(a) General. An MA organization that uses utilization management (UM) policies and procedures, including prior authorization (PA), must establish a UM committee that is led by a plan's medical director (described in § 422.562(a)(4)).

(b) Limit on use of UM policies and procedures. An MA plan may not use any UM policies and procedures for basic or supplemental benefits on or after January 1, 2024 unless those policies and procedures have been reviewed and approved by the UM committee.

(c) Utilization Management Committee Composition. The UM committee must—

(1) Include a majority of members who are practicing physicians.

(2) Include at least one practicing physician who is independent and free of conflict relative to the MA organization and MA plan.

(3) Include at least one practicing physician who is an expert regarding care of elderly or disabled individuals.

(4) Include members representing various clinical specialties (for example, primary care, behavioral health) to ensure that a wide range conditions are adequately considered in the development of the MA plan's utilization management policies.

(5) Beginning January 1, 2025, include at least one member with expertise in health equity. Expertise in health equity includes educational degrees or credentials with an emphasis on health equity; experience conducting studies identifying disparities amongst different population groups; experience leading organization-wide policies, programs, or services to achieve health equity; or experience leading advocacy efforts to achieve health equity.

(d) Utilization Management Committee Responsibilities. The UM committee must—

(1) At least annually, review the policies and procedures for all utilization management, including prior authorization, used by the MA plan. Such review must consider:

(i) The services to which the utilization management applies;

(ii) Coverage decisions and guidelines for Traditional Medicare, including NCDs, LCDs, and laws; and

(iii) Relevant current clinical guidelines.

(2) Approve only utilization management policies and procedures that:

(i) Use or impose coverage criteria that comply with the requirements and standards at § 422.101(b);

(ii) For prior authorization policies, comply with requirements and standards at § 422.138;

(iii) Comply with the standards in § 422.202(b)(1); and

(iv) Apply and rely on medical necessity criteria that comply with § 422.101(c)(1).

(3) Revise the utilization management policies and procedures as necessary to comply with the standards in this regulation, including removing requirements for UM for services and items that no longer warrant UM.

(4) Clearly articulate and document processes to determine that the requirements under paragraphs (c)(1) through (4) of this section have been met, including the determination by an objective party of whether disclosed financial interests are conflicts of interest and the management of any recusals due to such conflicts.

(5) Document in writing the reason for its decisions regarding the development of UM policies and make this documentation available to CMS upon request.

(6) Beginning in 2025, annually conduct a health equity analysis of the use of prior authorization.

(i) The final report of the analysis must be approved by the member of the committee with expertise in health equity before it is publicly posted.

(ii) The analysis must examine the impact of prior authorization on enrollees with one or more of the following social risk factors:

(A) Receipt of the low-income subsidy or being dually eligible for Medicare and Medicaid.

(B) Disability status is determined using the variable original reason for entitlement code (OREC) for Medicare using the information from the Social Security Administration and Railroad Retirement Board record systems.

(iii) The analysis must use the following metrics, calculated for enrollees with the specified social risk factors and enrollees without the specified social risk factors, to conduct the analysis at the plan level using data from the prior contract year regarding coverage of items and services excluding data on drugs as defined in § 422.119(b)(1)(v):

(A) The percentage of standard prior authorization requests that were approved, aggregated for all items and services.

(B) The percentage of standard prior authorization requests that were denied, aggregated for all items and services.

(C) The percentage of standard prior authorization requests that were approved after appeal, aggregated for all items and services.

(D) The percentage of prior authorization requests for which the timeframe for review was extended, and the request was approved, aggregated for all items and services.

(E) The percentage of expedited prior authorization requests that were approved, aggregated for all items and services.

(F) The percentage of expedited prior authorization requests that were denied, aggregated for all items and services.

(G) The average and median time that elapsed between the submission of a request and a determination by the MA plan, for standard prior authorizations, aggregated for all items and services.

(H) The average and median time that elapsed between the submission of a request and a decision by the MA plan for expedited prior authorizations, aggregated for all items and services.

(7) By July 1, 2025, and annually thereafter, publicly post the results of the health equity analysis of the utilization management policies and procedures on the plan's website meeting the following requirements:

(i) In a prominent manner and clearly identified in the footer of the website.

(ii) Easily accessible to the general public, without barriers, including but not limited to ensuring the information is accessible:

(A) Free of charge.

(B) Without having to establish a user account or password.

(C) Without having to submit personal identifying information.

(iii) In a machine-readable format with the data contained within that file being digitally searchable and downloadable.

(iv) Include a txt file in the root directory of the website domain that includes a direct link to the machine-readable file to establish and maintain automated access.