(a) Statutory basis. This subpart is based on the following statutory sections:

(1) Section 1128 of the Act provides for the exclusion of certain individuals and entities from participation in the Medicaid program.

(2) Section 1128J(d) of the Act requires that persons who have received an overpayment under Medicaid report and return the overpayment within 60 days after the date on which the overpayment was identified.

(3) Section 1902(a)(4) of the Act requires that the State plan provide for methods of administration that the Secretary finds necessary for the proper and efficient operation of the plan.

(4) Section 1902(a)(19) of the Act requires that the State plan provide the safeguards necessary to ensure that eligibility is determined and services are provided in a manner consistent with simplicity of administration and the best interests of the beneficiaries.

(5) Section 1902(a)(27) of the Act requires States to enroll persons or institutions that provide services under the State plan.

(6) Section 1902(a)(68) of the Act requires that any entity that receives or makes annual payments under the State plan of at least $5,000,000 must establish certain minimum written policies relating to the Federal False Claims Act.

(7) Section 1902(a)(77) of the Act requires that States comply with provider and supplier screening, oversight, and reporting requirements described in section 1902(kk)(1) of the Act.

(8) Section 1902(a)(80) of the Act prohibits payments for items or services provided under the State plan or under a waiver to any financial institution or entity located outside of the United States.

(9) Section 1902(kk)(7) of the Act requires States to enroll physicians or other professionals that order or refer services under the State plan.

(10) Section 1903(i) of the Act prohibits FFP for amounts expended by MCOs or PCCMs for providers excluded by Medicare, Medicaid, or CHIP, except for emergency services.

(11) Section 1903(m) of the Act establishes conditions for payments to the State for contracts with MCOs.

(12) Section 1932(d)(1) of the Act prohibits MCOs and PCCMs from knowingly having certain types of relationships with individuals and entities debarred under Federal regulations from participating in specified activities, or with affiliates of those individuals.

(b) Basic rule. As a condition for receiving payment under a Medicaid managed care program, an MCO, PIHP, PAHP, PCCM or PCCM entity must comply with the requirements in §§ 438.604, 438.606, 438.608 and 438.610, as applicable.

(c) Applicability. States will not be held out compliance with the following requirements of this subpart prior to the dates noted below so long as they comply with the corresponding standard(s) in 42 CFR part 438 contained in the CFR, parts 430 to 481, edition revised as of October 1, 2015:

(1) States must comply with §§ 438.602(a), 438.602(c) through (h), 438.604, 438.606, 438.608(a), and 438.608(c) and (d), no later than the rating period for contracts starting on or after July 1, 2017.

(2) States must comply with § 438.602(b) and § 438.608(b) no later than the rating period for contracts beginning on or after July 1, 2018.

(a) Monitoring contractor compliance. Consistent with § 438.66, the State must monitor the MCO's, PIHP's, PAHP's, PCCM's or PCCM entity's compliance, as applicable, with §§ 438.604, 438.606, 438.608, 438.610, 438.230, and 438.808.

(b) Screening and enrollment and revalidation of providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries.

(2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees.

(c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in § 438.608(c).

(d) Federal database checks. Consistent with the requirements at § 455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with § 438.610(c).

(e) Periodic audits. The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.

(f) Whistleblowers. The State must receive and investigate information from whistleblowers relating to the integrity of the MCO, PIHP, PAHP, PCCM, or PCCM entity, subcontractors, or network providers receiving Federal funds under this part.

(g) Transparency. The State must post on its Web site, as required in § 438.10(c)(3), the following documents and reports:

(1) The MCO, PIHP, PAHP, or PCCM entity contract.

(2) The data at § 438.604(a)(5).

(3) The name and title of individuals included in § 438.604(a)(6).

(4) The results of any audits under paragraph (e) of this section.

(5) Enrollee handbooks, provider directories, and formularies required at § 438.10(g) through (i).

(6) The information on rate ranges required at § 438.4(c)(2)(iv), if applicable.

(7) The reports required at §§ 438.66(e) and 438.207(d).

