------------------
                                                      Section references in
                  Section heading                           part 422            Section references in part 423
----------------------------------------------------------------------------------------------------------------
Definitions.......................................  422.2...................  423.4
Compliance Plan...................................  422.503(b)(4)(vi).......  423.504(b)(4)(vi)
Access to Facilities and Records..................  422.504(e) and            423.505(e)
                                                     422.503(d)(2)(iii).
Contract Provisions...............................  422.504(i)..............  423.505(i)
Effective Date and Term of Contract...............  422.505.................  423.506
Non-renewal of contract...........................  422.506.................  423.507

[[Page 68703]]

 
Termination of contract by CMS....................  422.510.................  423.509
Notice of contract determination..................  422.644.................  423.642
Effect of contract determination..................  422.646.................  423.643
Reconsideration: applicability....................  422.648 (delete)........  423.644 (delete)
Request for reconsideration.......................  422.650 (delete)........  423.645 (delete)
Opportunity to submit evidence....................  422.652 (delete)........  423.646 (delete)
Reconsidered determination........................  422.654 (delete)........  423.647 (delete)
Notice of reconsidered determination..............  422.656 (delete)........  423.648 (delete)
Effect of reconsidered determination..............  422.658 (delete)........  423.649 (delete)
Right to a hearing and burden of proof............  422.660.................  423.650
Request for hearing...............................  422.662.................  423.651
Postponement of effective date of a contract        422.664.................  423.652
 determination when a request for a hearing with
 respect to a contract determination is filed
 timely.
Time and Place of Hearing.........................  422.670.................  423.655
Discovery.........................................  422.682.................  423.661
Prehearing and Summary Judgment...................  422.684.................  423.662
Review by the Administrator.......................  422.692.................  423.666
Reopening of initial contract determination or      422.696.................  423.668
 intermediate sanction or decision of a hearing
 officer or the Administrator.
Effect of revised determination...................  422.698 (delete)........  423.669 (delete)
Types of intermediate sanctions and civil money     422.750.................  423.750
 penalties.
Basis for imposing intermediate sanctions and       422.752.................  423.752
 civil money penalties.
Procedures for imposing intermediate sanctions and  422.756.................  423.756
 civil money penalties.
Collection of civil money penalty imposed by CMS..  422.758.................  423.758
Determinations regarding the amount of civil money  422.760.................  423.760
 penalties and assessment imposed by CMS.
Settlement of penalties...........................  422.762.................  423.762
Other applicable provisions.......................  422.764.................  423.764
Basis and scope...................................  422.1000................  423.1000
Definitions.......................................  422.1002................  423.1002
Scope and applicability...........................  422.1004................  423.1004
Appeal rights.....................................  422.1006................  423.1006
Appointment of representatives....................  422.1008................  423.1008
Authority of representatives......................  422.1010................  423.1010
Fees for services of representatives..............  422.1012................  423.1012
Charge for transcripts............................  422.1014................  423.1014
Filing of briefs with the Administrative Law Judge  422.1016................  423.1016
 or Departmental Appeals Board, and opportunity
 for rebuttal.
Notice and effect of initial determinations.......  422.1018................  423.1018
Request for hearing...............................  422.1020................  423.1020
Parties to the hearing............................  422.1022................  423.1022
Designation of hearing official...................  422.1024................  423.1024
Disqualification of Administrative Law Judge......  422.1026................  423.1026
Prehearing conference.............................  422.1028................  423.1028
Notice of prehearing conference...................  422.1030................  423.1030
Conduct of prehearing conference..................  422.1032................  423.1032
Record, order, and effect of prehearing conference  422.1034................  423.1034
Time and place of hearing.........................  422.1036................  423.1036
Change in time and place of hearing...............  422.1038................  423.1038
Joint hearing.....................................  422.1040................  423.1040
Hearing on new issues.............................  422.1042................  423.1042
Subpoenas.........................................  422.1044................  423.1044
Conduct of hearing................................  422.1046................  423.1046
Evidence..........................................  422.1048................  423.1048
Witnesses.........................................  422.1050................  423.1050
Oral and written summation........................  422.1052................  423.1052
Record of hearing.................................  422.1054................  423.1054
Waiver of right to appear and present evidence....  422.1056................  423.1056
Dismissal of request for hearing..................  422.1058................  423.1058
Dismissal for abandonment.........................  422.1060................  423.1060
Dismissal for cause...............................  422.1062................  423.1062
Notice and effect of dismissal and right to         422.1064................  423.1064
 request review.
Vacating a dismissal of request for hearing.......  422.1066................  423.1066
Administrative Law Judge's decision...............  422.1068................  423.1068
Removal of hearing to Departmental Appeals Board..  422.1070................  423.1070
Remand by the Administrative Law Judge............  422.1072................  423.1072
Right to request Departmental Appeals Board review  422.1074................  423.1074
 of Administrative Law Judge's decision or
 dismissal.
Request for Departmental Appeals Board review.....  422.1076................  423.1076
Departmental Appeals Board action on request for    422.1078................  423.1078
 review.
Procedures before Departmental Appeals Board on     422.1080................  423.1080
 review.

