SUPPLEMENTARY INFORMATION:

Inspection of Public Comments: All comments received before the close of the comment period are available for viewing by the public, including any personally identifiable or confidential business information that is included in a comment. We post all comments received before the close of the comment period on the following website as soon as possible after they have been received: www.regulations.gov. Follow the search instructions on that website to view public comments. CMS will not post on Regulations.gov public comments that make threats to individuals or institutions or suggest that the commenter will take actions to harm an individual. CMS continues to encourage individuals not to submit duplicative comments. We will post acceptable comments from multiple unique commenters even if the content is identical or nearly identical to other comments.

Plain Language Summary: In accordance with 5 U.S.C. 553(b)(4), a plain language summary of this proposed rule may be found at www.regulations.gov/​.

I. Executive Summary

A. Purpose

The primary purpose of this proposed rule is to amend the regulations for the Medicare Advantage (Part C) program and the Medicare Prescription Drug Benefit (Part D) program to implement section 6219 (Adjustments to Medicare Part D Cost-Sharing Reductions For Low-Income Individuals), section 6220 (Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act), and section 6224 (Modernizing and Ensuring Pharmacy Benefit Manager Accountability) of the Consolidated Appropriations Act, 2026 (CAA).

We note that, as with previous rules, any new marketing and communications policies in this rule are proposed to be applicable for all contract year 2028 marketing and communications, beginning October 1, 2027.

B. Summary of the Key Provisions

1. Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals (Section 6219 of the Consolidated Appropriations Act, 2026)

CMS is proposing to implement section 6219 of the CAA that would reduce the generic drug copayment from $1 to $0 for full-benefit dual eligible individuals at or below 100 percent of the Federal Poverty Level, effective for plan years starting January 1, 2028.

2. REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026)

CMS proposes to codify regulations to implement section 6220 of the CAA, titled the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act, which establishes new provider directory accuracy and accountability requirements for Medicare Advantage (MA) organizations beginning in contract year 2028. Specifically, CMS proposes requirements to implement this new law related to provider directory verification and maintenance standards, annual accuracy analysis and reporting, public reporting of accuracy scores, and cost sharing protections for enrollees who rely on inaccurate provider directory information. CMS also proposes to codify the statutory requirements for contract year 2029, including that CMS must publicly display provider directory accuracy scores in a machine-readable format and MA organizations must prominently display those scores in their provider directories. Through these proposed codifications implementing the REAL Health Providers Act, CMS seeks to promote provider directory accuracy and accountability among MA organizations to ensure that beneficiaries are provided with clear, accurate information on the network of providers available to meet their health care needs.

3. Modernizing and Ensuring Pharmacy Benefit Manager Accountability (Section 6224 of the Consolidated Appropriations Act, 2026)

CMS has several proposals to implement section 6224 of the CAA, which established requirements related to pharmacy benefit managers (PBMs) and their affiliates specific to the Medicare Part D program. These proposals include new and enhanced requirements governing the remuneration that PBMs and their affiliates may receive for services in connection with the utilization of Part D drugs, data reporting by PBMs to Part D plan sponsors and CMS, transparency in ( printed page 66409) price guarantee arrangements between PBMs or their affiliates and Part D plan sponsors, disclosure by PBMs to Part D plan sponsors of the terms of certain agreements between PBMs or their affiliates and pharmaceutical manufacturers, and other requirements added by the CAA. CMS also proposes to define key terms related to such requirements and establish compliance and enforcement mechanisms, including disgorgement of funds to CMS for violations of the remuneration requirements.

C. Summary of Costs and Benefits

D. Conclusion

Finally, we are clarifying and emphasizing our intent that if any provision of this rule, once finalized, is held to be invalid or unenforceable by its terms, or as applied to any person or circumstance, or stayed pending further agency action, it shall be severable from this rule and not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other, dissimilar circumstances. Through this rule, we propose provisions that are intended to and will operate independently of each other, even if each serves the same general purpose or policy goal. Where a provision is necessarily dependent on another, the context generally makes that clear (such as by a cross-reference to apply the same standards or requirements).

II. Implementation of Certain Provisions of the Consolidated Appropriations Act, 2026

A. Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals (Section 6219 of the Consolidated Appropriations Act, 2026) (§ 423.782)

In the Medicare Program, Medicare Prescription Drug Benefit Final Rule (70 FR 4194), CMS codified at § 423.782(a)(2)(iii)(A) and (B) the cost-sharing requirements for full-benefit dual eligible (FBDE) individuals with incomes that do not exceed 100 percent of the Federal Poverty Level (FPL) pursuant to section 1860D-14(a) of the Act, codified at 42 U.S.C. 1395w-114(a). Under these provisions, individuals are subject to cost-sharing for covered Part D drugs equal to the lesser of the following:

• A copayment amount of no more than $1 for a generic drug, approved biological product, or preferred drugs that are multiple source, or $3 for any other drug in 2006.
• For years after 2006, the amounts specified earlier are adjusted for the annual percentage increase in the Consumer Price Index (CPI) as of September of the previous year, rounded to the nearest multiple of 5 cents or 10 cents, respectively; or
• Under § 423.782(a)(2)(i), the copayment amount charged to: noninstitutionalized full-benefit dual eligible individuals who have income above 100 percent of the FPL, individuals with income under 135 percent of the FPL for years prior to 2024, or individuals with income under 150 percent of the FPL for years 2024 and thereafter.

