(a) Basic rule. Each State must ensure that all services covered under the State plan are available and accessible to enrollees of MCOs, PIHPs, and PAHPs in a timely manner. The State must also ensure that MCO, PIHP and PAHP provider networks for services covered under the contract meet the standards developed by the State in accordance with § 438.68.

(b) Delivery network. The State must ensure, through its contracts, that each MCO, PIHP and PAHP, consistent with the scope of its contracted services, meets the following requirements:

(1) Maintains and monitors a network of appropriate providers that is supported by written agreements and is sufficient to provide adequate access to all services covered under the contract for all enrollees, including those with limited English proficiency or physical or mental disabilities.

(2) Provides female enrollees with direct access to a women's health specialist within the provider network for covered care necessary to provide women's routine and preventive health care services. This is in addition to the enrollee's designated source of primary care if that source is not a women's health specialist.

(3) Provides for a second opinion from a network provider, or arranges for the enrollee to obtain one outside the network, at no cost to the enrollee.

(4) If the provider network is unable to provide necessary services, covered under the contract, to a particular enrollee, the MCO, PIHP, or PAHP must adequately and timely cover these services out of network for the enrollee, for as long as the MCO, PIHP, or PAHP's provider network is unable to provide them.

(5) Requires out-of-network providers to coordinate with the MCO, PIHP, or PAHP for payment and ensures the cost to the enrollee is no greater than it would be if the services were furnished within the network.

(6) Demonstrates that its network providers are credentialed as required by § 438.214.

(7) Demonstrates that its network includes sufficient family planning providers to ensure timely access to covered services.

(c) Furnishing of services. The State must ensure that each contract with a MCO, PIHP, and PAHP complies with the following requirements.

(1) Timely access. Each MCO, PIHP, and PAHP must do the following:

(i) Meet and require its network providers to meet State standards for timely access to care and services taking into account the urgency of the need for services, as well as appointment wait times specified in § 438.68(e).

(ii) Ensure that the network providers offer hours of operation that are no less than the hours of operation offered to commercial enrollees or comparable to Medicaid FFS, if the provider serves only Medicaid enrollees.

(iii) Make services included in the contract available 24 hours a day, 7 days a week, when medically necessary.

(iv) Establish mechanisms to ensure compliance by network providers.

(v) Monitor network providers regularly to determine compliance.

(vi) Take corrective action if there is a failure to comply by a network provider.

(2) Access and cultural considerations. Each MCO, PIHP, and PAHP participates in the State's efforts to promote the delivery of services in a culturally competent manner to all enrollees, including those with limited English proficiency and diverse cultural and ethnic backgrounds, disabilities, and regardless of sex which includes sex characteristics, including intersex traits; pregnancy or related conditions; sexual orientation; gender identity and sex stereotypes.

(3) Accessibility considerations. Each MCO, PIHP, and PAHP must ensure that network providers provide physical access, reasonable accommodations, and accessible equipment for Medicaid enrollees with physical or mental disabilities.

(d) Applicability date. States will not be held out of compliance with the requirements of paragraphs (c)(1)(i) of this section prior to the first rating period that begins on or after 3 years after July 9, 2024, so long as they comply with the corresponding standard(s) codified in 42 CFR 438.206(c)(1)(i) (effective as of October 1, 2023).

(a) Basic rule. The State must ensure, through its contracts, that each MCO, PIHP, and PAHP gives assurances to the State and provides supporting documentation that demonstrates that it has the capacity to serve the expected enrollment in its service area in accordance with the State's standards for access to care under this part, including the standards at § 438.68 and § 438.206(c)(1).

(b) Nature of supporting documentation. Each MCO, PIHP, and PAHP must submit documentation to the State, in a format specified by the State, to demonstrate that it complies with the following requirements:

(1) Offers an appropriate range of preventive, primary care, specialty services, and LTSS that is adequate for the anticipated number of enrollees for the service area;

(2) Maintains a network of providers that is sufficient in number, mix, and geographic distribution to meet the needs of the anticipated number of enrollees in the service area; and

(3) Except as specified in paragraphs (b)(3)(iii) and (iv) of this section and if covered by the MCO's, PIHP's, or PAHP's contract, provides an annual payment analysis using paid claims data from the immediate prior rating period that demonstrates each MCO's, PIHP's, or PAHP's level of payment as specified in paragraphs (b)(3)(i) and (ii) of this section.