[[Page 68704]]

 
Evidence admissible on review.....................  422.1082................  423.1082
Decision or remand by the Departmental Appeals      422.1084................  423.1084
 Board.
Effect of Departmental Appeals Board decision.....  422.1086................  423.1086
Extension of time for seeking judicial review.....  422.1088................  423.1088
Basis, timing, and authority for reopening an       422.1090................  423.1090
 Administrative Law Judge or Board decision.
Revision of reopened decision.....................  422.1092................  423.1092
Notice and effect of revised decision.............  422.1094................  423.1094
----------------------------------------------------------------------------------------------------------------

    We did not receive any comments on the crosswalk distribution table 
and have made no substantial changes to it. We are finalizing the table 
as proposed.

D. Proposed Changes to Part 422--Medicare Advantage Program and Part 
423--Medicare Prescription Drug Benefit Program

Sections 422.2 and 423.4--Definitions
    We proposed to correct a technical oversight in both regulations by 
including the definitions of ``downstream entity,'' ``first tier 
entity,'' and ``related entity,'' in the overall definitions sections 
of both the MA and Part D regulations at Sec.  422.2 and Sec.  423.4 to 
ensure that these terms are used consistently throughout both programs. 
Since these three terms are only defined in Subpart K of parts 422 and 
423, we proposed to add them to Subpart A, General Provisions at Sec.  
422.2 and Sec.  423.4.
    Please see page 29372 of the proposed rule for a flow chart that 
provides examples of, and describes the relationships between, Part D 
sponsors, and first tier, downstream, and related entities.
    Comment: A few commenters requested more explicit definitions of 
first tier, downstream, and related entities. They asked us to provide 
clarification for the terms record retention, administrative services, 
written arrangements, acceptable to CMS, CMS instructions, and 
directors. We also received a request that we clarify the phrase ``a 
written agreement, acceptable to CMS,'' found in the definition of 
``downstream entity,'' and a request that we clarify which entities are 
involved in such an arrangement.
    Response: The terms ``first tier entity,'' ``downstream entity,'' 
and ``related entity'' are already defined in Subpart K of parts 422 
and 423, and we are only including them in Subpart A, General 
Provisions at Sec.  422.2 and Sec.  423.4 for clarity, since these 
terms were originally defined in only Subpart K. Examples of downstream 
entities include, but are not limited to, pharmacy benefit managers, 
mail order pharmacies, retail pharmacies, firms providing agent/broker 
services, agents, brokers, marketing firms, and call center firms. We 
are neither providing definitions nor clarifications for the terms 
``record retention,'' ``administrative services,'' ``written 
arrangements,'' ``acceptable to CMS,'' ``CMS instructions,'' or 
``directors,'' since these terms are longstanding terms used by us and 
the industry. We are finalizing the definitions of ``first tier 
entity'' and ``related entity'' as proposed.
    Based upon an unintentional oversight in the proposed regulation, 
we are revising the definition of ``downstream entity'' for improved 
clarity, as described below. The definition of a Part D ``downstream 
entity'' at Sec.  423.4 states that a ``[d]ownstream entity means any 
party that enters into a written arrangement acceptable to CMS, below 
the level of the arrangement between a Part D plan sponsor (or 
applicant) and a first tier entity.'' In response to this comment, we 
are modifying the proposed definition to address with whom the entity 
is entering into a written arrangement. The definition is revised to 
read: ``Downstream entity means any party that enters into a written 
arrangement, acceptable to CMS, with persons or entities involved with 
the Part D benefit, below the level of the arrangement between a Part D 
plan sponsor (or applicant) and a first tier entity. These written 
arrangements continue down to the level of the ultimate provider of 
both health and administrative services.'' We are making similar 
changes to the definition of ``downstream entity'' in the MA regulation 
at Sec.  422.2.
    Comment: One commenter questioned whether a pharmacist is a 
downstream entity.
    Response: As illustrated in the sample flowchart provided on p. 
29372 of the proposed rule, and below, a pharmacist would be considered 
a downstream entity as defined in the regulation.

