Medicare Program; Secure Electronic Prior Authorization For Medicare Part D, 86824-86835 [2020-28877]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 85, Number 251 (Thursday, December 31, 2020)]
[Rules and Regulations]
[Pages 86824-86835]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-28877]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 423

[CMS-4189-F]
RIN 0938-AT94


Medicare Program; Secure Electronic Prior Authorization For 
Medicare Part D

AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of 
Health and Human Services (HHS).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule names a new transaction standard for the 
Medicare Prescription Drug Benefit program's (Part D) e-prescribing 
program as required by the ``Substance Use-Disorder Prevention that 
Promotes Opioid Recovery and Treatment for Patients and Communities 
Act'' or the ``SUPPORT Act.'' Under the SUPPORT Act, the Secretary is 
required to adopt standards for the Part D e-prescribing

[[Page 86825]]

program to ensure secure electronic prior authorization request and 
response transmissions. In this final rule, we amend the Part D e-
prescribing regulations to require Part D plan sponsors' support of 
version 2017071 of the National Council for Prescription Drug Programs 
(NCPDP) SCRIPT standard for use in certain electronic Prior 
Authorization (ePA) transactions with prescribers regarding Part D-
covered drugs to Part D-eligible individuals.

DATES: These regulations are effective on February 1, 2021. The 
incorporation by reference of certain publications listed in the rule 
was approved by the Director of the Federal Register as of July 28, 
2017.

FOR FURTHER INFORMATION CONTACT: Joella Roland (410) 786-7638.

SUPPLEMENTARY INFORMATION: 

I. Background

    The purpose of this final rule is to adopt a new standard for 
certain transactions concerning Part D-covered drugs prescribed to Part 
D-eligible individuals under the Part D e-prescribing program. Under 
this final rule, Part D plan sponsors will be required to support 
version 2017071 of the National Council for Prescription Drug Programs 
(NCPDP) SCRIPT standard for four electronic Prior Authorization (ePA) 
transactions, and prescribers will be required to use that standard 
when performing ePA transactions for Part D-covered drugs they wish to 
prescribe to Part D-eligible individuals. Part D plans, as defined in 
42 CFR 423.4, include Prescription Drug Plans (PDPs) and Medicare 
Advantage Prescription Drug Plans (MA-PDs); Part D sponsor, as defined 
in 42 CFR 423.4, means the entity sponsoring a Part D plan, MA 
organization offering a MA-PD plan, a Programs of All-Inclusive Care 
for the Elderly (PACE) organization sponsoring a PACE plan offering 
qualified prescription drug coverage, and a cost plan offering 
qualified prescription drug coverage. The ePA transaction standard will 
provide for the electronic transmission of information between the 
prescribing health care professional and Part D plan sponsor to inform 
the sponsor's determination as to whether or not a prior authorization 
(PA) should be granted. The NCPDP SCRIPT standard version 2017071 was 
adopted as a Part D e-prescribing program standard for certain defined 
transactions in the April 16, 2018 final rule (83 FR 16440) titled 
``Medicare Program; Contract Year 2019 Policy and Technical Changes to 
the Medicare Advantage, Medicare Cost Plan, Medicare Fee-for-Service, 
the Medicare Prescription Drug Benefit Programs, and the PACE Program'' 
that became effective June 15, 2018.

A. Legislative Background

1. Health Insurance Portability and Accountability Act of 1996 (HIPAA)
    The Health Insurance Portability and Accountability Act of 1996 
(HIPAA) (Pub. L. 104-191) was enacted on August 21, 1996. Title II, 
Subtitle F, of HIPAA requires covered entities--health plans, health 
care providers that conduct covered transactions, and health care 
clearinghouses--to use the standards HHS adopts for certain electronic 
transactions. The standards adopted by HHS for purposes of HIPAA are in 
regulations at 45 CFR part 162.
2. Medicare Prescription Drug, Improvement, and Modernization Act of 
2003 (MMA)
    The Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003 (MMA) (Pub. L. 108-173) was enacted on December 8, 2003. It 
amended Title XVIII of the Social Security Act (the Act) by 
redesignating Part D as Part E and inserting a new Part D to establish 
a voluntary prescription drug benefit program. As part of that program, 
section 1860D-4(e) of the Act, as added by the MMA, required the 
adoption of Part D e-prescribing standards for electronic prescriptions 
and prescription-related transactions between Part D plan sponsors, 
providers, and pharmacies. The Secretary's selection of standards is 
informed by the National Committee on Vital and Health Statistics 
(NCVHS), an advisory committee that gives advice to the Secretary in 
accordance with the Federal Advisory Committee Act, including regarding 
implementation of the administrative simplification provisions of 
HIPAA. Under section 1860D-4(e)(4)(B) of the Act, NCVHS develops 
recommendations for Part D e-prescribing standards, in consultation 
with specified groups of organizations and entities. These 
recommendations are then taken into consideration when developing, 
adopting, recognizing, or modifying Part D e-prescribing standards. The 
statute further requires that the selection of standards be designed, 
to the extent practicable, so as not to impose an undue administrative 
burden on prescribers or dispensers, but to be compatible with 
standards established under Part C of title XI of the Act (the HIPAA 
standards), comport with general health information technology 
standards, and permit electronic exchange of drug labeling and drug 
listing information maintained by the Food and Drug Administration and 
the Library of Medicine.
    The standards adopted by CMS for purposes of the Part D e-
prescribing program are in regulations at 42 CFR 423.160. Part D plan 
sponsors are required to support the Part D e-prescribing program 
transaction standards, and providers and pharmacies that conduct 
electronic transactions for which a program standard has been adopted 
must do so using the adopted standard. (For additional information 
about the MMA program authority, see the February 4, 2005 proposed rule 
(70 FR 6256).)
3. Substance Use-Disorder Prevention That Promotes Opioid Recovery and 
Treatment for Patients and Communities Act
    The Substance Use-Disorder Prevention that Promotes Opioid Recovery 
and Treatment for Patients and Communities Act (Pub. L. 115-271), 
hereinafter referred to as the ``SUPPORT Act,'' was enacted on October 
24, 2018. Section 6062 of the SUPPORT Act amended section 1860D-4(e)(2) 
of the Act to require the adoption of transaction standards for the 
Part D e-prescribing program to ensure secure ePA request and response 
transactions between prescribers and Part D plan sponsors no later than 
January 1, 2021. Such transactions are to include an ePA request 
transaction for prescribers seeking an ePA from a Part D plan sponsor 
for a Part D-covered drug for a Part D-eligible individual, as well as 
an ePA response transaction for the Part D plan sponsor's response to 
the prescriber. A facsimile, a proprietary payer portal that does not 
meet standards specified by the Secretary or an electronic form are not 
treated as electronic transmissions for the purposes of ePA requests. 
The ePA standards adopted under this authority are to be adopted in 
consultation with the NCPDP or other standards development 
organizations the Secretary finds appropriate, as well as other 
stakeholders.
    Finally, the SUPPORT Act also authorized the adoption of ePA 
transaction standards for Part D-covered drugs prescribed to Part D-
eligible individuals ``notwithstanding'' any other provision of law.