(8) The network adequacy standards required at § 438.68(b)(1) through (2) and (e).

(9) The results of secret shopper surveys required at § 438.68(f).

(10) State directed payment evaluation reports required in § 438.6(c)(2)(v)(C).

(11) Information on all required Application Programming Interfaces including as specified in § 431.60(d) and (f).

(12) Quality related information as required in §§ 438.332(c)(1), 438.340(d), 438.362(c) and 438.364(c)(2)(i).

(13) Documentation of compliance with requirements in subpart K—Parity in Mental Health and Substance Use Disorder Benefits.

(h) Contracting integrity. The State must have in place conflict of interest safeguards described in § 438.58 and must comply with the requirement described in section 1902(a)(4)(C) of the Act applicable to contracting officers, employees, or independent contractors.

(i) Entities located outside of the U.S. The State must ensure that the MCO, PIHP, PAHP, PCCM, or PCCM entity with which the State contracts under this part is not located outside of the United States and that no claims paid by an MCO, PIHP, or PAHP to a network provider, out-of-network provider, subcontractor or financial institution located outside of the U.S. are considered in the development of actuarially sound capitation rates.

(j) Applicability. Paragraphs (g)(5) through (13) of this section apply to the first rating period for contracts with MCOs, PIHPs and PAHPs beginning on or after 2 years after July 9, 2024.

(a) Specified data, information, and documentation. The State must require any MCO, PIHP, PAHP, PCCM or PCCM entity to submit to the State the following data:

(1) Encounter data in the form and manner described in § 438.818.

(2) Data on the basis of which the State certifies the actuarial soundness of capitation rates to an MCO, PIHP or PAHP under § 438.4, including base data described in § 438.5(c) that is generated by the MCO, PIHP or PAHP.

(3) Data on the basis of which the State determines the compliance of the MCO, PIHP, or PAHP with the medical loss ratio requirement described in § 438.8.

(4) Data on the basis of which the State determines that the MCO, PIHP or PAHP has made adequate provision against the risk of insolvency as required under § 438.116.

(5) Documentation described in § 438.207(b) on which the State bases its certification that the MCO, PIHP or PAHP has complied with the State's requirements for availability and accessibility of services, including the adequacy of the provider network, as set forth in § 438.206.

(6) Information on ownership and control described in § 455.104 of this chapter from MCOs, PIHPs, PAHPs, PCCMs, PCCM entities, and subcontractors as governed by § 438.230.

(7) The annual report of overpayment recoveries as required in § 438.608(d)(3).

(b) Additional data, documentation, or information. In addition to the data, documentation, or information specified in paragraph (a) of this section, an MCO, PIHP, PAHP, PCCM or PCCM entity must submit any other data, documentation, or information relating to the performance of the entity's obligations under this part required by the State or the Secretary.

(a) Source of certification. For the data, documentation, or information specified in § 438.604, the State must require that the data, documentation or information the MCO, PIHP, PAHP, PCCM or PCCM entity submits to the State be certified by either the MCO's, PIHP's, PAHP's, PCCM's, or PCCM entity's Chief Executive Officer; Chief Financial Officer; or an individual who reports directly to the Chief Executive Officer or Chief Financial Officer with delegated authority to sign for the Chief Executive Officer or Chief Financial Officer so that the Chief Executive Officer or Chief Financial Officer is ultimately responsible for the certification.

(b) Content of certification. The certification provided by the individual in paragraph (a) of this section must attest that, based on best information, knowledge, and belief, the data, documentation, and information specified in § 438.604 is accurate, complete, and truthful.

(c) Timing of certification. The State must require the MCO, PIHP, PAHP, PCCM, or PCCM entity to submit the certification concurrently with the submission of the data, documentation, or information required in § 438.604(a) and (b).