[[Page 68705]]

[GRAPHIC] [TIFF OMITTED] TR05DE07.014

Sections 422.503 and 423.504--General Provisions
    The current regulations at Sec.  423.504 include a requirement that 
a Part D sponsor's compliance plan consist of training and education, 
and effective lines of communication between the compliance officer, 
and the organization's employees, contractors, agents, directors, and 
managers. The terms ``contractor'' and ``agent'' are not defined in the 
current regulations, and it has been unclear to the industry which 
entities are subject to the training and education, and the effective 
lines of communication requirements. In response to industry concerns 
and to eliminate the confusion associated with using the term 
``contractor'', currently used in those sections, we proposed to revise 
paragraphs (b)(4)(vi)(C) and (b)(4)(vi)(D) of Sec.  423.504. The 
proposed revision clarified that a compliance plan must consist of 
training and education, and effective lines of communication between 
the compliance officer and the Part D sponsor's employees, managers, 
and directors, as well as the Part D sponsor's ``first tier, 
downstream, and related entities'' which are defined at 422.500 and 
423.501. This change clarifies that Part D plan sponsors need to apply 
these training and communication requirements to all entities they are 
partnering with to provide benefits or services in the Part D program, 
not just to their direct employees within their organizations.
    Pursuant to our authority under Sec.  1856(b)(1) of the Act to 
establish MA standards by regulation, we also proposed to make the same 
changes in the MA program. We similarly proposed to require MA 
organizations to apply their training and education and effective lines 
of communication requirements to their first tier, downstream, and 
related entities, in an effort to make the compliance plan requirements 
uniform across MA organizations, Medicare Advantage Prescription Drug 
Plans (MA-PDs), and other Part D sponsors. Additionally, we proposed 
clarifying paragraph (b)(4)(vi) in Sec.  422.503 and Sec.  423.504 by 
removing what we believe to be a duplicative and confusing ``final 
element'' of the compliance plan--a comprehensive ``fraud, waste, and 
abuse plan to detect, correct, and prevent fraud, waste, and abuse,'' 
at paragraph (b)(4)(vi)(H) of both regulations. We proposed to remove 
this element because since the Part D program's inception, we received 
feedback from many Part D sponsors indicating that it was not clear 
whether we were requiring a fraud, waste, and abuse (FWA) plan separate 
and distinct from a compliance plan.
    In April 2006, we issued Chapter 9 of the Prescription Drug Benefit 
Manual (``Part D Program to Control Fraud, Waste and Abuse,'' hereafter 
referred to as ``Chapter 9'') as best practices guidance for Part D 
sponsors to develop an FWA plan. We intend for Chapter 9 to be similar 
to the type of best practices guidance issued by the Office of the 
Inspector General (OIG) in its Compliance Program Guidance for drug 
manufacturers and health care providers. While we clarified in Chapter 
9 that Part D sponsors could choose whether to incorporate FWA measures 
in a compliance plan, we believe the final element continues to cause 
potential confusion to the industry, and therefore, proposed to remove 
this element from (b)(4)(vi) of Sec.  422.503 (for MA-PDs) and Sec.  
423.504 (for Part D sponsors).
    We continue to believe an effective compliance plan includes 
procedures and policies for preventing fraud, waste, and abuse, and so 
proposed changes to the introductory clause of Sec.  423.504(b)(4)(vi) 
that reflect our policy stance. Congress mandated that Part D sponsors 
have a ``program to control fraud, waste, and abuse.'' See Sec.  1860D-
4(c)(1)(D) of the Act. Therefore, we are also clarifying that if Part D 
plan sponsors develop an effective compliance plan that incorporates 
measures to detect, prevent, and correct fraud, waste, and abuse, this 
compliance plan would also satisfy the statutory requirement that 
sponsors have a FWA plan in place. Part D sponsors should continue to 
look to Chapter 9 as recommended guidance for the types of measures we 
recommend in detecting and preventing fraud, waste, and abuse. Chapter 
9 can be viewed at: https://www.cms.gov/PrescriptionDrugCovContra/
Downloads/PDBManual_Chapter9_FWA.pdf.
    We recognize that Chapter 9 was specifically developed for Part D 
sponsors and is not applicable for MA organizations that do not offer a 
prescription drug benefit. In the interim,

[[Page 68706]]

