(a) State eligibility to establish a risk adjustment program. (1) A State that elects to operate an Exchange is eligible to establish a risk adjustment program.

(2) Any State that does not elect to operate an Exchange, or that HHS has not approved to operate an Exchange, will forgo implementation of all State functions in this subpart, and HHS will carry out all of the provisions of this subpart on behalf of the State.

(3) Any State that elects to operate an Exchange but does not elect to administer risk adjustment will forgo implementation of all State functions in this subpart, and HHS will carry out all of the provisions of this subpart on behalf of the State.

(4) Beginning in 2015, any State that is approved to operate an Exchange and elects to operate risk adjustment but has not been approved by HHS to operate risk adjustment prior to publication of its State notice of benefit and payment parameters for the applicable benefit year, will forgo implementation of all State functions in this subpart, and HHS will carry out all of the provisions of this subpart on behalf of the State.

(b) Entities eligible to carry out risk adjustment activities. If a State is operating a risk adjustment program, the State may elect to have an entity other than the Exchange perform the State functions of this subpart, provided that the entity meets the standards promulgated by HHS to be an entity eligible to carry out Exchange functions.

(c) State responsibility for risk adjustment. (1) A State operating a risk adjustment program for a benefit year must administer the applicable Federally certified risk adjustment methodology through an entity that—

(i) Is operationally ready to implement the applicable Federally certified risk adjustment methodology and process the resulting payments and charges; and

(ii) Has experience relevant to operating the risk adjustment program.

(2) The State must ensure that the risk adjustment entity complies with all applicable provisions of subpart D of this part in the administration of the applicable Federally certified risk adjustment methodology.

(3) The State must conduct oversight and monitoring of its risk adjustment program.

(4) Maintenance of records. A State operating a risk adjustment program must maintain documents and records relating to the risk adjustment program, whether paper, electronic, or in other media, for each benefit year for at least 10 years, and make them available upon request from HHS, the OIG, the Comptroller General, or their designees, to any such entity. The documents and records must be sufficient to enable the evaluation of the State-operated risk adjustment program's compliance with Federal standards. A State operating a risk adjustment program must also ensure that its contractors, subcontractors, and agents similarly maintain and make relevant documents and records available upon request from HHS, the OIG, the Comptroller General, or their designees, to any such entity.

(d) Approval for a State to operate risk adjustment. (1) To be approved by HHS to operate risk adjustment under a particular Federally certified risk adjustment methodology for a benefit year, a State must establish that it and its risk adjustment entity meet the standards set forth in paragraph (c) of this section.

(2) To obtain such approval, the State must submit to HHS, in a form and manner specified by HHS, evidence that its risk adjustment entity meets these standards.

(3) In addition to requirements set forth in paragraphs (d)(1) and (2) of this section, to obtain re-approval from HHS to operate risk adjustment for a third benefit year, the State must, in the first benefit year for which it operates risk adjustment, provide to HHS an interim report, in a manner specified by HHS, including a detailed summary of its risk adjustment activities in the first 10 months of the benefit year, no later than December 31 of the applicable benefit year.

(4) To obtain re-approval from HHS to operate risk adjustment for each benefit year after the third benefit year, each State operating a risk adjustment program must submit to HHS and make public a detailed summary of its risk adjustment program operations for the most recent benefit year for which risk adjustment operations have been completed, in the manner and timeframe specified by HHS.

(i) The summary must include the results of a programmatic and financial audit for each benefit year of the State-operated risk adjustment program conducted by an independent qualified auditing entity in accordance with generally accepted auditing standards (GAAS).

(ii) The summary must identify any material weakness or significant deficiency identified in the audit and address how the State intends to correct any such material weakness or significant deficiency.

(e) Timeframes. A State, or HHS on behalf of the State, must implement risk adjustment for the 2014 benefit year and every benefit year thereafter. For each benefit year, a State, or HHS on behalf of the State, must notify issuers of risk adjustment payments due or charges owed annually by June 30 of the year following the benefit year.

(a) General requirement. Any risk adjustment methodology used by a State, or HHS on behalf of the State, must be a Federally certified risk adjustment methodology. A risk adjustment methodology may become Federally certified by one of the following processes:

(1) The risk adjustment methodology is developed by HHS and published in advance of the benefit year in rulemaking; or

(2) An alternate risk adjustment methodology is submitted by a State in accordance with § 153.330, reviewed and certified by HHS, and published in the applicable annual HHS notice of benefit and payment parameters.