(i) The payment analysis must provide the total amount paid for evaluation and management current procedural terminology codes in the paid claims data from the immediate prior rating period for primary care, obstetrical and gynecological, mental health, and substance use disorder services, as well as the percentage that results from dividing the total amount paid by the published Medicare payment rate for the same services.

(A) A separate total and percentage must be reported for primary care, obstetrics and gynecology, mental health, and substance use disorder services; and

(B) If the percentage differs between adult and pediatric services, the percentages must be reported separately.

(ii) For homemaker services, home health aide services, personal care services, and habilitation services, the payment analysis must provide the total amount paid and the percentage that results from dividing the total amount paid by the amount the State's Medicaid FFS program would have paid for the same services.

(A) A separate total and percentage must be reported for homemaker services, home health aide services, personal care services, and habilitation services; and

(B) If the percentage differs between adult and pediatric services, the percentages must be reported separately.

(iii) Payments by MCOs, PIHPS, and PAHPs for the services specified in § 438.207(b)(3)(i) and (ii) for which the MCO, PIHP, or PAHP is not the primary payer are excluded from the analysis required in this paragraph.

(iv) Services furnished by a Federally-qualified health center as defined in section 1905(l)(2) and services furnished by a rural health clinic as defined in section 1905(l)(1) are excluded from the analysis required in this paragraph.

(c) Timing of documentation. Each MCO, PIHP, and PAHP must submit the documentation described in paragraph (b) of this section as specified by the State, but no less frequently than the following:

(1) At the time it enters into a contract with the State.

(2) On an annual basis.

(3) At any time there has been a significant change (as defined by the State) in the MCO's, PIHP's, or PAHP's operations that would affect the adequacy of capacity and services, including—

(i) Changes in MCO, PIHP, or PAHP services, benefits, geographic service area, composition of or payments to its provider network; or

(ii) Enrollment of a new population in the MCO, PIHP, or PAHP.

(d) State review and certification to CMS. After the State reviews the documentation submitted by the MCO, PIHP, or PAHP as specified in paragraph (b) of this section and the secret shopper evaluation results as required at § 438.68(f), the State must submit an assurance of compliance to CMS, in the format prescribed by CMS, that the MCO, PIHP, or PAHP meets the State's requirements for availability of services, as set forth in §§ 438.68 and 438.206.

(1) The submission to CMS must include documentation of an analysis that supports the assurance of the adequacy of the network for each contracted MCO, PIHP or PAHP related to its provider network.

(2) The analysis in paragraph (d)(1) of this section must include the payment analysis submitted by each MCO, PIHP, or PAHP, as required in paragraph (b)(3) of this section, and contain:

(i) The data provided by each MCO, PIHP, and PAHP in paragraph (b)(3) of this section; and

(ii) A State level payment percentage for each service type specified in paragraphs (b)(3)(i) and (ii) of this section produced by using the number of member months for the applicable rating period to weight each MCO's, PIHP's, or PAHP's reported percentages, as required in paragraph (b)(3) of this section.

(3) States must submit the assurance of compliance required in paragraph (d) of this section as specified in paragraphs (i) through (iii) of this section and post the report on the State's website required in § 438.10(c)(3) within 30 calendar days of submission to CMS.

(i) Sufficiently in advance to enable CMS to make a determination that the contract entered into as specified at § 438.207(c)(1) is approved under § 438.3(a).

(ii) On an annual basis and no later than 180 calendar days after each rating period.

(iii) At any time there has been a significant change as specified in paragraph (c)(3) of this section and with the submission of the associated contract, as required at § 438.3(a).

(e) CMS's right to inspect documentation. The State must make available to CMS, upon request, all documentation collected by the State from the MCO, PIHP, or PAHP, as well as documentation from all secret shopper surveys required at § 438.68(f).