MA organizations should refer to Chapter 9 as a reference regarding how 
to incorporate fraud, waste, and abuse detection and prevention into 
their compliance plans. We plan to develop separate guidelines for MA 
organizations for implementation by January 1, 2009.
    Pursuant to our authority under section 1856(b)(1) of the Act, we 
also proposed to make the same change to the introductory clause of 
Sec.  422.503(b)(4)(vi), so that the compliance plan requirements for 
MA organizations will be identical to those for Part D sponsors. We 
proposed that MA organizations must include ``measures to detect, 
correct, and prevent fraud, waste, and abuse'' throughout the 7 
elements of the compliance plan requirement. Before this proposed 
change, only MA-PDs were explicitly required to include detection and 
prevention of fraud, waste, and abuse into their compliance plans. 
However, it has always been our expectation that fraud, waste, and 
abuse would be addressed through the implementation of all 7 elements 
in a MA organization's compliance plan, enumerated at paragraphs (A) 
through (G) of Sec.  422.504(b)(4)(vi). It has been our longstanding 
policy that an effective MA compliance plan addresses the detection, 
correction, and prevention of fraud, waste, and abuse in the MA 
program, and we believe that our proposed change makes this policy 
explicit in our regulations. As previously stated in this final rule 
with comment period, MA organizations may refer to Chapter 9 in the 
interim, and further guidance on the types of measures we recommend in 
detecting and preventing fraud, waste, and abuse will be developed 
specifically for MA organizations.
    Comment: A number of respondents requested further clarification 
regarding who must provide training and education under the compliance 
plan and who must be trained and educated.
    Response: We did not intend to imply that MA organizations and Part 
D sponsors are required to directly provide Part D compliance training 
and education to all of their first tier, downstream, and related 
entities. Instead, we seek to reaffirm the role and responsibilities of 
the MA organization and Part D sponsor in this area. To the extent that 
aspects of the compliance plan are delegated, it is important to 
remember that the MA organization's or Part D sponsor's compliance 
officer must maintain appropriate oversight of those delegated 
activities. The Part D sponsor and the MA organization maintain 
ultimate responsibility regardless of whether training has been 
delegated to the first tier, downstream, or related entities. In 
accordance with the Part D and MA applications, the Part D sponsor or 
MA organization must attest it will implement a compliance plan that 
includes effective training and education between the compliance 
officer, organization employees, contractors, agents and directors. In 
addition, as part of plan audits, CMS will verify that all necessary 
training has been provided. Therefore, CMS would expect that a Part D 
sponsor and MA organization would have training logs and copies of 
attestations from the first tier, downstream or related entities to 
comply with this requirement. As previously stated in this final rule 
with comment period, MA organizations may refer to Chapter 9 in the 
interim, and further guidance will be developed for MA organizations.
    Comment: A few commenters questioned ``who would be responsible'' 
for implementing the compliance program's fraud, waste, and abuse 
detection and prevention efforts related to Part D.
    Response: The MA organization or Part D sponsor is ultimately 
responsible for meeting the compliance plan requirement to implement 
measures for detecting and preventing fraud, waste, and abuse. However, 
we realize that each MA organization and Part D sponsor has a unique 
business model and structure, and that some will choose to perform 
certain functions themselves while some MA organizations and Part D 
sponsors will subcontract certain functions and rely on the expertise 
and operations that first tier, downstream, and related entities offer. 
The job of the compliance officer cannot be delegated. But MA 
organizations and Part D sponsors have the flexibility to determine 
how, and to what extent, they will delegate their compliance 
activities, which may include training and education to control fraud, 
waste, and abuse. MA organizations and Part D sponsors have the 
flexibility to determine how and to what extent they will delegate 
other aspects of their contractual requirements. To the extent that any 
compliance activities are delegated to first tier, downstream, and 
related entities, MA organizations and Part D sponsors are ultimately 
responsible for compliance plan oversight, including monitoring 
training and education, and complying with all statutory and regulatory 
requirements, as well as any additional guidance identified by us. One 
option MA organizations and Part D sponsors may choose is to 
contractually require their first tier, downstream, and related 
entities to train their own workforce on delegated activities and 
establish lines of communication to the appropriate managers in those 
entities. We recommend that Part D sponsors review chapter 9 of the 
Prescription Drug Benefit Manual for further guidance regarding 
accountability and oversight of first tier, downstream, and related 
entities. As previously stated in this final rule with comment period, 
MA organizations may refer to Chapter 9 in the interim, and further 
guidance will be developed specifically for MA organizations.
    MA organizations and Part D sponsors should consider requiring that 
any first tier, downstream, and related entities performing activities 
on behalf of the MA organization or Part D sponsor, provide their own 
training in accordance with Sec.  422.504(b)(4)(vi)(C) or Sec.  
423.504(b)(4)(vi)(C) respectively, or where there are sufficient 
organizational similarities, the MA organization or sponsor may choose 
to make its training programs available to these entities. This will 
allow the first tier, downstream, and related entities the choice of 
accessing the MA organization or Part D sponsor's training and 
education materials, or providing proof to them of their compliance 
with the training and education requirement. For further guidance, 
please refer to chapter 9 of the Prescription Drug Benefit Manual.
    Employees with specific responsibilities in Medicare Part D 
business areas should receive specialized training on issues posing 
compliance risks based on their job function (for example, pharmacist, 
statistician, and so on), upon initial hire, when requirements change, 
or when an employee works in an area previously found to be 
noncompliant with program requirements or associated with past 
misconduct. Such training should also be required at least annually 
thereafter as a condition of employment. Specialized training content 
may be developed by the sponsor or employees may attend professional 
education courses that help meet this objective. Further discussion 
related to this subject may be found in Chapter 9.
    In Chapter 9, we discuss how delegation of training would be 
applicable, if deemed appropriate by the sponsor, for General 
Compliance Training and Specialized Compliance Training. We did not 
make any changes to our proposed provisions as a result of this 
comment.
    Comment: We received some comments suggesting that we should work 
with the industry to develop a