(b) Publication of methodology in notices. The publication of a risk adjustment methodology by HHS in an annual HHS notice of benefit and payment parameters or by a State in an annual State notice of benefit and payment parameters described in subpart B of this part must include:

(1) A complete description of the risk adjustment model, including—

(i) Draft factors to be employed in the model, including but not limited to, demographic factors, diagnostic factors, and utilization factors, if any, the dataset(s) to be used to calculate final coefficients, and the date by which final coefficients will be released in guidance;

(ii) The qualifying criteria for establishing that an individual is eligible for a specific factor;

(iii) Weights assigned to each factor; and

(iv) The schedule for the calculation of individual risk scores.

(2) A complete description of the calculation of plan average actuarial risk.

(3) A complete description of the calculation of payments and charges.

(4) A complete description of the risk adjustment data collection approach.

(5) The schedule for the risk adjustment program.

(c) Use of methodology for States that do not operate a risk adjustment program. HHS will specify in notice-and-comment rulemaking by HHS in advance of the applicable benefit year, the Federally certified risk adjustment methodology that will apply in States that do not operate a risk adjustment program.

(d) State flexibility to request reductions to transfers. For the 2020 through 2023 benefit years, States can request to reduce risk adjustment transfers in the State's individual catastrophic, individual non-catastrophic, small group, or merged market risk pool by up to 50 percent in States where HHS operates the risk adjustment program. For the 2024 benefit year only, only prior participants, as defined in paragraph (d)(5) of this section, may request to reduce risk adjustment transfers in the State's individual catastrophic, individual non-catastrophic, small group, or merged market risk pool by up to 50 percent in States where HHS operates the risk adjustment program.

(1) State requests. State requests for a reduction to transfers must include:

(i) Supporting evidence and analysis demonstrating the State-specific factors that warrant an adjustment to more precisely account for the differences in actuarial risk in the State market risk pool;

(ii) The adjustment percentage of up to 50 percent requested for the State individual catastrophic, individual non-catastrophic, small group, or merged market risk pool; and

(iii) For the 2020 through 2023 benefit years, a justification for the reduction requested demonstrating the State-specific factors that warrant an adjustment to more precisely account for relative risk differences in the State individual catastrophic, individual non-catastrophic, small group, or merged market risk pool, or demonstrating the requested reduction would have de minimis impact on the necessary premium increase to cover the transfers for issuers that would receive reduced transfer payments; or

(iv) For the 2024 benefit year only, a justification for the requested reduction demonstrating the requested reduction would have de minimis impact on the necessary premium increase to cover the transfers for issuers that would receive reduced transfer payments.

(2) Timeframe to submit reduction requests. States must submit requests for a reduction to transfers in the individual catastrophic, individual non-catastrophic, small group, or merged market risk pool by August 1 of the benefit year that is 2 calendar years prior to the applicable benefit year, in the form and manner specified by HHS.

(3) Publication of reduction requests. HHS will publish State reduction requests in the applicable benefit year's HHS notice of benefit and payment parameters rule and make the supporting evidence available to the public for comment, except to the extent the State requests HHS not publish certain supporting evidence because it contains trade secrets or confidential commercial or financial information as defined in HHS' Freedom of Information regulations under 45 CFR 5.31(d). HHS will publish any approved or denied State reduction requests in the applicable benefit year's HHS notice of benefit and payment parameters final rule.

(4) HHS approval. (i) Subject to paragraph (d)(4)(ii) of this section, HHS will approve State reduction requests if HHS determines, based on the review of the information submitted as part of the State's request, along with other relevant factors, including the premium impact of the transfer reduction for the State market risk pool, and relevant public comments:

(A) For the 2020 through 2023 benefit years, that State-specific rules or other relevant factors warrant an adjustment to more precisely account for relative risk differences in the State's individual catastrophic, individual non-catastrophic, small group, or merged market risk pool and support the percentage reduction to risk adjustment transfers requested; or State-specific rules or other relevant factors warrant an adjustment to more precisely account for relative risk differences in the State's individual catastrophic, individual non-catastrophic, small group, or merged market risk pool and the requested reduction would have de minimis impact on the necessary premium increase to cover the transfers for issuers that would receive reduced transfer payments.

(B) For the 2024 benefit year only, that the requested reduction would have de minimis impact on the necessary premium increase to cover the transfers for issuers that would receive reduced transfer payments.

(ii) HHS may approve a reduction amount that is lower than the amount requested by the State if the supporting evidence and analysis do not fully support the requested reduction amount. HHS will assess other relevant factors, including the premium impact of the transfer reduction for the applicable State market risk pool.