B. Regulatory History

    In 2000, the Secretary adopted HIPAA transaction standards for the 
``referral certification and authorization transaction''. The term 
``referral certification and authorization transaction'' is defined at 
45 CFR

[[Page 86826]]

162.1301 as the transmission of any of the following: (1) A request 
from a health care provider to a health plan for the review of health 
care to obtain an authorization for the health care; (2) a request from 
a health care provider to a health plan to obtain authorization for 
referring an individual to another health care provider; and (3) a 
response from a health plan to a health care provider to a request 
described in (1) or (2). The first HIPAA standard adopted for this 
transaction was version 4010 of the X12 278 (65 FR 50371, August 17, 
2000). In 2003, the Secretary adopted another standard, the NCPDP 
version 5.1, for retail pharmacy drug referral certification and 
authorization transactions, and specified that version 4010 of the X12 
278 was to be used only for dental, professional, and institutional 
referral certification and authorization transactions. (For more 
detailed information, see the February 20, 2003 Federal Register (68 FR 
8398).) Still, as of 2003, the Secretary had not adopted a standard for 
ePA for medications specifically.
    In 2004, NCPDP formed a multi-industry, multi-Standards Development 
Organization (SDO) ePA Task Group to evaluate existing ePA standards 
and promote standardized ePA, with a focus on the medication context. 
The Task Group considered the X12 278 standard, but determined that 
there were certain gaps in the X12 278 standard that made the standard 
difficult to use for ePA for medications, including that the standard 
was unable to support attachments for PA determinations, did not 
incorporate free text in certain fields, and did not at the time allow 
functionality for real-time messaging. As a result of these findings, 
the Task Group wrote a letter to the HHS Secretary stating that the X12 
278 standard offered limited support for ePA for medications.
    On January 16, 2009, the Secretary adopted later versions of the 
HIPAA transaction standards, requiring NCPDP Telecommunications D.0 
instead of NCPDP 5.1, and version 5010 instead of version 4010 of the 
X12 278 for referral certification and authorization transactions (74 
FR 3326). These standards are specified at 45 CFR 162.1302(b)(2).
    In the meantime, the industry continued to work to develop and test 
alternative ePA transaction standards for use in the medication 
context. Such work led NCPDP to develop what would ultimately become 
its first standard to support ePA. In a May 15, 2014, letter to the HHS 
Secretary, NCVHS stated that they had received a letter from the NCPDP 
recommending its SCRIPT Standard Version 2013101 as a standard for 
carrying out medication ePA transactions. (For more information see, 
https://ncvhs.hhs.gov/wp-content/uploads/2014/05/140515lt2.pdf.) In 
support of this recommendation, NCVHS reported that NCPDP investigators 
tasked with reviewing the X12 278 standards (the 278 v4010 or v5010) 
for medication ePA transactions found impediments. These impediments 
were grounded in the standards having been designed for requests for 
review and corresponding responses for the ePA of health care services 
(such as for procedures/services and durable medical equipment), 
resulting in an inability to facilitate medication ePA. NCPDP also 
noted the lack of widespread use of the X12 278 transaction in the 
medication ePA context as evidence of its inadequacy for this purpose.
    Despite these findings and NCPDP recommendation to NCVHS, we did 
not pursue proposing the NCPDP SCRIPT Standard Version 2013101 as a 
Part D eRx program standard for medication ePA transactions because it 
was contrary to the HIPAA requirements, which continued to require use 
of the X12 278 standard. Similarly, when NCPDP wrote to CMS on May 24, 
2017 to recommend the adoption of its NCPDP SCRIPT Standard Version 
2017071, we were unable to consider it for the Part D e-Rx program due 
to the HIPAA transaction standards in effect at that time.
    Of note, the Part D e-Rx program's authorizing statute requires the 
selection of Part D standards that are compatible with the HIPAA 
standards. See section 1860D-4(e)(2)(C) of the Act. However, given the 
new authority under the SUPPORT Act, we believe we now have authority 
to adopt Part D eRx ePA transaction standards ``notwithstanding'' any 
other provision of law, if such proposals are framed in consultation 
with stakeholders and the NCPDP or other standard setting organizations 
the Secretary finds appropriate. See section 1860D-4(e) of the Act, as 
amended by section 6062 of the SUPPORT Act. We believe that this 
provision explicitly authorizes us to require the use of an ePA 
standard in the Part D context that is different from the HIPAA 
standard, as long as it is for use in the ePA of Part D-covered drugs 
prescribed to a Part D-eligible individuals.
    As previously described, Part D plan sponsors are required to 
establish electronic prescription drug programs that comply with the e-
prescribing standards adopted under the Part D e-prescribing program's 
authorizing statute. There is no requirement that prescribers or 
dispensers implement eRx. However, prescribers and dispensers who 
electronically transmit and receive prescription and certain other 
information regarding covered drugs prescribed for Medicare Part D-
eligible beneficiaries, directly or through an intermediary, are 
required to comply with any applicable standards that are in effect.
    As of January 1, 2020, prescribers and dispensers are required to 
use the NCPDP SCRIPT standard, Implementation Guide Version 2017071, 
for the communication of the same prescription or prescription-related 
information between prescribers and dispensers for the transactions for 
which prior versions of the NCPDP SCRIPT standard were adopted, as well 
as a handful of new transactions named at Sec.  423.160(b)(2)(iv). For 
more information, see the April 16, 2018 final rule (83 FR 16635) and 
for a detailed discussion of the regulatory history of the Part D e-
prescribing standards see the November 28, 2017 proposed rule (82 FR 
56437).
    While not currently adopted as part of the Part D eRx standard, the 
NCPDP SCRIPT standard version 2017071 includes 4 transaction standards 
that will enable prescribers to initiate, request, and review the 4 
response transactions from Part D plan sponsors at the time of the 
patient's visit. These eight response transactions include: The PA 
initiation request/response, PA request/response, PA appeal request/
response, and PA cancel request/response. As noted previously, 
historically we were unable to name this ePA transaction standard as a 
Part D e-prescribing program standard. Prior to the passage of the 
SUPPORT Act, the Part D program was required to adopt standards that 
were compatible with the HIPAA standards, and HIPAA covered entities 
are currently required to use the X12 278 to conduct referral 
certification and authorization transactions between health plans and 
health care providers.

II. Adoption of the NCPDP SCRIPT Standard Version 2017071 as the Part D 
ePA Transaction for the Part D Program

A. PA in the Part D Context

    All Part D plans, as defined under Sec.  423.4, including PDPs, MA-
PDs, PACE Plans offering qualified prescription drug coverage, or Cost 
Plans offering qualified prescription drug coverage, may use approved 
PA processes to ensure appropriate prescribing and coverage of Part D-
covered drugs prescribed to Part D-eligible individuals. We review all 
PA

[[Page 86827]]

criteria as part of the formulary review process. In framing our PA 
policies, we encourage PDP and MA-PD sponsors to consistently utilize 
PA for drugs prescribed for non-Part D covered uses and to ensure that 
Part D drugs are only prescribed when medically appropriate. Non-Part D 
covered uses may be indicated when the drug is frequently covered under 
Parts A or B as prescribed and dispensed or administered, is otherwise 
excluded from Part D coverage, or is used for a non-medically accepted 
indication. (For more information, see the Medicare Prescription Drug 
Manual, chapter 6, section 30.2.2.3.) Part D sponsors must submit to 
CMS utilization management requirements applied at point of sale, 
including PA.
    We may also approve PA for prescriptions when the Part D plan 
desires to manage drug utilization, such as when step therapy is 
required, when it needs to establish whether the utilization is a 
continuation of existing treatment that should not be subject to the 
step therapy requirements, or to ensure that a drug is being used 
safely or in a cost-effective manner. Formulary management decisions 
must be based on scientific evidence and may also be based on pharmaco-
economic considerations that achieve appropriate, safe, and cost-
effective drug therapy.
    The PA process has historically been handled via facsimile exchange 
of information or telephone call, and only recently via payer-specific 
web portals. However, stakeholders testifying to NCVHS generally agree 
that there is a need to move to a user-friendly, real-time ePA for use 
by prescribers. Minutes from NCVHS meetings can be accessed at https://ncvhs.hhs.gov/meetings-meeting/all-past-meetings/. Therefore, we 
believe the adoption of an ePA standard for the Part D eRx program will 
improve patient access to required medications.