(a) Administrative and management arrangements or procedures to detect and prevent fraud, waste and abuse. The State, through its contract with the MCO, PIHP or PAHP, must require that the MCO, PIHP, or PAHP, or subcontractor to the extent that the subcontractor is delegated responsibility by the MCO, PIHP, or PAHP for coverage of services and payment of claims under the contract between the State and the MCO, PIHP, or PAHP, implement and maintain arrangements or procedures that are designed to detect and prevent fraud, waste, and abuse. The arrangements or procedures must include the following:

(1) A compliance program that includes, at a minimum, all of the following elements:

(i) Written policies, procedures, and standards of conduct that articulate the organization's commitment to comply with all applicable requirements and standards under the contract, and all applicable Federal and State requirements.

(ii) The designation of a Compliance Officer who is responsible for developing and implementing policies, procedures, and practices designed to ensure compliance with the requirements of the contract and who reports directly to the Chief Executive Officer and the board of directors.

(iii) The establishment of a Regulatory Compliance Committee on the Board of Directors and at the senior management level charged with overseeing the organization's compliance program and its compliance with the requirements under the contract.

(iv) A system for training and education for the Compliance Officer, the organization's senior management, and the organization's employees for the Federal and State standards and requirements under the contract.

(v) Effective lines of communication between the compliance officer and the organization's employees.

(vi) Enforcement of standards through well-publicized disciplinary guidelines.

(vii) Establishment and implementation of procedures and a system with dedicated staff for routine internal monitoring and auditing of compliance risks, prompt response to compliance issues as they are raised, investigation of potential compliance problems as identified in the course of self-evaluation and audits, correction of such problems promptly and thoroughly (or coordination of suspected criminal acts with law enforcement agencies) to reduce the potential for recurrence, and ongoing compliance with the requirements under the contract.

(2) Provision for reporting within 30 calendar days all overpayments identified or recovered, specifying the overpayments due to potential fraud, to the State.

(3) Provision for prompt notification to the State when it receives information about changes in an enrollee's circumstances that may affect the enrollee's eligibility including all of the following:

(i) Changes in the enrollee's residence;

(ii) The death of an enrollee.

(4) Provision for notification to the State when it receives information about a change in a network provider's circumstances that may affect the network provider's eligibility to participate in the managed care program, including the termination of the provider agreement with the MCO, PIHP or PAHP.

(5) Provision for a method to verify, by sampling or other methods, whether services that have been represented to have been delivered by network providers were received by enrollees and the application of such verification processes on a regular basis.

(6) In the case of MCOs, PIHPs, or PAHPs that make or receive annual payments under the contract of at least $5,000,000, provision for written policies for all employees of the entity, and of any contractor or agent, that provide detailed information about the False Claims Act and other Federal and State laws described in section 1902(a)(68) of the Act, including information about rights of employees to be protected as whistleblowers.

(7) Provision for the prompt referral of any potential fraud, waste, or abuse that the MCO, PIHP, or PAHP identifies to the State Medicaid program integrity unit or any potential fraud directly to the State Medicaid Fraud Control Unit.

(8) Provision for the MCO's, PIHP's, or PAHP's suspension of payments to a network provider for which the State determines there is a credible allegation of fraud in accordance with § 455.23 of this chapter.

(b) Provider screening and enrollment requirements. The State, through its contracts with a MCO, PIHP, PAHP, PCCM, or PCCM entity must ensure that all network providers are enrolled with the State as Medicaid providers consistent with the provider disclosure, screening and enrollment requirements of part 455, subparts B and E of this chapter. This provision does not require the network provider to render services to FFS beneficiaries.

(c) Disclosures. The State must ensure, through its contracts, that each MCO, PIHP, PAHP, PCCM, PCCM entity, and any subcontractors:

(1) Provides written disclosure of any prohibited affiliation under § 438.610.

(2) Provides written disclosures of information on ownership and control required under § 455.104 of this chapter.

(3) Reports to the State within 60 calendar days when it has identified the capitation payments or other payments in excess of amounts specified in the contract.

(d) Treatment of recoveries made by the MCO, PIHP or PAHP of overpayments to providers. (1) Contracts with a MCO, PIHP, or PAHP must specify:

(i) The retention policies for the treatment of recoveries of all overpayments from the MCO, PIHP, or PAHP to a provider, including specifically the retention policies for the treatment of recoveries of overpayments due to fraud, waste, or abuse.