[[Page 68707]]

standardized training and communication plan applicable to all 
stakeholders, and make it available on the internet. This way, 
stakeholders would receive one comprehensive training and communication 
package.
    Response: We believe this to be a valuable suggestion, and we will 
take it under consideration.
    Comment: Some commenters requested that we conduct certifications 
to verify that training and education had been completed for Part D 
plans and their first tier, downstream, and related entities.
    Response: At this time, we do not require a certification process 
but rather, through our audit and review process, will determine 
whether or not the training and education requirements were fulfilled. 
We hold the Part D sponsor or MA organization responsible for 
fulfilling this requirement regardless of whether first tier, 
downstream, and related entities certify to that effect. We may revisit 
the idea of certification in the future.
    Comment: One respondent questioned who downstream entities should 
contact with ``compliance concerns.''
    Response: We have contracted with program integrity contractors who 
will use innovative techniques to monitor and analyze data to help 
identify and prevent fraud, waste, and abuse. Any person or entity at a 
first tier, downstream, or related entity level that wishes to report 
potential fraud or misconduct may contact a program integrity 
contractor and/or the MA organization or the Part D sponsor, depending 
on the type of violation.
    Comment: Another respondent questioned who would be responsible for 
reporting potential prescription drug fraud.
    Response: The Part D sponsor or MA organization maintains ultimate 
responsibility regardless of whether oversight duties have been 
delegated. To the extent that any of the compliance activities for 
Parts C or D are delegated, it is important that the MA or Part D 
compliance officer maintain appropriate oversight of those duties that 
have been delegated. The compliance officer is responsible for 
determining whether voluntary self-reporting of any potential fraud or 
misconduct related to the MA or Part D program is appropriate. In 
addition, first tier, downstream, and related entities are encouraged 
to report fraud, waste, or abuse to the program integrity contractor 
and/or the MA organization or the Part D sponsor.
Sections 422.503(b)(4)(vi)(G)(3) and 423.504(b)(4)(vi)(G)(3)--Mandatory 
Self-Reporting
    At Sec.  422.503(b)(4)(vi)(G)(3) and Sec.  423.504(b)(4)(vi)(G)(3), 
we proposed mandatory self-reporting of potential fraud or misconduct 
in both the MA and Part D programs. We believe that it is important for 
the government to have information on potential fraud or misconduct as 
soon as possible. The comments we received on the May 25, 2007, 
proposed rule highlighted the challenges in establishing the parameters 
of a mandatory self-reporting process in the context of MA and PDP 
plans. Commenters expressed several concerns during the public comment 
period, including the need for us to better define what constitutes 
``potential'' fraud and misconduct, the process for reporting, and the 
need to be consistent with other agencies' guidance regarding self-
reporting. After reviewing these comments, we determined that 
additional analysis needs to be undertaken and additional information 
sought before implementing a mandatory self-reporting requirement.
    In the meantime, we believe that self-reporting is a valuable 
component of an MA organization's or Part D sponsor's compliance plan. 
Therefore, in an effort to make the compliance plan requirements 
uniform across MA organizations, Medicare Advantage Prescription Drug 
Plans (MA-PDs), and other Part D sponsors, we will amend proposed 
paragraph (b)(4)(vi)(G)(3) of both Sec. Sec.  422.503 and 423.504 to 
read: A MA organization or Part D sponsor ``should have procedures for 
voluntary self-reporting of potential fraud or misconduct * * *.'' We 
are essentially retaining the voluntary self-reporting recommendation 
for Part D sponsors, but merely moving it within the regulatory text to 
accommodate other regulatory changes we are making, and implementing a 
voluntary self-reporting recommendation for MA organizations. We are 
strongly recommending that, if after conducting a reasonable inquiry, 
it is determined that potential fraud or misconduct has occurred, the 
conduct should be promptly referred to the program integrity contractor 
for further investigation. While we are not requiring mandatory self-
reporting in this final rule with comment period, there may be 
instances under federal criminal and fraud and abuse statutes where MA 
organizations and Part D sponsors are potentially subject to 
prosecution if certain issues are not properly addressed. We further 
note that our decision not to amend the existing MA and PDP 
requirements further at this time does not mean that organizations may 
not be liable under other Federal laws or regulations if they fail to 
disclose a violation they have discovered.
    We wish to call attention to the existing guidance we provide on 
self-reporting. Key documents include Chapter 9 of the Prescription 
Drug Benefit Manual, concerning fraud, waste, and abuse (at https://
www.cms.hhs.gov/PrescriptionDrugCovContra/Downloads/PDBManual_
Chapter9_FWA.pdf) and the Medicare Part D Reporting Requirements for 
Contract Year 2007 (at https://www.cms.hhs.gov/
PrescriptionDrugCovContra/Downloads/PartDReportingRequirements_
CurrentYear.pdf). While these documents are not codified rules, the 
guidance they contain provides clear direction to plans as to our 
expectations. We will periodically revise these guidelines to reflect 
additional guidance on ways to improve reporting of fraud, waste, and 
abuse.
    We are committed to implementing mandatory self-reporting and we 
intend to issue a proposed rule. Finally, we believe that it would be 
valuable to obtain additional input at this time, in order to inform 
our evaluative, analytic, and guidance efforts. Accordingly, we are 
asking for additional public comments on this issue. Specifically, we 
ask for comments regarding the following:
     We proposed requiring MA organizations and Part D sponsors 
to report potential ``fraud or misconduct.'' We seek guidance as to how 
to define what kinds of offenses would constitute fraud and misconduct 
for purposes of this reporting requirement. We seek specific examples 
of what constitutes potential fraud and misconduct.
     Alternatively, we seek input as to whether there is an 
alternate formulation, rather than ``fraud or misconduct'' that would 
better describe the categories of offenses that should be reported to 
CMS (for example violations of administrative, civil and/or criminal 
authorities).
     Who are the entities that would be responsible for 
reporting to CMS (sponsor, first tier, downstream entities)?
     At what point would CMS require that a MA or Part D plan 
report a potential issue that could fall into the category of offenses 
that would require self-reporting (for example, upon initial discovery 
or after an opportunity for reasonable inquiry or due diligence)?
     How should this information be reported to CMS (through 
the MEDICs, disclosure to the CMS plan manager, or