(f) Remedy plans to improve access. (1) When the State, MCO, PIHP, PAHP, or CMS identifies an area in which an MCO's, PIHP's, or PAHP's access to care under the access standards in this part could be improved, including the standards at §§ 438.68 and 438.206, the State must:

(i) Submit to CMS for approval a remedy plan as specified in paragraph (f)(ii) of this section no later than 90 calendar days following the date that the State becomes aware of an MCO's, PIHP's, or PAHP's access issue;

(ii) Develop a remedy plan that addresses the identified access issue within 12 months and that identifies specific steps with timelines for implementation and completion, and responsible parties. State's and MCO's, PIHP's, or PAHP's actions may include a variety of approaches, including but not limited to: increasing payment rates to providers, improving outreach and problem resolution to providers, reducing barriers to provider credentialing and contracting, providing for improved or expanded use of telehealth, and improving the timeliness and accuracy of processes such as claim payment and prior authorization;

(iii) Ensure that improvements in access are measurable and sustainable; and

(iv) Submit quarterly progress updates to CMS on implementation of the remedy plan.

(2) If the remedy plan required in paragraph (f)(1) of this section does not result in addressing the MCO's, PIHP's, or PAHP's access issue by improving access within 12 months, CMS may require the State to continue the remedy plan for another 12 months and may require revision to the remedy plan required in paragraph (f)(1) of this section.

(g) Applicability date. Paragraphs (b)(3) and (d)(2) of this section apply to the first rating period for contracts with MCOs, PIHPs, or PAHPs beginning on or after 2 years after July 9, 2024. Paragraph (d)(3) of this section applies to the first rating period for contracts with MCOs, PIHPs, or PAHPs beginning on or after 1 year after July 9, 2024. States will not be held out of compliance with the requirements of paragraph (e) of this section prior to the rating period for contracts with MCOs, PIHPs, or PAHPs beginning on or after 4 year after July 9, 2024, so long as they comply with the corresponding standard(s) codified in 42 CFR 438.207 (e) (effective as of October 1, 2023) Paragraph (f) of this section applies to the first rating period for contracts with MCOs, PIHPs, or PAHPs beginning on or after 4 years after July 9, 2024.

(a) Basic requirement—(1) General rule. Except as specified in paragraphs (a)(2) and (3) of this section, the State must ensure through its contracts, that each MCO, PIHP, and PAHP complies with the requirements of this section.

(2) PIHP and PAHP exception. For PIHPs and PAHPs, the State determines, based on the scope of the entity's services, and on the way the State has organized the delivery of managed care services, whether a particular PIHP or PAHP is required to implement mechanisms for identifying, assessing, and producing a treatment plan for an individual with special health care needs, as specified in paragraph (c) of this section.

(3) Exception for MCOs that serve dually eligible enrollees. (i) For each MCO that serves enrollees who are also enrolled in and receive Medicare benefits from a Medicare Advantage Organization (as defined in § 422.2 of this chapter), the State determines to what extent the MCO must meet the identification, assessment, and treatment planning provisions of paragraph (c) of this section for dually eligible individuals.

(ii) The State bases its determination on the needs of the population it requires the MCO to serve.

(b) Care and coordination of services for all MCO, PIHP, and PAHP enrollees. Each MCO, PIHP, and PAHP must implement procedures to deliver care to and coordinate services for all MCO, PIHP, and PAHP enrollees. These procedures must meet State requirements and must do the following:

(1) Ensure that each enrollee has an ongoing source of care appropriate to his or her needs and a person or entity formally designated as primarily responsible for coordinating the services accessed by the enrollee. The enrollee must be provided information on how to contact their designated person or entity;

(2) Coordinate the services the MCO, PIHP, or PAHP furnishes to the enrollee:

(i) Between settings of care, including appropriate discharge planning for short term and long-term hospital and institutional stays;

(ii) With the services the enrollee receives from any other MCO, PIHP, or PAHP;

(iii) With the services the enrollee receives in FFS Medicaid; and

(iv) With the services the enrollee receives from community and social support providers.

(3) Provide that the MCO, PIHP or PAHP makes a best effort to conduct an initial screening of each enrollee's needs, within 90 days of the effective date of enrollment for all new enrollees, including subsequent attempts if the initial attempt to contact the enrollee is unsuccessful;

(4) Share with the State or other MCOs, PIHPs, and PAHPs serving the enrollee the results of any identification and assessment of that enrollee's needs to prevent duplication of those activities;

(5) Ensure that each provider furnishing services to enrollees maintains and shares, as appropriate, an enrollee health record in accordance with professional standards; and

(6) Ensure that in the process of coordinating care, each enrollee's privacy is protected in accordance with the privacy requirements in 45 CFR parts 160 and 164 subparts A and E, to the extent that they are applicable.