B. PA for Part D E-Prescribing

    In order to meet the SUPPORT Act's mandate to adopt an ePA 
transaction standard for the Part D-covered drugs prescribed to Part D-
eligible individuals, CMS identified ePA transaction standards 
currently available for use by pharmacies and prescribers. These 
included the X12 278 and NCPDP Telecommunications D.0 standards, the 
NCPDP SCRIPT standard version 2017071, and earlier versions of the 
NCPDP SCRIPT standard. We quickly ruled out the use of older NCPDP 
SCRIPT standards based on the improvements incorporated in the current 
HIPAA Administrative Simplification transaction standards and our 
assessment of the enhanced functionality available in the NCPDP SCRIPT 
standard version 2017071.
    Then we considered the needs of the Part D eRx program; the 
functionalities offered by the remaining two sets of standards; NCVHS 
recommendations, stakeholder recommendations based on their experience 
developing, vetting, evaluating, revising, and using the standards 
constructed by the respective Standards Development Organizations 
(SDOs) including NCPDP, the burden on stakeholders to use the 
standards, the security offered by the standards; and the current EHR 
capabilities of the industry in order to estimate the potential burden 
each standard will impose if it were to be adopted in the Part D 
context.
    The NCPDP Telecommunications D.0 standard was designed to be a 
standard for insurance companies to approve claims, and, to our 
knowledge, is only used in ``pharmacy to plan'' transactions. We found 
that it does not include all of the content fields that may be relevant 
to ePA for medications, and had understood that it does not have the 
ability to support transmission of information in real time. Then we 
considered the X12 278 standard. The X12 278 is already used as the 
HIPAA standard for referral certification and PA for dental, 
professional and institutional transactions, and retail pharmacy drugs 
transactions, respectively.
    Based on review of NCPDP's testimony and the letters received from 
NCVHS, we had found that the NCPDP and its participant organizations 
have historically concluded (and presented to NCVHS via testimony at 
hearings) that the X12 278 standard is not adequate to enable ePA in 
the medication e-prescribing context because it does not support 
``real-time'' medication e-prescribing, meaning a prescriber seeking an 
ePA determination during the patient encounter. We understood that this 
was due to the content logic of the standard not having the technical 
capabilities to allow for next question logic, which allows the 
prescriber to determine medication alternatives and determine within 
minutes if the medication will be authorized or if a coverage 
determination is required. In addition, we found that the fields, 
transaction messaging, and software functioning were not structured to 
include information relevant to ePA, and contained mandatory questions 
that were unnecessary for medication ePA. Unfortunately, we also found 
that prescribers are unable to customize these fields as may be needed 
for medication ePA.
    These findings were largely based on NCPDP's 2016 written testimony 
to NCVHS, which is available via this web link: https://www.ncvhs.hhs.gov/wp-content/uploads/2016/01/Part-2-Attachments-NCPDP-WrittenOnly.pdf. The NCPDP testimony urged the exemption of medication 
transactions from the X12 278 standard. The testimony also advocated 
for NCPDP's May 24, 2017 recommendation to adopt the NCPDP SCRIPT 
Standard Version 2017071 for ePA transactions in the HIPAA context, 
with a 24-month implementation time period due to the extensive coding 
required by health IT developers and Part D plans to implement the 
change.
    Although NCPDP's recommendation was to adopt this standard for all 
HIPAA transactions, the Department did not elect to make the suggested 
changes to the HIPAA Administrative Simplification transaction 
standards. Based on conversations with the industry, our own assessment 
of the standard, and under the authority provided by Congress to 
require the use of a standard for Part D ePA notwithstanding any other 
provision of law, we concluded that the potential benefits of adopting 
user-friendly ePA for the Part D eRx program outweigh any difficulties 
that may arise by virtue of Part D using a different standard than the 
rest of the industry.
    More specifically, we concluded that the NCPDP SCRIPT standard 
version 2017071 would support an electronic version of today's PA 
process by providing standardized information fields that are relevant 
for medication use, mandatory questions, transaction messaging, and 
standardized ePA data elements and vocabulary for exchanging the PA 
questions and answers between prescribers and payers, while also 
allowing the payers to customize the wording of the questions using 
free form fields. Although the X12 278 standard has standard 
information fields, mandatory questions, transaction messaging, and 
standardized data element and values, we believed those fields were 
more relevant to use in dental, professional, and institutional 
requests for review and response, and would not be conducive to 
medication ePA. Since the X12 278 standard does not allow payers to 
customize the wording of questions, we believe it would be difficult 
for parties to decide how to fill out the fields. In contrast, we found 
that NCPDP SCRIPT Standard version 2017071 was specifically designed to 
support medication ePA. The standard supports features that minimize 
what the prescriber is asked, creating a customized experience based

[[Page 86828]]

on earlier answers or data automatically pulled by their EHR system. 
These features would reduce the amount of time a prescriber or their 
staff spend reviewing and responding to the ePA questions. We 
understood that this functionality exists in most EHR systems, and can 
be customized based on what information is requested by the plans. We 
found great value in this potential to automate the collection of data 
required for ePA from data available within most EHR systems.
    Furthermore, unlike the X12 278 standard, NCPDP SCRIPT standard 
version 2017071 supports solicited and unsolicited models. A solicited 
model occurs when the prescriber notifies the payer that they wish to 
initiate the PA process to determine if an authorization is needed for 
the patient and their desired medication. The prescriber requests 
guidance as to what information will be required for an ePA request for 
a particular patient and medication. The payer then responds either 
with a description of the information required, or an indication that a 
PA is not required for that patient and medication. An unsolicited 
model can be used when the information generated in this first 
interchange of the solicited model is not required. In such a case, the 
prescriber presumes or knows that an authorization will be required 
based on past experience or other knowledge, anticipates what the payer 
needs, and submits the needed information.
    We also found that while X12 278 uses Electronic Data Interchange 
(EDI) syntax, the NCPDP SCRIPT standard version 2017071 uses XML 
syntax. XML helps to ensure the security of transactions through the 
encryption of personal health information and through use of XML 
transaction processing. XML is a newer syntax that provides for an 
easier interaction among different formats and is more easily readable 
between disparate systems and when system issues arise. By contrast, 
EDI is an older syntax more commonly used when there are fewer 
companies that conduct standard interactions among one another.
    Based on this evaluation of the candidate standards, coupled with 
the recommendations from NCPDP, CMS concluded that the NCPDP SCRIPT 
standard version 2017071 was the most appropriate standard to propose 
for the Part D eRx program.
    We explicitly recognized that this final rule would not change the 
ePA transaction standards that will be used outside of the Part D 
context. We did not believe that it would be problematic to use one 
standard for Part D and another standard outside of Part D, because we 
believed that the industry was already equipped to use different 
standards for different health plans and programs.
    Finally, we considered whether adopting the NCPDP SCRIPT standard 
version 2017071 for Part D ePA would create any difficulties if an 
individual had multiple forms of drug coverage or wished to pay cash 
for a prescription. The SUPPORT Act specifies that the adopted standard 
shall be applicable for ePA of Part D-covered drugs prescribed to Part 
D-eligible individuals, but it stops short of requiring that the 
prescribed drug be paid for by the Part D plan. Thus, even if a 
prescriber were to use the NCPDP SCRIPT standard version 2017071 to 
seek Part D ePA, the beneficiary's right to pay for the drug directly, 
or to use non-Part D coverage to pay for the drug would be unaffected. 
However, we noted that the prescriber may not use the NCPDP SCRIPT 
standard version 2017071 to seek ePA with non-Part D plans. We expected 
that their EHR's eRx function would be capable of using the appropriate 
HIPAA standard or that they may use alternative means to seek PA 
outside of the Part D context. Furthermore, where a patient has both a 
Part D plan and a supplementary payer, the NCPDP SCRIPT standard 
version 2017071 could be used to process the Part D ePA transactions in 
real time, with the subsequent claims processing transactions made in 
the usual manner if the prescription is filled. Thus, we believed our 
proposal would not be overly burdensome for regulated parties, even if 
beneficiaries seek to use their non-Part D coverage or elect to self-
pay.
    However, in recognition of patient rights, we also noted that while 
the prescriber can use the NCPDP SCRIPT standard version 2017071 for 
all Part D-covered drugs prescribed to Part D-eligible individuals, it 
should refrain from doing so in instances in which the patient 
specifically requests that the Part D benefits not be accessed.
    As a result of these observations and our understanding that most 
of the industry is able to support NCPDP SCRIPT standard version 
2017071 using their current EHRs, we believed that requiring plans to 
support, and prescribers to use the NCPDP SCRIPT standard version 
2017071 ePA transactions when prescribing Part D-covered drugs to Part 
D-eligible individuals will not impose an undue administrative burden 
on plans, prescribers or dispensers. Therefore, based on its inherent 
features designed to accommodate prescriptions, we believed that the 
NCPDP SCRIPT standard version 2017071, which includes the following ePA 
transaction capabilities, would be the best available option to support 
ePA between prescribers and payers for Part D covered drugs prescribed 
to Part D-eligible individuals:

 PAInitiationRequest and PAInitiationResponse
 PARequest and PAResponse
 PAAppealRequest and PAAppealResponse
 PACancelRequest and PACancelResponse.