(ii) The process, timeframes, and documentation required for reporting the recovery of all overpayments.

(iii) The process, timeframes, and documentation required for payment of recoveries of overpayments to the State in situations where the MCO, PIHP, or PAHP is not permitted to retain some or all of the recoveries of overpayments.

(iv) This provision does not apply to any amount of a recovery to be retained under False Claims Act cases or through other investigations.

(2) Each MCO, PIHP, or PAHP requires and has a mechanism for a network provider to report to the MCO, PIHP or PAHP when it has received an overpayment, to return the overpayment to the MCO, PIHP or PAHP within 60 calendar days after the date on which the overpayment was identified, and to notify the MCO, PIHP or PAHP in writing of the reason for the overpayment.

(3) Each MCO, PIHP, or PAHP must report annually to the State on all overpayments identified or recovered.

(4) The State must use the results of the information and documentation collected in paragraph (d)(1) of this section and the report in paragraph (d)(3) of this section for setting actuarially sound capitation rates for each MCO, PIHP, or PAHP consistent with the requirements in § 438.4.

(e) Standards for provider incentive or bonus arrangements. The State, through its contract with the MCO, PIHP or PAHP, must require that incentive payment contracts between managed care plans and network providers meet the requirements as specified in §§ 438.3(i)(3) and (4).

(f) Applicability date. Paragraphs (a)(2), (d)(3) and (e) of this section apply to the first rating period for contracts with MCOs, PIHPs, or PAHPs beginning on or after 1 year from July 9, 2024.

(a) An MCO, PIHP, PAHP, PCCM, or PCCM entity may not knowingly have a relationship of the type described in paragraph (c) of this section with the following:

(1) An individual or entity that is debarred, suspended, or otherwise excluded from participating in procurement activities under the Federal Acquisition Regulation or from participating in nonprocurement activities under regulations issued under Executive Order No. 12549 or under guidelines implementing Executive Order No. 12549.

(2) An individual or entity who is an affiliate, as defined in the Federal Acquisition Regulation at 48 CFR 2.101, of a person described in paragraph (a)(1) of this section.

(b) An MCO, PIHP, PAHP, PCCM, or PCCM entity may not have a relationship with an individual or entity that is excluded from participation in any Federal health care program under section 1128 or 1128A of the Act.

(c) The relationships described in paragraph (a) of this section, are as follows:

(1) A director, officer, or partner of the MCO, PIHP, PAHP, PCCM. or PCCM entity.

(2) A subcontractor of the MCO, PIHP, PAHP, PCCM, or PCCM entity, as governed by § 438.230.

(3) A person with beneficial ownership of 5 percent or more of the MCO's, PIHP's, PAHP's, PCCM's, or PCCM entity's equity.

(4) A network provider or person with an employment, consulting or other arrangement with the MCO, PIHP, PAHP, PCCM, or PCCM entity for the provision of items and services that are significant and material to the MCO's, PIHP's, PAHP's, PCCM's, or PCCM entity's obligations under its contract with the State.

(d) If a State finds that an MCO, PIHP, PAHP, PCCM, or PCCM entity is not in compliance with paragraphs (a) and (b) of this section, the State:

(1) Must notify the Secretary of the noncompliance.

(2) May continue an existing agreement with the MCO, PIHP, PAHP, PCCM, or PCCM entity unless the Secretary directs otherwise.

(3) May not renew or otherwise extend the duration of an existing agreement with the MCO, PIHP, PAHP, PCCM, or PCCM entity unless the Secretary provides to the State and to Congress a written statement describing compelling reasons that exist for renewing or extending the agreement despite the prohibited affiliations.

(4) Nothing in this section must be construed to limit or otherwise affect any remedies available to the U.S. under sections 1128, 1128A or 1128B of the Act.

(e) Consultation with the Inspector General. Any action by the Secretary described in paragraphs (d)(2) or (3) of this section is taken in consultation with the Inspector General.