[[Page 68708]]

CMS central office)? Please provide a discussion of the advantages or 
disadvantages of any of these or other reporting mechanisms.
     In addition to the specific questions raised above, please 
provide us with any other comments or constructive feedback that might 
assist us in crafting a mandatory self-reporting requirement.
Sections 422.504 and 423.505--General Provisions
    We proposed to clarify which entities under contract to MA 
organizations and Part D sponsors are subject to the contract 
provisions in the MA and Part D programs. Currently, the contract 
provisions at 422.504 and 423.505 refer to such entities as the MA 
organization or Part D sponsor's ``contractors'' and 
``subcontractors,'' which as we described in the proposed rule, are 
undefined terms in the statute and regulations. We proposed, where 
applicable, to delete the term ``contractor,'' because of potential 
confusion and redundancy, and replace the term ``subcontractor'' with 
the terms ``first tier entity'' and ``downstream entity'' in 422.504(e) 
and (i), to clarify which entities are subject to the contract 
provisions at 422.504.
    We also proposed, where applicable, to delete the term 
``contractor,'' and replace the term ``subcontractor'' with the terms 
``first tier entity'' and ``downstream entity'' in the Part D contract 
provisions at 423.505(e) and (i) for the same reasons. We believed 
using ``first tier and downstream, entities'' instead of 
``subcontractor'' would lessen the potential for confusion in the Part 
D program. Please see page 29372 of the proposed rule for examples of 
first tier, downstream, and related entities.
    Comment: We received a number of technical comments concerning the 
definitions of ``contractor'' and ``subcontractor.''
    Response: Based on these comments, we are correcting a few 
typographical errors in Sec.  423.505(i)(3)(v) by replacing the phrase 
``related entity, contractor or subcontractor'' with the phrase ``first 
tier, downstream, and related entities'' to be consistent with the 
other parts of the regulation. In Sec. Sec.  423.505(i)(3), and 
Sec. Sec.  423.505(i)(3)(ii), (i)(4), and (i)(4)(v), we are deleting 
the term ``pharmacy'' as it was included in error and is redundant. 
Section 423.505(i)(4) will now read: ``If any of the Part D plan 
sponsor's activities or responsibilities under its contract with CMS is 
delegated to other parties, the following requirements apply to any 
first tier, downstream, and related entity,'' and Sec.  
423.505(i)(4)(v) will read: ``All contracts or written arrangements 
must specify that the first tier, downstream, or related entity must 
comply with all applicable Federal laws, regulations, and CMS 
instructions.'' We also are making similar corrections to Sec.  
422.504(i)(3), (i)(3)(ii), and (i)(4) where the term ``provider'' was 
left in the regulations unintentionally. All references to ``provider'' 
have been deleted in the final regulations.
    We proposed to add a provision to the contracts and written 
arrangements between sponsors and their first tier, downstream, and 
related entities at Sec.  423.505(i)(3)(iv) to clarify that this 
information can be provided to either the Part D sponsor to give to 
CMS, or can be provided directly to CMS or its designees. We discussed 
in the proposed rule at page 29373 our existing authority under section 
1860D-12(b)(3)(c) of the Act and Sec.  422.504(e) and Sec.  423.505(e) 
to inspect and audit any books, contracts, requests, and records of a 
Part D sponsor or MA organization relating to the Part D program. 
Because of the proposed contract provision, we also proposed to 
redesignate Sec.  423.505(i)(3)(iv) as Sec.  423.505(i)(3)(v). We are 
finalizing these changes as proposed.
    Comment: A few commenters questioned our authority to access the 
books and records of first tier, downstream and related entities. One 