(c) Additional services for enrollees with special health care needs or who need LTSS—(1) Identification. The State must implement mechanisms to identify persons who need LTSS or persons with special health care needs to MCOs, PIHPs and PAHPs, as those persons are defined by the State. These identification mechanisms—

(i) Must be specified in the State's quality strategy under § 438.340.

(ii) May use State staff, the State's enrollment broker, or the State's MCOs, PIHPs and PAHPs.

(2) Assessment. Each MCO, PIHP, and PAHP must implement mechanisms to comprehensively assess each Medicaid enrollee identified by the State (through the mechanism specified in paragraph (c)(1) of this section) and identified to the MCO, PIHP, and PAHP by the State as needing LTSS or having special health care needs to identify any ongoing special conditions of the enrollee that require a course of treatment or regular care monitoring. The assessment mechanisms must use appropriate providers or individuals meeting LTSS service coordination requirements of the State or the MCO, PIHP, or PAHP as appropriate.

(3) Treatment/service plans. MCOs, PIHPs, or PAHPs must produce a treatment or service plan meeting the criteria in paragraphs (c)(3)(i) through (v) of this section for enrollees who require LTSS and, if the State requires, must produce a treatment or service plan meeting the criteria in paragraphs (c)(3)(iii) through (v) of this section for enrollees with special health care needs that are determined through assessment to need a course of treatment or regular care monitoring. The treatment or service plan must be:

(i) Developed by an individual meeting LTSS service coordination requirements with enrollee participation, and in consultation with any providers caring for the enrollee;

(ii) Developed by a person trained in person-centered planning using a person-centered process and plan as defined in § 441.301(c)(1) and (2) of this chapter for LTSS treatment or service plans;

(iii) Approved by the MCO, PIHP, or PAHP in a timely manner, if this approval is required by the MCO, PIHP, or PAHP;

(iv) In accordance with any applicable State quality assurance and utilization review standards; and

(v) Reviewed and revised upon reassessment of functional need, at least every 12 months, or when the enrollee's circumstances or needs change significantly, or at the request of the enrollee per § 441.301(c)(3) of this chapter.

(4) Direct access to specialists. For enrollees with special health care needs determined through an assessment (consistent with paragraph (c)(2) of this section) to need a course of treatment or regular care monitoring, each MCO, PIHP, and PAHP must have a mechanism in place to allow enrollees to directly access a specialist (for example, through a standing referral or an approved number of visits) as appropriate for the enrollee's condition and identified needs.

(d) Applicability date. This section applies to the rating period for contracts with MCOs, PIHPs, and PAHPs beginning on or after July 1, 2017. Until that applicability date, states are required to continue to comply with § 438.208 contained in the 42 CFR parts 430 to 481, edition revised as of October 1, 2015.

(a) Coverage. Each contract between a State and an MCO, PIHP, or PAHP must do the following:

(1) Identify, define, and specify the amount, duration, and scope of each service that the MCO, PIHP, or PAHP is required to offer.

(2) Require that the services identified in paragraph (a)(1) of this section be furnished in an amount, duration, and scope that is no less than the amount, duration, and scope for the same services furnished to beneficiaries under FFS Medicaid, as set forth in § 440.230 of this chapter, and for enrollees under the age of 21, as set forth in subpart B of part 441 of this chapter.

(3) Provide that the MCO, PIHP, or PAHP—

(i) Must ensure that the services are sufficient in amount, duration, or scope to reasonably achieve the purpose for which the services are furnished.

(ii) May not arbitrarily deny or reduce the amount, duration, or scope of a required service solely because of diagnosis, type of illness, or condition of the beneficiary.

(4) Permit an MCO, PIHP, or PAHP to place appropriate limits on a service—

(i) On the basis of criteria applied under the State plan, such as medical necessity; or

(ii) For the purpose of utilization control, provided that—

(A) The services furnished can reasonably achieve their purpose, as required in paragraph (a)(3)(i) of this section;

(B) The services supporting individuals with ongoing or chronic conditions or who require long-term services and supports are authorized in a manner that reflects the enrollee's ongoing need for such services and supports; and

(C) Family planning services are provided in a manner that protects and enables the enrollee's freedom to choose the method of family planning to be used consistent with § 441.20 of this chapter.