    We believed finalization of the ePA transaction proposals would 
enable the electronic presentation of ePA questions and responses using 
secure transactions.
    The SUPPORT Act states that the Secretary must adopt, and a Part D 
sponsor's electronic prescription program must implement the adopted 
ePA by January 1, 2021. As of January 1, 2020, plans will already be 
required to use the NCPDP SCRIPT 2017071 standard for certain Part D-
specified transactions, so we believed that giving plans an additional 
year to add ePA to that list of other NCPDP SCRIPT 2017071 transactions 
would not be overly burdensome and would ensure that the SUPPORT Act 
was implemented as required.
    In addition, the SUPPORT Act, allows us to finalize the adoption of 
an ePA standard for Part D-covered drugs to Part D-eligible individuals 
notwithstanding any other provision of law. Furthermore, we noted our 
belief that our proposal, if finalized, being later in time, more 
specific, and authorized by the SUPPORT Act, would prevail in a 
conflict of law analysis.
    Therefore, we proposed adding Sec.  423.160(b)(7) which would 
require Part D plans' support the noted NCPDP SCRIPT standard version 
2017071 ePA transactions beginning on January 1, 2021, and that 
prescribers use that standard when conducting ePA for Part D-covered 
drugs prescribed to Part D-eligible individuals by the same date. This 
applies to the following list of ePA transactions:

 PAInitiationRequest and PAInitiationResponse
 PARequest and PAResponse
 PAAppealRequest and PAAppealResponse
 PACancelRequest and PACancelResponse

    We welcomed comments on the proposed adoption of the NCPDP SCRIPT 
standard version 2017071 for these ePA transactions for Part D covered 
drugs prescribed to Part D eligible individuals. We also solicited

[[Page 86829]]

comments regarding the impact of the proposed transactions and the 
proposed effective date on industry and other interested stakeholders, 
including whether the implementation of these NCPDP SCRIPT standard 
version 2017071 ePA transactions for use by prescribers and plans in 
the Part D program would impose an additional burden on the industry as 
a whole. We were also interested in hearing input as to whether 
implementation of the proposed transactions would constitute a 
significant change for Part D sponsors, such that a January 1, 2021 
implementation date would not be feasible. We also sought comment on 
strategies to mitigate burden in order to support successful adoption 
of this policy, should it be finalized. We also sought comment on any 
additional ways that we can support plans if they were to be required 
to transition to the ePA standard by the proposed 2021 deadline. 
Finally, we solicited comments on the alternatives considered for the 
proposed rule.
    In the June 19, 2019 Federal Register (84 FR 28450), we published 
the proposed rule that would, if finalized, establish a new ePA 
transaction standard for the Part D e-prescribing program as required 
by SUPPORT Act. We received 53 timely pieces of correspondence in 
response to the June 2019 proposed rule. Commenters included Part D 
sponsors, beneficiaries, beneficiary advocacy groups, pharmacy benefit 
managers (PBMs), pharmaceutical manufacturers, pharmacies, IT vendors, 
and other interested parties. Of the comments received, most commenters 
supported the rule. Summaries of the public comments, our responses to 
those public comments, and our final policies are set forth as follows.
    Comment: Many commenters supported the proposed rule, stating that 
the standard is already used in the industry, and that any 
encouragement to use it for ePA will help streamline the PA process.
    Response: We thank commenters for their support and agree that ePA 
will likely help streamline the PA process in the Part D eRx program 
context.
    Comment: A few commenters expressed their dissatisfaction with 
having to perform PAs so often and stated that providers should be paid 
to perform PA.
    Response: While we appreciate commenters' concerns, the use of PA 
is outside the scope of this rule. This final rule is limited to 
establishing the means by which ePA will be conducted in the Part D eRx 
program context, not the frequency of PAs or provider reimbursement. 
However, we note that as a part of the agency's Patients Over Paperwork 
initiative,\1\ we are working towards improving the prior-authorization 
process, and solicited comment on ways to do so in the June 11, 2019, 
Request for Information; Reducing Administrative Burden to Put Patients 
Over Paperwork (84 FR 27070). We also solicited comment on how to 
improve prior authorization in Medicare fee-for-service through our 
Request for Information on the Future of Program Integrity issued in 
October 2019.
---------------------------------------------------------------------------

    \1\ https://www.cms.gov/About-CMS/story-page/patients-over-paperwork.html.
---------------------------------------------------------------------------

    Comment: A number of commenters provided comments relating to the 
proposed January 1, 2021, implementation date. Some of these commenters 
stated that the January 1, 2021 deadline was achievable. However, other 
commenters encouraged a later deadline for implementation or the use of 
enforcement discretion for the first 2 years. The reasons given for the 
requested delay include a desire to focus on the requirement for Part D 
plans to implement a prescriber real time benefit tool (RTBT) by 
January 1, 2021 (84 FR 23832) and to allow more time for development 
and testing. One commenter requested that we allow 24 months after the 
publication of the final rule for implementation: 12 months for 
development and testing and 12 months for providers to adopt software 
updates.
    Response: We are sympathetic to commenters requesting a longer 
period in which to implement these requirements, especially in light of 
the toll that the current public health emergency (PHE) related to the 
2019 Novel Coronavirus Disease (COVID-19) is taking on the industry, 
our prescriber RTBT requirement, and the need to test the technology 
before use. However, as noted in the proposed rule and previously in 
this final rule, the SUPPORT Act established the deadline by which we 
are required to implement this program standard. The SUPPORT Act 
requires that the Part D eRx program ``provide for the secure 
electronic transmission of . . . a prior authorization request . . .'' 
by January 1, 2021. In light of this mandate and the benefits of 
encouraging ePA, including increased interoperability between parties 
and a decrease in time spent performing prior authorizations, we are 
allowing Part D sponsors to use NCPDP SCRIPT 2017071 for prior 
authorizations beginning January 1, 2021. In an attempt to balance the 
statutory mandate and the benefits of use of this standard with the 
concerns of the commenters requesting more time and the burden on Part 
D plans in light of the current PHE, we are only requiring use of the 
standard beginning January 1, 2022. We believe that the January 1, 2022 
deadline affords sufficient time to ensure compliance with this rule. 
Although we understand the request for a 24-month implementation 
timeframe, we believe that the implementation date in this final rule 
appropriately balances the benefits of adoption of the standard and the 
time needed to ensure compliance. We also note that this is only a 
requirement for Part D plans--not providers--so we do not believe that 
the additional 12 months for providers to adopt updates needs to be 
accounted for in the implementation timeframe. As a result of our 
decision to delay requiring use of the standard until January 1, 2022, 
we do not anticipate using enforcement discretion.
    As discussed later in this final rule, we are finalizing proposed 
Sec.  423.160(b)(7) as Sec.  423.160(b)(8). Additionally, to 
effectively finalize the implementation date changes, we are 
restructuring the regulation text at Sec.  423.160(b)(8). As finalized, 
paragraph (b)(8)(i) allows for use of the NCPDP SCRIPT standard by 
January 1, 2021, and paragraph (b)(8)(ii) requires use of the standard 
by January 1, 2022. Accordingly, we have redesignated proposed 
paragraphs (b)(7)(i) through (iv), which list the covered electronic 
prior authorization transactions, as paragraphs (b)(8)(i)(A) through 
(D).
    Comment: Some commenters stated that although they applaud 
implementing the NCPDP SCRIPT standard version 2017071 ePA transactions 
for Part D, they believe that it should be acceptable for all pharmacy 
transactions. The reasons commenters gave for this were their belief 
that the SCRIPT standard is the most appropriate standard for all 
pharmacy transactions, regardless of payer or inclusion in Part D, and 
that using two standards for the same workflow will cause an 
unnecessary burden.
    Response: We thank the commenters for their support for 
implementing this rule, and appreciate their feedback. However, 
suggestions regarding the use of these standards outside of the Part D 
eRx program are outside the scope of this rule. This final rule 
implements section 6062 of the SUPPORT Act, which requires the program 
to provide for the secure electronic transmission of Part D drugs for a 
Part D eligible individual enrolled in a Part D plan. As such, 
electronic transmissions outside of the Part D context go beyond the 
scope of this rule.