commenter suggested a need for more formal rulemaking on this topic.
    Response: We have existing authority under section 1860D-
12(b)(3)(c) of the Act and Sec.  422.504(e)(2) and Sec.  423.505(e)(2) 
to inspect and audit any books, contracts, and records of a Part D 
sponsor or MA organization and its first tier, downstream, and related 
entities that pertain to any aspect of services performed, 
reconciliation of benefit liabilities, and determination of accounts 
payable under the contract or as the Secretary may deem necessary to 
enforce the contract. Therefore, it is not necessary, as the commenters 
suggested, to propose a more formal regulation and offer another public 
comment period. These third party disclosure requirements were 
finalized in the final MA and Part D rules and were approved under the 
Paperwork Reduction Act approval under OMB 0938-1004 (Part C) 
and OMB 0938-1000 (Part D). Additionally, in the preamble to 
the Part D proposed rule, published on January 28, 2005 (70 FR 4194), 
we clearly stated our inspection and audit rights with respect to a 
Part D sponsor and its contractors, subcontractors, and related 
entities under the section entitled ``Access to Facilities and 
Records'' (69 FR 46632-46712). In this regulation, we have further 
clarified that our access rights apply to ``first tier, downstream, and 
related entities,'' and not ``contractors, subcontractors, and related 
entities.''
    The limited rebate and other price concession information provided 
to the Part D sponsor by its contracting entities may provide some 
payment information to us, but it may not be enough for us to determine 
in all cases whether appropriate payments have been made to the 
sponsor. Therefore, it may be necessary for us to rely on our authority 
to access books and records to obtain more detailed rebate and other 
price concession information in order to verify proper payments were 
made to the Part D sponsor.
    Comment: We received a number of comments questioning whether books 
and records must be made available to us directly or through the Part D 
sponsor.
    Response: We have chosen not to be prescriptive regarding whether 
first tier, downstream, and related entities must make their books and 
records available to us directly or through the Part D Sponsor. It is 
our opinion that this is considered to be part of the negotiation 
process between the Part D sponsor and its first tier, downstream, and 
related entities. The provision must be clear as to whether or not the 
requested documentation is to be submitted through the Part D sponsor 
to us (or our designee(s)), or submitted directly to us (or our 
designee(s)). The parties could also decide to have such books and 
records made directly available to us, or our designee(s), through 
onsite access. The Part D sponsor must be prepared to submit evidence 
of this agreed upon provision in its executed contracts to us. To 
clarify, the ``designee'' either refers to entities under a program 
integrity contract with us, or entities, such as law enforcement, 
working in collaboration with us to fight fraud, waste and abuse in the 
Medicare Part D program.
    HHS, the Comptroller General, or its designees have the authority 
to collect any information from the first tier, downstream, or related 
entities that is related to the Medicare Part D prescription drug 
transaction. Examples of the type of information collected are provided 
at Sec.  423.505(e)(2).
    In addition to proposing a new contract provision at Sec.  
423.505(i)(4)(iv), we also proposed minor regulatory changes which 
clarify the Part D sponsor's CMS contractual requirements. While we 
continue to believe our regulations clearly state our authority to 
access the books and records of a Part D sponsor's first tier, 
downstream, and related entities, we proposed to add language about 
these