(5) Exception for prior participants. As used in paragraph (d) of this section, prior participants mean States that submitted a State reduction request in the State's individual catastrophic, individual non-catastrophic, small group, or merged market risk pool in the 2020, 2021, 2022, or 2023 benefit year.

(a) State request for alternate methodology certification. (1) A State request to HHS for the certification of an alternate risk adjustment methodology must include:

(i) The elements specified in § 153.320(b);

(ii) The calibration methodology and frequency of calibration; and

(iii) The statistical performance metrics specified by HHS.

(2) The request must include the extent to which the methodology:

(i) Accurately explains the variation in health care costs of a given population;

(ii) Links risk factors to daily clinical practice and is clinically meaningful to providers;

(iii) Encourages favorable behavior among providers and health plans and discourages unfavorable behavior;

(iv) Uses data that is complete, high in quality, and available in a timely fashion;

(v) Is easy for stakeholders to understand and implement;

(vi) Provides stable risk scores over time and across plans; and

(vii) Minimizes administrative costs.

(b) Evaluation criteria for alternate risk adjustment methodology. An alternate risk adjustment methodology will be certified by HHS as a Federally certified risk adjustment methodology based on the following criteria:

(1) The criteria listed in paragraph (a)(2) of this section;

(2) Whether the methodology complies with the requirements of this subpart D;

(3) Whether the methodology accounts for risk selection across metal levels; and

(4) Whether each of the elements of the methodology are aligned.

(c) State renewal of alternate methodology. If a State is operating a risk adjustment program, the State may not implement a recalibrated risk adjustment model or otherwise alter its risk adjustment methodology without first obtaining HHS certification.

(1) Recalibration of the risk adjustment model must be performed at least as frequently as described in paragraph (a)(1)(ii) of this section;

(2) A State request to implement a recalibrated risk adjustment model or otherwise alter its risk adjustment methodology must include any changes to the parameters described in paragraph (a)(1) of this section.

(a) Data collection requirements. If a State is operating a risk adjustment program, the State must collect risk adjustment data.

(b) Minimum standards. (1) If a State is operating a risk adjustment program, the State may vary the amount and type of data collected, but the State must collect or calculate individual risk scores generated by the risk adjustment model in the applicable Federally certified risk adjustment methodology;

(2) If a State is operating a risk adjustment program, the State must require that issuers offering risk adjustment covered plans in the State comply with data privacy and security standards set forth in the applicable risk adjustment data collection approach; and

(3) If a State is operating a risk adjustment program, the State must ensure that any collection of personally identifiable information is limited to information reasonably necessary for use in the applicable risk adjustment model, calculation of plan average actuarial risk, or calculation of payments and charges. Except for purposes of data validation, the State may not collect or store any personally identifiable information for use as a unique identifier for an enrollee's data, unless such information is masked or encrypted by the issuer, with the key to that masking or encryption withheld from the State. Use and disclosure of personally identifiable information is limited to those purposes for which the personally identifiable information was collected (including for purposes of data validation).

(4) If a State is operating a risk adjustment program, the State must implement security standards that provide administrative, physical, and technical safeguards for the individually identifiable information consistent with the security standards described at 45 CFR 164.308, 164.310, and 164.312.

(a) General requirement. The State, or HHS on behalf of the State, must ensure proper implementation of any risk adjustment software and ensure proper validation of a statistically valid sample of risk adjustment data from each issuer that offers at least one risk adjustment covered plan in that State.

(b) Adjustment to plan average actuarial risk. The State, or HHS on behalf of the State, may adjust the plan average actuarial risk for a risk adjustment covered plan based on errors discovered with respect to implementation of risk adjustment software or as a result of data validation conducted pursuant to paragraph (a) of this section.

(c) Adjustment to charges and payments. The State, or HHS on behalf of the State, may adjust charges and payments to all risk adjustment covered plan issuers based on the adjustments calculated in paragraph (b) of this section.

(d) Appeals. The State, or HHS on behalf of the State, must provide an administrative process to appeal findings with respect to the implementation of risk adjustment software or data validation.

Enrollees in a risk adjustment covered plan must be assigned to the applicable risk pool in the State in which the employer's policy was filed and approved.

If a State is operating a risk adjustment program, it must keep an accounting of all receipts and expenditures related to risk adjustment payments and charges and the administration of risk adjustment-related functions and activities for each benefit year.