[[Page 86830]]

    Although we are sympathetic to concerns about having to support two 
standards within the same workflow, we are unable to remedy this issue 
within the scope of this final rule, which implements section 6062 of 
the SUPPORT Act. We believe that having the two standards is consistent 
with Congress' intent when promulgating this section of the SUPPORT 
Act, since the statutory mandate only extended to providing for 
electronic transmissions in Part D.
    Comment: A commenter requested that CMS either issue clarifying 
guidance in the final rule to indicate that HIPAA's Referral 
Certification and Authorization standards do not apply to ePA 
transactions for prescription drugs, or name the NCPDP SCRIPT standard 
version 2017071 as the HIPAA standard for ePA transactions for 
prescription drugs. The commenter stated that the ASC X12 prior 
authorization transaction named under HIPAA is for medical benefits and 
is not effective for the exchange of information related to prior 
authorizations of products covered under a pharmacy benefit.
    Response: We are unable to do as requested. Suggestions regarding 
the use of these standards outside of the Part D eRx program are 
outside the scope of this rule. This final rule implements section 6062 
of the SUPPORT Act, which requires the program to provide for the 
secure electronic transmission of Part D drug for a Part D eligible 
individual enrolled in a Part D plan. As such, electronic transmissions 
outside of the Part D context go beyond the scope of this rule.
    Comment: Several commenters stated that CMS should allow and 
encourage other ePA standards, such as the Fast Healthcare 
Interoperability Resources (FHIR) standard promulgated by the standards 
development organization Health Level 7 (HL7). This standard supports 
application programming interfaces (APIs), and encouraged us to adopt 
these standards for other eRx contexts.
    Response: Although we appreciate this feedback, these comments are 
outside the scope of this rule. The proposed rule only covered our 
proposals to implement the SUPPORT Act's mandate to implement an ePA 
standard under Part D. At this time, the suggested standard and 
application programming interfaces are not used to support most 
pharmacy transactions. We will continue to monitor the development, 
maturity, and industry adoption of HL7 FHIR standards for future 
rulemaking.
    In addition, to the extent the commenters were suggesting the 
adoption of more broadly applicable standards outside of the Part D eRx 
program, section 6062 of the SUPPORT Act, which this rule implements, 
only allows for the use of an ePA standard that is different from the 
HIPAA standard if it is for a Part D covered drug prescribed to a Part 
D eligible individual. Other ePA medication transactions outside of 
Part D are still governed by HIPAA standards.
    Comment: Some commenters requested more guidance surrounding the 
use of PA generally, including information about PA processing times 
allowed under Part D and how PAs interact with subregulatory guidance 
for Medicare health and drug programs.
    Response: Although we appreciate commenters' interest in learning 
more about use of PA in the Medicare programs, these comments are not 
within the scope of this rule. As previously mentioned, the sole 
purpose of this rule is to implement the SUPPORT Act's mandate that 
requires our adoption of a new standard for ePA in the Part D eRx 
program. However, we would note that PA is a key component of 
utilization management under a Part D plan, and consistent with Sec.  
423.153, we would further remind commenters that each Part D plan is 
required to review the effectiveness of its utilization management 
policies and systems. Such review should include ensuring the 
prevention of over-utilization and under-utilization of prescribed 
medications. To the extent that automation of the PA function will 
allow plans to improve their ongoing monitoring of utilization 
management programs through enhanced reporting, they should use that 
improved functioning. In addition, as coverage of drugs that undergo a 
PA constitutes a coverage determination, such determinations are 
subject to all applicable coverage determination standards, timelines, 
and requirements.
    Comment: A commenter requested clarification about whether the 
proposed rule, if finalized, would ban prescribers from conducting PA 
using non-electronic means or whether it would only require prescribers 
to use the NCPDP SCRIPT standard version 2017071 ePA transactions if 
they intend to process PA via electronic means. Another commenter 
believed that naming the NCPDP SCRIPT standard version 2017071 ePA 
transactions was premature given the challenges inherent in the 
practice of rural medicine, which can be impacted by limited or 
inconsistent technological capabilities.
    Response: This rule only requires plans support the NCPDP SCRIPT 
standard version 2017071. Prescribers who elect to conduct PA 
electronically in the Part D eRx context will be required to do so 
using the adopted standards. Prescribers remain free to use non-
electronic means of conducting PA, and Part D plans are still required 
to accept prior authorization requests via existing means, such as via 
facsimile (FAX).
    Comment: A commenter requested that CMS adopt the same electronic 
prescribing standards used for prescribers to communicate with 
Prescription Drug Management Program (PDMP) databases. The commenter 
did not identify the standard generally used by PDMPs.
    Response: We did not consider the standard the commenter alluded to 
because without knowing the details of the standard generally used by 
PDMPs we are unable to assess whether it was or was not a standard 
considered for Part D eRx ePA. We appreciate the commenter's concerns 
about interoperability, but we are unable to delay naming of the 
proposed transactions while we evaluate the degree to which PDMPs may 
or may not be using the NCPDP SCRIPT standard version 2017071 or some 
alternative. Due to the statutory deadline to implement ePA in the Part 
D eRx program, we needed to select a standard that is ready for use in 
ePA transactions.
    Comment: Another commenter urged CMS to allow voluntary use of 
other standards if mutually agreed upon between trading partners.
    Response: We would like to emphasize that this rule proposed the 
NCPDP SCRIPT standard version 2017071 ePA transactions in part because 
health plans are already required to support use of that same version 
of the standard for other transactions beginning January 1, 2020, in 
accordance with the April 2018 final rule. As the ePA transactions are 
part of version 2017071 of the NCPDP SCRIPT standard, we do not believe 
it would be advisable to allow voluntary use of a different version of 
the NCPDP SCRIPT standard as that would require all trading partners to 
support different versions of the standard at the same time in order to 
comply with Part D program requirements, which we believe would impose 
unnecessary burden. CMS will consider proposing use of future updates 
to the NCPDP SCRIPT standard in future Part D e-prescribing rules as 
the need arises.
    In order to ensure that ePA permeates across the industry for Part 
D and that multiple Part D stakeholders can participate in it, we 
believe that one Part D ePA standard should be used rather

[[Page 86831]]