[[Page 68709]]

partnering entities to Sec.  423.505(b)(10), and proposed to 
consolidate Sec.  423.505(e)(2) and (3) into one provision at (e)(2). 
We proposed these revisions to make explicit the Part D plan sponsor's 
contractual obligation to ensure HHS, the Comptroller General, or their 
designees have access to any books and records related to the Part D 
program, including those of a sponsor's first tier, downstream, and 
related entities. These revisions do not impose any new requirements on 
Part D sponsors or its partnering entities. We are finalizing these 
proposed provisions without change.
    Comment: A few commenters noted that the proposed revision to Sec.  
422.504 and Sec.  423.505 has not prescribed ``typical'' data sets to 
be reported within the context of our request for books and records of 
first tier, downstream, and related entities. Another commenter 
indicated that the information that could be collected is too broad.
    Response: We want to clarify that the ``books and records'' we are 
entitled to access do not make up a typical data set included in the 
Medicare Part D Reporting Requirements. There is no report form to be 
defined, as the format will be dependent upon the information being 
requested and the unique circumstances upon which the request is based. 
The scope of the information collected will be based on the type of 
audit being performed. If upon review of the information submitted we, 
or our designee(s), determine that additional information or 
clarification is warranted, the scope of the review may be expanded.
    Comment: A commenter suggested that we should rely on subpoena 
authority, regulation, provider contracts, or some other method to 
collect books and records in connection with investigations.
    Response: We do not have subpoena authority; however, our law 
enforcement partners such as OIG and DOJ do. The government may use a 
variety of methods to obtain records and books from entities under 
contract with MA organizations and/or Part D sponsors. There may be 
instances where we may need to see books and records without involving 
law enforcement. These provisions at Sec.  422.504 and Sec.  423.505 
only clarify one method we may employ to do so.
    We clarified in the preamble to the proposed rule that HHS, the 
Comptroller General, or their designees have the authority under the 
statute to request records from MA organizations and Part D sponsors or 
their first tier, downstream, or related entities. MA organizations and 
Part D plan sponsors must maintain, as required by Sec.  423.505(d), 
``books, records, documents and other evidence of accounting procedures 
and practices,'' pertaining to determinations of amounts payable under 
the contract, agreements, contracts, and subcontracts. Since Part D 
sponsors have delegated many Part D functions to their first tier 
entities, we are aware that many of these records reside with first 
tier and downstream entities, such as pharmaceutical benefits managers 
(PBMs). We are taking the opportunity again, in this final rule with 
comment period, to make explicit that we have the authority to request 
for verification of payment purposes, any records relating to rebates 
and any other price concessions between PBMs and manufacturers that may 
impact payments made to sponsors in the Part D program.
    Comment: We received a comment addressing the 10-year record 
retention requirement.
    Response: This requirement was implemented in a prior regulation 
and is outside the scope of this final rule with comment period.
    Comment: A number of commenters expressed concern that information 
submitted by first tier, downstream, and related entities, especially 
proprietary information, would not be kept confidential by us.
    Response: As an agency, we are subject to various Federal 
disclosure laws, such as the Trade Secrets Act, the Privacy Act, and 
the Freedom of Information Act (FOIA) (5 U.S.C. 552). We are also 
subject to confidentiality and disclosure regulations at 42 CFR Part 
401 Subpart B. In addition, sections 1860D-15(d)(2)(B) and (f)(2) of 
the Act place restrictions on the Secretary's disclosure of certain 
payment data collected in the Part D program to anyone outside of HHS. 
Therefore, we believe there are sufficient legal restrictions to 
protect the disclosure of such proprietary data outside of the agency.
    Comment: One commenter questioned our need to gather information 
about rebate agreements between potential first tier and downstream 
entity contracted partners.
    Response: Our proposa