(5) Specify what constitutes “medically necessary services” in a manner that—

(i) Is no more restrictive than that used in the State Medicaid program, including quantitative and non-quantitative treatment limits, as indicated in State statutes and regulations, the State Plan, and other State policy and procedures; and

(ii) Addresses the extent to which the MCO, PIHP, or PAHP is responsible for covering services that address:

(A) The prevention, diagnosis, and treatment of an enrollee's disease, condition, and/or disorder that results in health impairments and/or disability.

(B) The ability for an enrollee to achieve age-appropriate growth and development.

(C) The ability for an enrollee to attain, maintain, or regain functional capacity.

(D) The opportunity for an enrollee receiving long-term services and supports to have access to the benefits of community living, to achieve person-centered goals, and live and work in the setting of their choice.

(b) Authorization of services. For the processing of requests for initial and continuing authorizations of services, each contract must require—

(1) That the MCO, PIHP, or PAHP and its subcontractors have in place, and follow, written policies and procedures.

(2) That the MCO, PIHP, or PAHP—

(i) Have in effect mechanisms to ensure consistent application of review criteria for authorization decisions.

(ii) Consult with the requesting provider for medical services when appropriate.

(iii) Authorize LTSS based on an enrollee's current needs assessment and consistent with the person-centered service plan.

(3) That any decision to deny a service authorization request or to authorize a service in an amount, duration, or scope that is less than requested, be made by an individual who has appropriate expertise in addressing the enrollee's medical, behavioral health, or long-term services and supports needs.

(c) Notice of adverse benefit determination. Each contract must provide for the MCO, PIHP, or PAHP to notify the requesting provider, and give the enrollee written notice of any decision by the MCO, PIHP, or PAHP to deny a service authorization request, or to authorize a service in an amount, duration, or scope that is less than requested. For MCOs, PIHPs, and PAHPs, the enrollee's notice must meet the requirements of § 438.404. For Medicaid contracts with an applicable integrated plan, as defined in § 422.561 of this chapter, in lieu of the provisions in this paragraph governing notices of adverse benefit determinations, the provisions set forth in §§ 422.629 through 422.634 of this chapter apply to determinations affecting dually eligible individuals who are also enrolled in a dual eligible special needs plan with exclusively aligned enrollment, as defined in § 422.2 of this chapter.

(d) Timeframe for decisions. Each MCO, PIHP, or PAHP contract must provide for the following decisions and notices:

(1) Standard authorization decisions. (i) For standard authorization decisions, provide notice as expeditiously as the enrollee's condition requires and:

(A) For rating periods that start before January 1, 2026, within state established time frames that may not exceed 14 calendar days after receiving the request for service.

(B) For rating periods that start on or after January 1, 2026, within state established time frames that may not exceed 7 calendar days after receiving the request for service.

(ii) Standard authorization decisions may have an extension to the timeframes in paragraph (d)(1)(i) of this section up to 14 additional calendar days if—

(A) The enrollee or the provider requests the extension; or

(B) The MCO, PIHP, or PAHP justifies (to the State agency upon request) a need for additional information and how the extension is in the enrollee's interest.

(2) Expedited authorization decisions. (i) For cases in which a provider indicates, or the MCO, PIHP, or PAHP determines, that following the standard timeframe could seriously jeopardize the enrollee's life or health or ability to attain, maintain, or regain maximum function, the MCO, PIHP, or PAHP must make an expedited authorization decision and provide notice as expeditiously as the enrollee's health condition requires and no later than 72 hours after receipt of the request for service.

(ii) The MCO, PIHP, or PAHP may extend the 72 hour time period by up to 14 calendar days if the enrollee requests an extension, or if the MCO, PIHP, or PAHP justifies (to the State agency upon request) a need for additional information and how the extension is in the enrollee's interest.

(3) Covered outpatient drug decisions. For all covered outpatient drug authorization decisions, provide notice as described in section 1927(d)(5)(A) of the Act.