than simply allowing any stakeholder to use his/her preferred standard.
    In addition, based on our analysis of available standards that led 
to our proposing to adopt the NCPDP SCRIPT standard version 2017071 for 
ePA under Part D, we question how many trading partners would wish to 
support the added cost and complexity of using ePA transactions drawn 
from an entirely different standard. Requiring consistent use of the 
same ePA standards throughout the Part D eRx program also ensures all 
plans and prescribers serving Part D eligible patients are able to 
conduct ePA transactions with one another.
    Comment: One commenter noted that although they do not disagree 
with our characterization of the X12 278 transaction as the wrong type 
of standard for this transaction, they did alert us to the fact that 
the X12 278 transaction can now be used in real-time transactions, in 
addition to batched transactions.
    Response: We thank the commenter for alerting us to this new 
development, and have consequently amended the statement in the 
background section to clarify that the X12 278 standard was not a real-
time transaction in 2004.
    Comment: A commenter disagreed with our statement that the SCRIPT 
transaction can determine whether the beneficiary's plan requires a PA 
for a given transaction, stating that the standard is not designed to 
determine whether prior authorization is required for a given 
transaction.
    Response: We thank the commenter for this correction. We have not 
included this statement in the background section of this final rule.
    Comment: A commenter expressed concern that this final rule would 
conflict with the information blocking and certification requirements 
from the March 4, 2019, Office of the National Coordinator for 
Information Technology (ONC) notice of proposed rulemaking (NPRM) (84 
FR 7424), should it be finalized. Another commenter urged HHS to 
incorporate the NCPDP ePA transaction standard into future 
certification editions from ONC.
    Response: In ONC's May 1, 2020 final rule titled ``21st Century 
Cures Act: Interoperability, Information Blocking, and the ONC Health 
IT Certification Program'' (ONC 21st Century Cures Act final rule), ONC 
finalized policies which directly align with the standard adopted in 
this final rule that supports ePA transactions and standards (85 FR 
25642). Specifically, the ONC 21st Century Cures Act final rule adopted 
the NCPDP SCRIPT standard version 20170701 for Health IT Modules 
seeking certification to the Sec.  170.315(b)(3) electronic prescribing 
criterion under the ONC Health IT Certification Program. The ONC 21st 
Century Cures Act final rule also adopted the ePA transactions in the 
NCPDP SCRIPT standard version 2017071 as optional for the updated Sec.  
170.315(b)(3) electronic prescribing criterion (85 FR 25685). As noted 
in the 21st Century Cures Act final rule, ONC believes the adoption of 
the ePA transactions included in version 2017071 of the NCPDP SCRIPT 
standard as optional transactions within this certification criteria 
supports alignment between the health IT certification program and Part 
D ePA policy.
    We also note that CMS published the Patient Access and 
Interoperability final rule (85 FR 25510) concurrently with ONC's 21st 
Century Cures Act final rule on May 1, 2020. The CMS final rule 
requires certain payers, such as such as MA plans and Medicaid and CHIP 
programs, to make enrollee electronic health information held by the 
payer available through application programming interfaces (APIs) 
conformant to HL7 FHIR and other API standards that ONC adopted in 45 
CFR 170.215.
    Neither rule finalized a standard for conduct of ePA, nor did they 
require ePA be conducted through APIs conformant with the FHIR 
standard. The purpose of the current rule is to encourage the exchange 
of electronic health information by naming a standard suitable to 
support ePA by January 1, 2021. We will continue to monitor efforts 
within the health IT industry to support electronic prescribing 
transactions through emerging standards such as HL7 FHIR and 
technologies like APIs and will consider such developments in future 
rulemaking.
    Comment: A commenter expressed concern that this rule would 
conflict with the CMS Interoperability and Patient Access proposed rule 
that was issued on March 4, 2019 (84 FR 7610), should it be finalized. 
In CMS Interoperability and Patient Access proposed rule, we noted that 
in June 2018, in support of the Da Vinci project (a private-sector 
initiative led by Health Level 7 (HL7), the CMS Medicare FFS program 
began: (1) Developing a prototype Documentation Requirement Lookup 
Service for the Medicare FFS program and (2) populating it with the 
list of items/services for which prior authorization is required by the 
Medicare FFS program (84 FR 7613).
    Response: This rule can be finalized, as proposed, without 
conflicting with the CMS Interoperability and Patient Access final rule 
(85 FR 25510) which did not require payers to develop a prototype 
Documentation Requirement Lookup Service (DRLS). The DRLS was described 
in the proposed rule as work CMS was doing related to HL7 FHIR 
standards. We believe that the listing of items or services for 
purposes of a DRLS, as encouraged by CMS, is separate and distinct from 
requiring that a certain standard be used for ePA transactions for 
prescribers. This rule would require only the latter in the Part D eRx 
program context. Although CMS has recently proposed a rule requiring 
payers to use DRLS (85 FR 82586), this requirement does not extend to 
Part D. As a result, we continue to believe that this is separate and 
distinct from the requirements of this final rule.
    Comment: A few commenters questioned whether pharmacies would be 
permitted to actively use the NCPDP SCRIPT standard version 2017071 
transactions for ePAs performed on behalf of a beneficiary enrolled in 
Part D. One of these commenters stated that pharmacies that serve 
beneficiaries in long term care (LTC) settings would benefit from using 
the ePA transactions. They noted that applicable state laws permit 
dispensers to fulfill the terms of a prior authorization and suggest 
that we change the verbiage of the proposed regulation to allow 
``dispensers (as applicable)'' to the parties required to use the NCPDP 
SCRIPT standard version 2017071 ePA transactions adopted in this final 
rule.
    Response: We appreciate the commenters' concerns. However, this 
rule does not seek to change the current regulation with regard to who 
may request a PA on behalf of the beneficiary. Under our regulation at 
Sec.  423.566(c), a pharmacy cannot request a coverage determination on 
behalf of an enrollee, unless the pharmacy is the enrollee's appointed 
representative. We believe that changing who may request a PA is 
outside the scope of the proposed rule. However, we will take the 
suggestion under advisement.
    Comment: A commenter requested that CMS use this regulation as an 
opportunity to implement other provisions of the SUPPORT Act, such as 
section 2003 of the SUPPORT Act requiring the use of e-prescribing for 
opioids.
    Response: We understand the importance of ensuring that all 
provisions of the SUPPORT Act are implemented. However, what is 
suggested in this comment is outside the scope of this rule, as the 
proposed rule only sought to implement section 6062 of the SUPPORT 
Act--not the entirety of the Act.

[[Page 86832]]

    Comment: A commenter noted that the proposed NCPDP SCRIPT standard 
does not in itself prepopulate National Drug Codes (NDCs), rather NDCs 
are prepopulated by eRx and EHR systems if they are capable of doing so 
and set up to pre-fill such fields with known values.
    Response: Upon re-evaluation we now understand that these NDCs are 
indeed completed by eRx and EHR systems with certain capabilities that 
are set up to do this work. During our initial research we had seen 
that the NDCs were widely prepopulated and incorrectly attributed this 
to the NCPDP SCRIPT standard. We appreciate this correction. In light 
of this understanding, we believe that the promulgation of a single 
standard electronic ePA for Part D-covered drugs prescribed to Part D-
eligible individuals will encourage any remaining eRx and EHR vendors 
that do not offer the functionality to prepopulate NDCs to begin to do 
so, and continue to follow the NCPDP SCRIPT implementation guide.
    Comment: A commenter clarified that the NCPDP Telecommunications 
standard D.0 is, indeed, a real time transaction.
    Response: We appreciate the opportunity to further explain our 
assertions in the proposed rule. As the commenter states, the NCPDP 
Telecommunications D.0 standard is, indeed, a real time standard. 
However, because it is designed as a transaction between the pharmacy 
and the plan, it does not allow a prescriber to transmit information 
necessary to satisfy a prior authorization in real time. In practical 
terms when a drug is subject to prior authorization the 
Telecommunications standard conveys a real-time rejection to the 
pharmacy but leaves the prescriber unaware of the rejection, and unable 
to convey information to the plan which would satisfy the terms of the 
PA. To our knowledge, the NCPDP SCRIPT standard version 2017071 remains 
the only mechanism by which a prescriber can satisfy the terms of a 
prior authorization electronically in real time.
    Comment: One commenter recommended that we amend our regulation 
text so that it states that the prescription-related information flows 
between prescribers and Part D sponsors, rather than prescribers and 
dispensers, which is what we stated in the proposed rule.
    Response: We thank the commenter for the correction and have 
amended the text accordingly.
    Comment: A commenter noted that since the May 2019 final rule 
amended the regulation text to include Sec.  423.160(b)(7), the 
proposed rule should have been amended to include a new Sec.  
423.160(b)(8).
    Response: We appreciate this comment and are finalizing the 
proposal in Sec.  423.160(b)(8).
    Comment: A commenter noted that some of the citations to the HIPAA 
standards at section 1860D-4(e)(4) of the Act and the new SUPPORT Act 
mandate at section 1860D-4(e)(2)(E)(ii)(III) of the Act were incorrect.
    Response: We have revised the preamble to correct the citations 
noted by the commenter.
    After review and consideration of the comments received, and for 
the reasons discussed herein and in the proposed rule, we are 
finalizing our proposed revision, with the following modifications:
     We are finalizing proposed Sec.  423.160(b)(7) as Sec.  
423.160(b)(8).
     We are restructuring the final regulation text to permit 
Part D sponsors to use the standard beginning January 1, 2021 at Sec.  
423.160(b)(8)(i), but not require its use until January 1, 2022 at 
Sec.  423.160(b)(8)(ii).
     We are redesignating proposed Sec.  423.160(b)(7)(i) 
through (iv) which list the covered electronic prior authorization 
transactions, as Sec.  423.160(b)(8)(i)(A) through (D) in this final 
rule.

