(a) Each issuer subject to the reporting requirement of this part must allow access and entry to its premises, facilities and records, including computer and other electronic systems, to HHS, the Comptroller General, or their designees to evaluate, through inspection, audit, or other means, compliance with the requirements for reporting and calculation of data submitted to HHS, and the timeliness and accuracy of rebate payments made under this part.

(b) Each issuer must also allow access and entry to the facilities and records, including computer and other electronic systems, of its parent organization, subsidiaries, related entities, contractors, subcontractors, agents, or a transferee that pertain to any aspect of the data reported to HHS or to rebate payments calculated and made under this part. To the extent that the issuer does not control access to the facilities and records of its parent organization, related entities, or third parties, it will be the responsibility of the issuer to contractually obligate any such parent organization, related entities, or third parties to grant said access.

(c) The Comptroller General, HHS, or their designees may inspect, evaluate, and audit through 6 years from the date of the filing of a report required by this part or through 3 years after the completion of the audit and for such longer period set forth below provided that any of the following occur:

(1) HHS determines there is a special need to retain a particular record or group of records for a longer period and notifies the issuer at least 30 days before the disposition date.

(2) There has been a dispute, or allegation of fraud or similar fault by the issuer, in which case the retention may be extended to 6 years from the date of any resulting final resolution of the dispute, fraud, or similar fault.

(3) HHS determines that there is a reasonable possibility of fraud or similar fault, in which case HHS may inspect, evaluate, and audit the issuer at any time.

(a) Basic rule. Each issuer subject to the requirements of this part must maintain all documents and other evidence necessary to enable HHS to verify that the data required to be submitted in accordance with this part comply with the definitions and criteria set forth in this part, and that the MLR is calculated and any rebates owing are calculated and provided in accordance with this part. This includes but is not limited to all administrative and financial books and records used in compiling data reported and rebates provided under this part and in determining what data to report and rebates to provide under this part, electronically stored information, and evidence of accounting procedures and practices. This also includes all administrative and financial books and records used by others in assisting an issuer with its obligations under this part.

(b) Length of time information must be maintained. All of the documents and other evidence required by this part must be maintained for the current year and six prior years, unless a longer time is required under § 158.501 of this subpart.