(4) For Medicaid contracts with an applicable integrated plan, as defined in § 422.561 of this chapter, timelines for decisions and notices must be compliant with the provisions set forth in §§ 422.629 through 422.634 of this chapter in lieu of §§ 438.404 through 438.424.

(e) Compensation for utilization management activities. Each contract between a State and MCO, PIHP, or PAHP must provide that, consistent with §§ 438.3(i), and 422.208 of this chapter, compensation to individuals or entities that conduct utilization management activities is not structured so as to provide incentives for the individual or entity to deny, limit, or discontinue medically necessary services to any enrollee.

(f) Publicly reporting prior authorization metrics. Beginning January 1, 2026, following each calendar year it has a contract with a State Medicaid agency, the MCO, PIHP, or PAHP must report prior authorization data, excluding data on any and all drugs covered by the MCO, PIHP, or PAHP, at the plan level by March 31. The MCO, PIHP, or PAHP must make the following data from the previous calendar year publicly accessible by posting them on its website:

(1) A list of all items and services that require prior authorization.

(2) The percentage of standard prior authorization requests that were approved, aggregated for all items and services.

(3) The percentage of standard prior authorization requests that were denied, aggregated for all items and services.

(4) The percentage of standard prior authorization requests that were approved after appeal, aggregated for all items and services.

(5) The percentage of prior authorization requests for which the timeframe for review was extended, and the request was approved, aggregated for all items and services.

(6) The percentage of expedited prior authorization requests that were approved, aggregated for all items and services.

(7) The percentage of expedited prior authorization requests that were denied, aggregated for all items and services.

(8) The average and median time that elapsed between the submission of a request and a determination by the MCO, PIHP or PAHP, for standard prior authorizations, aggregated for all items and services.

(9) The average and median time that elapsed between the submission of a request and a decision by the MCO, PIHP or PAHP, for expedited prior authorizations, aggregated for all items and services.

(g) Applicability date. (1) Subject to paragraph (f)(2) of this section, this section applies to the rating period for contracts with MCOs, PIHPs, and PAHPs beginning on or after July 1, 2017. Until that applicability date, States are required to continue to comply with § 438.210 contained in the 42 CFR parts 430 to 481, edition revised as of October 1, 2015.

(2) Provisions in this section affecting applicable integrated plans, as defined in § 422.561 of this chapter, are applicable no later than January 1, 2021.

(a) General rules. The State must ensure, through its contracts, that each MCO, PIHP, or PAHP implements written policies and procedures for selection and retention of network providers and that those policies and procedures, at a minimum, meet the requirements of this section.

(b) Credentialing and recredentialing requirements. (1) Each State must establish a uniform credentialing and recredentialing policy that addresses acute, primary, mental health, substance use disorders, and LTSS providers, as appropriate, and requires each MCO, PIHP and PAHP to follow those policies.

(2) Each MCO, PIHP, and PAHP must follow a documented process for credentialing and recredentialing of network providers.

(c) Nondiscrimination. MCO, PIHP, and PAHP network provider selection policies and procedures, consistent with § 438.12, must not discriminate against particular providers that serve high-risk populations or specialize in conditions that require costly treatment.

(d) Excluded providers. (1) MCOs, PIHPs, and PAHPs may not employ or contract with providers excluded from participation in Federal health care programs under either section 1128 or section 1128A of the Act.

(2) States must ensure through its contracts that MCOs, PIHPs, and PAHPs terminate any providers of services or persons terminated (as described in section 1902(kk)(8) of the Social Security Act) from participation under this title, title XVIII, or title XXI from participating as a provider in any network.

(e) State requirements. Each MCO, PIHP, and PAHP must comply with any additional requirements established by the State.

The State must ensure, through its contracts, that (consistent with subpart F of part 431 of this chapter), for medical records and any other health and enrollment information that identifies a particular enrollee, each MCO, PIHP, and PAHP uses and discloses such individually identifiable health information in accordance with the privacy requirements in 45 CFR parts 160 and 164, subparts A and E, to the extent that these requirements are applicable.

(a) The State must ensure, through its contracts, that each MCO, PIHP, and PAHP has in effect a grievance and appeal system that meets the requirements of subpart F of this part.