III. Collection of Information Requirements

    Under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et 
seq.), we are required to provide 60-day notice in the Federal Register 
and solicit public comment before a ``collection of information'' 
requirement is submitted to the Office of Management and Budget (OMB) 
for review and approval. For the purposes of the PRA and this section 
of the preamble, collection of information is defined under 5 CFR 
1320.3(c) of the PRA's implementing regulations.
    In order to fairly evaluate whether an information collection 
should be approved by OMB, section 3506(c)(2)(A) of the PRA requires 
that we solicit comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency.
     The accuracy of our estimate of the information collection 
burden.
     The quality, utility, and clarity of the information to be 
collected.
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    Our June 19, 2019 (84 FR 28450) proposed rule solicited public 
comment on each of the required issues under section 3506(c)(2)(A) of 
the PRA for our proposed information collection requirements, burden, 
and assumptions. Two comments were received. A summary of the comments 
is set out in this section of the document in this section of this rule 
along with our response.
    The following changes will be submitted to OMB for approval under 
control number 0938-TBD (CMS-10755). Please note that our proposed rule 
indicated that the changes would be submitted under control number 
0938-0763 (CMS-R-262). However, based on internal review we have since 
determined that the changes should be set out under a new collection of 
information request. Importantly, the new collection of information 
request (0938-TBD; CMS-10755) has no effect on our proposed and final 
requirements and burden estimates. Rather, we are simply changing the 
location of those requirements and burden estimates. Please note that 
OMB will issue the new control number when ready. In the meantime it is 
to be determined (or ``TBD''). The new collection of information 
request's CMS identification number (CMS-10755) is not subject to 
change.
    This rule implements section 6062 of the SUPPORT Act, which 
requires the adoption of technical standards for the Part D e-
prescribing program to help ensure secure ePA requests and response 
transactions. Specifically, this final rule amends the Prescription 
Drug Benefit program (Part D) regulations to require under Sec.  
423.160(b)(8) that Part D plan sponsors (hereinafter, ``Part D plans'' 
or ``plans'') have the technical capability to support the National 
Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 
2017071 when performing ePA for Part D-covered drugs prescribed to Part 
D-eligible individuals. While this final rule will not impact the PA 
criteria which Part D plans have in place, the electronic process will 
make the PA process less burdensome for plans and prescribers. 
Prescribers who are currently capable of using an electronic 
prescribing software likely already have access to the ePA transaction 
standards, and would be expected to generally be able to access the 
transactions without cost. As ePA is implemented, the current system of 
manual processing (fax and phone calls) will fade in the Part D context 
since plans will be able to use the adopted standard, and incentivize 
their prescribers to conduct ePA. We expect that prescribers will be 
more likely to conduct ePA now that

[[Page 86833]]

this less burdensome standard is currently available to them.
    We estimate a one-time cost for plans to implement the necessary 
changes to support the ePA transactions within NCPDP SCRIPT standard 
version 2017071. After consulting with industry stakeholders, we have 
concluded that implementing or building the type of logic which will 
allow systems engineers to produce the interactive logic which the 
NCPDP SCRIPT standard requires can vary based on how the PA criteria 
are currently documented, but $6,500 is the approximate average cost as 
the cost varies based on the size and expertise of the plan. The $6,500 
figure includes only the plan's internal costs including labor, initial 
development and programming, and systems support to transform each of 
its CMS-approved PA criteria from a free flowing manual process 
suitable for telephonic or facsimile communication with a clinical 
professional into a 2017071-compliant step-by-step query process that 
can be adapted for use by programmers. Based on our internal data, we 
estimate that this rule will apply to 774 plans. We estimate that only 
2 percent (or 15) of the plans (774 plans x 0.02) do not already have 
the internal ePA process capabilities that will be required to build 
the logic to support NCPDP SCRIPT standard version 2017071's ePA 
transactions. In that regard we estimate a one-time implementation cost 
of approximately $100,000 (15 plans x $6,500/plan) or $33,000 annually 
when factoring in OMB's 3-year approval period, which is required for 
all new Paperwork Reduction Act activities ($100,000/3 years). We are 
annualizing the one-time estimate since we do not anticipate any 
additional burden after the 3-year approval period expires.
    Based on our informal conversations with the industry, we believe 
that the ongoing cost that plans will incur to process ePA transactions 
range from $1.20 to $2.85 per transaction, which varies based on vendor 
and volume. Based on internal CMS data, for the 774 plans we estimate 
that 560,430 PAs are performed every year and that each authorization 
requires two individual transactions, one for receiving and one for 
responding. Using $2.03 as the average cost per transaction ([$1.20 + 
$2.85]/2) we estimate $4.06 per authorization ($2.03/transaction x 2 
transactions/authorization). In aggregate we project an ongoing 
transaction (both receiving and responding) cost of $2,275,346 annually 
($4.06/authorization x 560,430 authorizations) for all plans.
    With regard to current practice, 98 percent (or 15) of the plans 
(774 plans x 0.02) already have the capacity to process automated PAs. 
However, when they perform these processes manually, they spend an 
average of $10.00/fax PA for 549,221.4 authorizations (560,430 
authorizations x 0.98) at a cost of $5,492,214 (549,221 PAs x $10.00/
PA). The remaining 15 plans that rely on phone or fax and manual review 
spend an average of $25.00/manual PA for 11,209 authorizations (560,430 
authorizations x 0.02) at a cost of $280,225, (11,209 PAs x $25.00/PA). 
In this regard the transaction cost for the current practice is 
approximately $5,729,439 ($5,492,214 + $280,225).
    In addition, we believe that there will be added savings due to 
fewer appeals being processed. We estimate that 900 appeals are 
processed annually due to mistakes emanating from the use of manual PA, 
including missing PA information and the PAs not being received by the 
correct party. We believe that these appeals would be eliminated, since 
ePA requires input of all necessary information for the transactions to 
be processed and provides a secure means of delivery to the recipients. 
We estimate that it costs $101.63 to process each of these appeals 
based on the 1.25 hours at $69.72/hr that it takes a quality officer at 
each organization to process the appeal and the cost of sending the 
appropriate notices, which would lead to a savings to plans of $91,467 
(900 appeals x $101.63). When we add this savings to the $3,454,093 
already saved, we project a total annual savings of $3,454,560 
($3,454,093 + $91,467). This figure differs slightly from the estimate 
that was set out in our June 19, 2019 proposed rule. That rule had 
inadvertently excluded the savings emanating from the revised number of 
appeals. In addition, the rule had overestimated the amount of plans 
that would need to make changes to implement the standard and the 
burden to implement it. We are correcting that oversight in this final 
rule.
    Since this final rule only requires plans, and not prescribers, to 
implement the standard, we are not estimating costs that assume 
prescribers will transition to this standard. As a result, we did not 
include the aforementioned transaction costs and appeals savings in our 
tabulation of the final costs of implementing this rule. Therefore, we 
believe that the final cost of this rule will be the $100,000 for plans 
to implement this standard. As indicated, we received public comments 
related to the PRA. The following summarizes the comments and provides 
our response:
    Comment: A commenter requested that CMS include the burden to 
physicians. Another commenter expressed concern about the potential 
costs to practices to switch to the new standard, and requested that we 
bar EHR vendors from passing on additional transaction costs to 
providers or patients. Another commenter stated that they believe our 
assumption incorrectly assumed that a provider's electronic prescribing 
software already has support for all NCPDP SCRIPT transactions.
    Response: We thank commenters for the information about other 
factors that we should consider when estimating the implementation 
costs for providers to implement a new standard. However, we clarify 
that this rule imposes requirements only on Part D plans--if physicians 
elect to utilize ePA in the Part D program context, they will be 
required to do so using the adopted standard, but they are free to 
conduct PA through other means. We believe our proposed rule 
incorrectly included prescriber costs in our estimates. We have removed 
these estimates from the calculations on this final rule. While we 
understand the potential costs for providers and EHR vendors to pass on 
transaction costs to providers or plans, we do not have the statutory 
authority to regulate EHRs. As previously mentioned, this final rule 
implements section 1860D-4(e)(2)(E) of the Act requiring that the 
program provide for the secure electronic transmission of prior 
authorization requests and responses. However, this section of the Act 
does not expand CMS's authority to allow the agency to regulate EHR 
vendors or specify who may bear the cost of implementing the 
transaction. As a result, we are not able to adopt this commenter's 
suggestion that we bar EHR vendors from passing on transactions costs 
to providers or patients.
    Comment: A commenter requested that CMS revise its estimates to 
account for ongoing maintenance costs associated with ePA.
    Response: We acknowledged in the proposed rule that there would be 
a cost associated with maintenance of systems to support electronic 
prior authorizations. These costs are included in our ongoing 
methodology which, based on our research, we estimated to range from 
$1.20 to $2.85 per transaction for a total of $2.27 million. Since 
commenters did not provide specific feedback on the veracity of this 
estimate, we will finalize the estimates as initially presented.

[[Page 86834]]

IV. Regulatory Impact Statement

A. Statement of Need

    This rule implements provisions of the SUPPORT Act, which require 
the adoption of transaction standards for the Part D program that will 
help ensure secure electronic PA request and response transactions. 
Specifically, this final rule amends the Prescription Drug Benefit 
program (Part D) regulations to require that Part D sponsors have the 
technical capability to support the National Council for Prescription 
Drug Programs (NCPDP) SCRIPT standard version 2017071 when performing 
electronic Prior Authorization (ePA) for Part D-covered drugs 
prescribed to Part D-eligible individuals.

