As required under § 422.111(h)(2), MA organizations must have a website.

(a) General website requirements. (1) MA organization websites must meet all of the following requirements:

(i) Maintain current year contract content through December 31 of each year.

(ii) Notify users when they will leave the MA organization's Medicare site.

(iii) Include or provide access to (for example, through a hyperlink) applicable notices, statements, disclosures, or disclaimers with corresponding content. Overarching disclaimers, such as the Federal Contracting Statement, are not required on every page.

(iv) Reflect the most current information within 30 days of any material change.

(v) Keep MA content separate and distinct from other lines of business, including Medicare Supplemental Plans.

(2) MA organization websites may not do any of the following:

(i) Require beneficiaries to enter any information other than zip code, county, or state for access to non-beneficiary-specific website content.

(ii) Provide links to foreign drug sales, including advertising links.

(iii) State that the MA organization is not responsible for the content of their social media pages or the website of any first tier, downstream, or related entity that provides information on behalf of the MA organization.

(b) Required content. MA organization's websites must include the following content:

(1) A toll-free customer service number, TTY number, and days and hours of operation.

(2) A physical or Post Office Box address.

(3) A PDF or copy of a printable provider directory.

(4) A provider directory searchable by every element required in the model provider directory, such as name, location, specialty.

(5) When applicable, a searchable pharmacy directory combined with a provider directory.

(6) Information on enrollees' and MA organizations' rights and responsibilities upon disenrollment. MA organizations may either post this information or provide specific information on where it is located in the Evidence of Coverage together with a link to that document.

(7) A description of and information on how to file a grievance, request an organization determination, and an appeal.

(8) Prominently displayed link to the Medicare.gov electronic complaint form.

(9) Disaster and emergency policy consistent with § 422.100(m)(5)(iii).

(10) A Notice of Privacy Practices as required under the HIPAA Privacy Rule (45 CFR 164.520).

(11) For PFFS plans, a link to the PFFS Terms and Conditions of Payment.

(12) For MSA plans, the following statements:

(i) “You must file Form 1040, `US Individual Income Tax Return,' along with Form 8853, `Archer MSA and Long-Term Care Insurance Contracts' with the Internal Revenue Service (IRS) for any distributions made from your Medicare MSA account to ensure you aren't taxed on your MSA account withdrawals. You must file these tax forms for any year in which an MSA account withdrawal is made, even if you have no taxable income or other reason for filing a Form 1040. MSA account withdrawals for qualified medical expenses are tax free, while account withdrawals for non-medical expenses are subject to both income tax and a fifty (50) percent tax penalty.”

(ii) “Tax publications are available on the IRS website at http://www.irs.gov or from 1-800-TAX-FORM (1-800-829-3676).”

(13) Instructions on how to appoint a representative including a link to the downloadable version of the CMS Appointment of Representative Form (CMS Form-1696).

(14) Enrollment instructions and forms.

(c) Required posted materials. MA organization's website must provide access to the following materials, in a printable format, within the timeframes specified in paragraphs (c)(1) and (2) of this section.

(1) The following materials for each plan year must be posted on the website by October 15 prior to the beginning of the plan year:

(i) Evidence of Coverage.

(ii) Annual Notice of Change (for renewing plans).

(iii) Summary of Benefits.

(iv) Provider Directory.

(v) Provider/Pharmacy Directory.

(2) The following materials must be posted on the website throughout the year and be updated as required:

(i) Prior Authorization Forms for physicians and enrollees.

(ii) When applicable, Part D Model Coverage Determination and Redetermination Request Forms.

(iii) Exception request forms for physicians (which must be posted by January 1 for new plans).

(iv) CMS Star Ratings document, which must be posted within 21 days after its release on the Medicare Plan Finder.