(b) If the State delegates to the MCO, PIHP, or PAHP responsibility for notice of action under subpart E of part 431 of this chapter, the State must conduct random reviews of each delegated MCO, PIHP, or PAHP and its providers and subcontractors to ensure that they are notifying enrollees in a timely manner.

(a) Applicability. The requirements of this section apply to any contract or written arrangement that an MCO, PIHP, PAHP, or PCCM entity has with any subcontractor.

(b) General rule. The State must ensure, through its contracts with MCOs, PIHPs, PAHPs, and PCCM entities that—

(1) Notwithstanding any relationship(s) that the MCO, PIHP, PAHP, or PCCM entity may have with any subcontractor, the MCO, PIHP, PAHP, or PCCM entity maintains ultimate responsibility for adhering to and otherwise fully complying with all terms and conditions of its contract with the State; and

(2) All contracts or written arrangements between the MCO, PIHP, PAHP, or PCCM entity and any subcontractor must meet the requirements of paragraph (c) of this section.

(c) Each contract or written arrangement described in paragraph (b)(2) of this section must specify that:

(1) If any of the MCO's, PIHP's, PAHP's, or PCCM entity's activities or obligations under its contract with the State are delegated to a subcontractor—

(i) The delegated activities or obligations, and related reporting responsibilities, are specified in the contract or written agreement.

(ii) The subcontractor agrees to perform the delegated activities and reporting responsibilities specified in compliance with the MCO's, PIHP's, PAHP's, or PCCM entity's contract obligations.

(iii) The contract or written arrangement must either provide for revocation of the delegation of activities or obligations, or specify other remedies in instances where the State or the MCO, PIHP, PAHP, or PCCM entity determine that the subcontractor has not performed satisfactorily.

(2) The subcontractor agrees to comply with all applicable Medicaid laws, regulations, including applicable subregulatory guidance and contract provisions;

(3) The subcontractor agrees that—

(i) The State, CMS, the HHS Inspector General, the Comptroller General, or their designees have the right to audit, evaluate, and inspect any books, records, contracts, computer or other electronic systems of the subcontractor, or of the subcontractor's contractor, that pertain to any aspect of services and activities performed, or determination of amounts payable under the MCO's, PIHP's, or PAHP's contract with the State.

(ii) The subcontractor will make available, for purposes of an audit, evaluation, or inspection under paragraph (c)(3)(i) of this section, its premises, physical facilities, equipment, books, records, contracts, computer or other electronic systems relating to its Medicaid enrollees.

(iii) The right to audit under paragraph (c)(3)(i) of this section will exist through 10 years from the final date of the contract period or from the date of completion of any audit, whichever is later.

(iv) If the State, CMS, or the HHS Inspector General determines that there is a reasonable possibility of fraud or similar risk, the State, CMS, or the HHS Inspector General may inspect, evaluate, and audit the subcontractor at any time.

(d) Applicability date. This section applies to the rating period for contracts with MCOs, PIHPs, PAHPs, and PCCM entities beginning on or after July 1, 2017. Until that applicability date, states are required to continue to comply with § 438.230 contained in the 42 CFR parts 430 to 481, edition revised as of October 1, 2015.

(a) Basic rule. The State must ensure, through its contracts, that each MCO, PIHP, and PAHP meets the requirements of this section.

(b) Adoption of practice guidelines. Each MCO and, when applicable, each PIHP and PAHP adopts practice guidelines that meet the following requirements:

(1) Are based on valid and reliable clinical evidence or a consensus of providers in the particular field.

(2) Consider the needs of the MCO's, PIHP's, or PAHP's enrollees.

(3) Are adopted in consultation with network providers.

(4) Are reviewed and updated periodically as appropriate.

(c) Dissemination of guidelines. Each MCO, PIHP, and PAHP disseminates the guidelines to all affected providers and, upon request, to enrollees and potential enrollees.

(d) Application of guidelines. Decisions for utilization management, enrollee education, coverage of services, and other areas to which the guidelines apply are consistent with the guidelines.

(a) General rule. The State must ensure, through its contracts that each MCO, PIHP, and PAHP maintains a health information system that collects, analyzes, integrates, and reports data and can achieve the objectives of this part. The systems must provide information on areas including, but not limited to, utilization, claims, grievances and appeals, and disenrollments for other than loss of Medicaid eligibility.