B. Overall Impact

    We have examined the impact of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the 
Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), 
Executive Order 13132 on Federalism (August 4, 1999), the Congressional 
Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing 
Regulation and Controlling Regulatory Costs (January 30, 2017).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
regulatory impact analysis (RIA) must be prepared for major rules with 
economically significant effects ($100 million or more in any one 
year). This rule does not reach the economic threshold and thus is not 
considered a major rule.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
less than $7.5 million to $38.5 million annually. Individuals and 
states are not included in the definition of a small entity. We are not 
preparing an analysis for the RFA, because we have determined, and the 
Secretary certifies, that this final rule will not have a significant 
economic impact on a substantial number of small entities.
    In addition, section 1102(b) of the Act requires us to prepare an 
RIA if a rule may have a significant impact on the operations of a 
substantial number of small rural hospitals. This analysis must conform 
to the provisions of section 604 of the RFA. For purposes of section 
1102(b) of the Act, we define a small rural hospital as a hospital that 
is located outside of a Metropolitan Statistical Area for Medicare 
payment regulations and has fewer than 100 beds. We are not preparing 
an analysis for section 1102(b) of the Act because we have determined, 
and the Secretary certifies, that this rule will not have a significant 
impact on the operations of a substantial number of small rural 
hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any one year of 
$100 million in 1995 dollars, updated annually for inflation. In 2020, 
that threshold is approximately $156 million. This rule will have no 
consequential effect on state, local, or tribal governments or on the 
private sector.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on state 
and local governments, preempts state law, or otherwise has Federalism 
implications. Since this rule does not impose any costs on state or 
local governments, the requirements of Executive Order 13132 are not 
applicable.
    If regulations impose administrative costs on reviewers, such as 
the time needed to read and interpret this final rule, then we should 
estimate the cost associated with regulatory review. There are 
currently 774 PD contracts (excluding PACE organizations, since they 
are not affected by this regulation)). We assume each entity will have 
one designated staff member who will review the entire rule. Other 
assumptions are possible and will be reviewed after the calculations, 
in this section of this rule.
    Using the wage information from the Bureau of Labor Statistics 
(BLS) for medical and health service managers (code 11-9111), we 
estimate that the cost of reviewing this final rule is $107.38 per 
hour, including fringe benefits and overhead costs (https://www.bls.gov/oes/current/oes_nat.htm). Assuming an average reading speed, we 
estimate that it will take approximately 12.5 hours for each person to 
review this final rule. For each entity that reviews the rule, the 
estimated cost is therefore, $1,342 (12.5 hours x $107.38). Therefore, 
we estimate that the total cost of reviewing this final rule is 
$1,342,000 ($1,342 x 1,000 reviewers).
    Note that this analysis assumed one reader per contract. Some 
alternatives include assuming one reader per parent entity. Using 
parent organizations instead of contracts will reduce the number of 
reviewers to approximately 500 (assuming approximately 250 parent 
organizations), and this will cut the total cost of reviewing in half. 
The argument for this is that a parent organization might have local 
reviewers; even if that parent organization has several contracts that 
might have a reader for each distinct geographic region, to be on the 
lookout for effects of provisions specific to that region.
    Executive Order 13771, titled Reducing Regulation and Controlling 
Regulatory Costs, was issued on January 30, 2017 (82 FR 9339, February 
3, 2017). It has been determined that this rule does not impose more 
than a de minimis costs; and thus, is not a regulatory action for 
purposes of E.O. 13771.

C. Anticipated Effects

    As stated previously, section 6062 of the SUPPORT Act requires the 
adoption of technical standards for the Part D program that will ensure 
secure ePA request and response transactions no later than January 1, 
2022, and allows for Part D sponsors to begin using the standard by 
January 1, 2021. We are codifying requirements at Sec.  423.160, which 
require plans to support the National Council for Prescription Drug 
Programs (NCPDP) SCRIPT standard version 2017071 by January 1, 2022 
when performing ePA for Part D-covered drugs prescribed to Part D-
eligible individuals. This final rule has the following impacts.
    Entities affected by the PA processes include pharmacies receiving 
ePAs from providers and filling the prescription, prescribers who use 
ePA, the Medicare Part D Program, Part D plans, EHR vendors who need to 
modify their products, and the Promoting Interoperability Programs, for 
any Part D prescribers in these programs. Information about what 
programs are included in the Medicare Promoting Interoperability 
Programs is available via this web link: https://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/?redirect=/EHRincentiveprograms. We do not

[[Page 86835]]

anticipate any impacts to the Medicare program, beneficiaries, or other 
stakeholders.
    There are three primary aspects of the provision that could affect 
its cost and the amount saved. The most immediate cost comes from the 
one-time implementation cost for the few EHR vendors that need to need 
to change their programming to use two standards; the NCPDP SCRIPT 
standard version 2017071 for Part D ePA and the HIPAA standard for 
other contexts. Based on our conversations with EHR vendors, we believe 
that it will take the EHR vendors approximately 200 developing hours 
and 800 programming hours to enable the EHRs to utilize two standards.
    We also estimated what it will cost plan sponsors to implement this 
standard. After consulting with industry stakeholders, we have 
concluded that implementing or building to the SCRIPT standard can 
vary, but $6,500 is the approximate amount per plan and $100,000 is the 
approximate amount for the industry. We estimate that only 2 percent of 
the 774 plans will have to make changes to their ePA process to 
implement the NCPDP SCRIPT standard version 2017071 ePA transactions, 
which gives us an approximate one time implementation cost of $100,000 
(15 * $6,500).

E. Alternatives Considered

    We considered requiring the adoption of the standard by January 1, 
2021 to ensure that this important mandate was implemented quickly. 
However, we want to help ensure that plans have as much time to comply 
with the statutory mandate as possible.

F. Accounting Statement and Table

    The following table summarizes overall costs for this rule. The 
cost comes from implementing the new standard.

----------------------------------------------------------------------------------------------------------------
                                       2022            2023            2024            2025            2026
----------------------------------------------------------------------------------------------------------------
Total Costs....................        $100,000   ..............  ..............  ..............  ..............
Net Savings....................  ...............  ..............  ..............  ..............  ..............
----------------------------------------------------------------------------------------------------------------

List of Subjects in 42 CFR Part 423

    Administrative practice and procedure, Emergency medical services, 
Health facilities, Health maintenance organizations (HMO), Health 
professionals, Incorporation by reference, Medicare, Penalties, 
Privacy, Reporting and recordkeeping requirements.

    For the reasons set forth in the preamble, the Centers for Medicare 
& Medicaid Services amends 42 CFR part 423 as set forth below:

PART 423--VOLUNTARY MEDICARE PRESCRIPTION DRUG BENEFIT

0
1. The authority citation for part 423 continues to read as follows:

    Authority:  42 U.S.C. 1302, 1306, 1395w-101 through 1395w-152, 
and 1395hh.


0
2. Section 423.160 is amended by adding paragraph (b)(8) to read as 
follows:


Sec.  423.160   Standards for electronic prescribing.

* * * * *
    (b) * * *
    (8) Electronic prior authorization. (i) Beginning January 1, 2021, 
Part D sponsors and prescribers may use the National Council for 
Prescription Drug Programs SCRIPT standard, Implementation Guide 
Version 2017071 approved July 28, 2017 (incorporated by reference in 
paragraph (c)(1)(vii) of this section), to provide for the 
communication of a prescription or prescription-related information 
between prescribers and Part D sponsors for the following transactions:
    (A) PAInitiationRequest and PAInitiationResponse.
    (B) PARequest and PAResponse.
    (C) PAAppealRequest and PAAppealResponse.
    (D) PACancelRequest and PACancelResponse.
    (ii) Beginning January 1, 2022, Part D sponsors and prescribers 
must use the standard specified in paragraph (b)(8)(i) of this section 
for the transactions listed in paragraphs (b)(8)(i)(A) through (D) of 
this section.
* * * * *

    Dated: February 6, 2020.
Seema Verma,
Administrator, Centers for Medicare & Medicaid Services.
    Dated: March 13, 2020.
Alex M. Azar II,
Secretary, Department of Health and Human Services.

    Editorial note:  This document was received for publication by 
the Office of the Federal Register on December 23, 2020.
[FR Doc. 2020-28877 Filed 12-29-20; 4:15 pm]
BILLING CODE 4120-01-P