(b) Basic elements of a health information system. The State must require, at a minimum, that each MCO, PIHP, and PAHP comply with the following:

(1) Section 6504(a) of the Affordable Care Act, which requires that State claims processing and retrieval systems are able to collect data elements necessary to enable the mechanized claims processing and information retrieval systems in operation by the State to meet the requirements of section 1903(r)(1)(F) of the Act.

(2) Collect data on enrollee and provider characteristics as specified by the State, and on all services furnished to enrollees through an encounter data system or other methods as may be specified by the State.

(3) Ensure that data received from providers is accurate and complete by—

(i) Verifying the accuracy and timeliness of reported data, including data from network providers the MCO, PIHP, or PAHP is compensating on the basis of capitation payments.

(ii) Screening the data for completeness, logic, and consistency.

(iii) Collecting data from providers in standardized formats to the extent feasible and appropriate, including secure information exchanges and technologies utilized for State Medicaid quality improvement and care coordination efforts.

(4) Make all collected data available to the State and upon request to CMS.

(5) Subject to paragraph (b)(8) of this section, implement and maintain a Patient Access Application Programming Interface (API) required in § 431.60 of this chapter as if such requirements applied directly to the MCO, PIHP, or PAHP and:

(i) Include all encounter data, including encounter data from any network providers the MCO, PIHP, or PAHP is compensating based on capitation payments and adjudicated claims and encounter data from any subcontractors.

(ii) Exclude covered outpatient drugs as defined in section 1927(k)(2) of the Act.

(iii) Report metrics specified in § 431.60(f) of this chapter at the plan level.

(6) Implement, by January 1, 2021, and maintain a publicly accessible standards-based API described in § 431.70, which must include all information specified in § 438.10(h)(1) and (2) of this chapter.

(7) By the rating period beginning on or after January 1, 2027, comply with §§ 431.61(a), (b)(1) and (4) through (6), and (b)(7)(ii) and (iii) and 431.80(b) of this chapter as if such requirements applied directly to the MCO, PIHP, or PAHP

(8) By the rating period beginning on or after January 1, 2026, comply with § 431.80(a) of this chapter as if such requirements applied directly to the MCO, PIHP, or PAHP according to the decision timeframes in § 438.210(d).

(9) The following timeframes apply to paragraph (b)(5) of this section:

(i) Except for the requirements in § 431.60(b)(5), (g), and (h) of this chapter, comply with the requirements of § 431.60 of this chapter by January 1, 2021.

(ii) Comply with the requirements in § 431.60(b)(5) and (g) of this chapter by the rating period beginning on or after January 1, 2026.

(iii) Beginning in 2026, by March 31 following any year the MCO, PIHP, or PAHP operates, comply with the reporting requirements in § 431.60(h) of this chapter for the previous calendar year's data, in the form of aggregated, de-identified metrics, at the plan level.

(c) Enrollee encounter data. Contracts between a State and a MCO, PIHP, or PAHP must provide for:

(1) Collection and maintenance of sufficient enrollee encounter data to identify the provider who delivers any item(s) or service(s) to enrollees.

(2) Submission of enrollee encounter data to the State at a frequency and level of detail to be specified by CMS and the State, based on program administration, oversight, and program integrity needs.

(3) Submission of all enrollee encounter data, including allowed amount and paid amount, that the State is required to report to CMS under § 438.818.

(4) Specifications for submitting encounter data to the State in standardized ASC X12N 837 and NCPDP formats, and the ASC X12N 835 format as appropriate.

(d) State review and validation of encounter data. The State must review and validate that the encounter data collected, maintained, and submitted to the State by the MCO, PIHP, or PAHP, meets the requirements of this section. The State must have procedures and quality assurance protocols to ensure that enrollee encounter data submitted under paragraph (c) of this section is a complete and accurate representation of the services provided to the enrollees under the contract between the State and the MCO, PIHP, or PAHP.

(e) Applicability date. This section applies to the rating period for contracts with MCOs, PIHPs, PAHPs, and PCCM entities beginning on or after July 1, 2017. Until that applicability date, states are required to continue to comply with § 438.242 contained in the 42 CFR parts 430 to 481, edition revised as of October 1, 2015.