On February 3, 2026, the Consolidated Appropriations Act, 2026 (CAA), Public Law 119-75, was enacted into law. Section 6219 of the CAA, titled “Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals,” amends section 1860D-14(a) of the Act to reduce the generic drug copayment from $1 to $0 for FBDE individuals with incomes that do not exceed 100 percent of the FPL, effective for plan years beginning on or after January 1, 2028. The provision also clarifies that the existing annual CPI inflation adjustment methodology applies only to plan years before 2028 with respect to generic drug copayments for this population.

Currently, for plan years before January 1, 2028, FBDE individuals with incomes that do not exceed 100 percent of the FPL as described in § 423.782(a)(2)(iii), are subject to a $1 copayment for generic drugs covered under Medicare Part D, adjusted annually for CPI. For plan year 2026, this amount is $1.60 for generic drugs and $4.90 for other covered Part D drugs, with no deductible, as reflected in the CY 2026 Resource and Cost-Sharing Limits for Low-Income Subsidy guidance issued October 31, 2025.

To implement section 6219 of the CAA, we are proposing to amend § 423.782(a)(2)(iii) to reflect that, for plan years beginning on or after January 1, 2028, the copayment for generic drugs for FBDE individuals with incomes that do not exceed 100 percent of the FPL is $0. First, we are proposing to amend § 423.782(a)(2)(iii)(A) to specify that the cost-sharing rules in that paragraph are applicable to plan years before January 1, 2028. Second, we are proposing to redesignate paragraph (B) in § 423.782(a)(2)(iii) as paragraph (C) and add new paragraph (B) to specify that for plan years beginning on or after January 1, 2028, the copayment for generic drugs for FBDE individuals with incomes that do not exceed 100 percent of the FPL is $0.

This proposal is a conforming change to existing regulatory text and would not alter the eligibility criteria, subsidy ( printed page 66410) structure, or any other cost-sharing parameters applicable to FBDE individuals. CMS is not proposing any changes to the copayment amounts applicable to the cost-sharing requirements for non-generic (brand-name) drugs or other covered Part D drugs for FBDE individuals. Specifically, the copayment for preferred multiple-source drugs and other covered drugs for FBDE individuals would continue to be adjusted annually for CPI in accordance with existing statutory and regulatory requirements. This proposal is narrowly tailored to implement the specific statutory directive in section 6219 of the CAA and does not introduce any discretionary policy changes.

We estimate approximately 6 million enrollees would be affected by these proposed changes, based on 2026 CMS enrollment data. We believe the proposed changes would impact the Medicare Trust Fund and individuals in two ways: elimination of the co-pay is expected to reduce out-of-pocket costs for affected enrollees, and the anticipated increase in generic drug utilization is expected to affect Medicare Trust Fund expenditures through transferring copay costs from the beneficiary to the Medicare program. This rule does not include a new collection of information; therefore, there is no change in paperwork burden to plans or individuals. Additional information is provided in the regulatory impact analysis in section IV.C.1. of this proposed rule.

B. REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026) (§§ 422.2, 422.111, 422.120, 422.123, 422.124, 422.202, 422.504, 422.2265, and 422.2267)

On February 3, 2026, in section 6220 of the Consolidated Appropriations Act, 2026 (CAA) (Pub. L. 119-75, H.R. 7148-484), Congress enacted the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act. The REAL Health Providers Act amends sections 1851, 1852, and 1857 of the Act to establish new provider directory accuracy and accountability requirements for MA organizations, effective January 1, 2028, which is the beginning of contract year 2028. These statutory requirements include provider directory accuracy standards, accuracy score reporting, verification requirements, public transparency, and enrollee cost sharing protections. CMS is proposing to codify regulations to implement the REAL Health Providers Act legislation through this proposed rule. In addition to the statutory authority of the REAL Health Providers Act, CMS is also relying on the statutory authorities of sections 1856(b)(1) and 1857(e)(1) of the Act to establish the standards needed to implement the REAL Health Providers Act that go beyond what is specifically addressed in section 6220 of the CAA. Section 1856(b)(1) of the Act provides that CMS shall establish by regulation other standards for MA organizations and plans consistent with, and to carry out, the Part C program. Likewise, section 1857(e)(1) of the Act authorizes CMS to specify additional contract terms as necessary and appropriate in the agreements that CMS enters into with each MA organization.

The REAL Health Providers Act directs the Secretary to strengthen requirements for the accuracy and public availability of provider directory information maintained by MA organizations offering specified MA plans. Existing regulations at § 422.111(m), finalized for plan years beginning on or after January 1, 2026, already establish a foundational framework requiring MA organizations to submit provider directory information to CMS/HHS for publication online in a format and manner determined by CMS (that is, on Medicare Plan Finder (MPF)), update that information within 30 days of becoming aware of a change, and attest to its accuracy no less than annually. As CMS explained when finalizing the § 422.111(m) requirements, these changes were intended to promote transparency and informed beneficiary choice by improving access to accurate online provider directory information for beneficiaries who are navigating their health care options (90 FR 45140). These goals closely parallel the enhanced accuracy and transparency requirements in the REAL Health Providers Act. Therefore, in implementing the REAL Health Providers Act, CMS intends to build directly upon, reinforce, and, where necessary, supplement this existing regulatory infrastructure, ensuring MA organizations have a clear and harmonized set of provider directory requirements, rather than creating a parallel, duplicative, or competing set of standards.

CMS is also actively developing a National Provider Directory (NPD), which is a centralized, standardized repository intended to serve as the authoritative public-facing platform for provider directory information across the entire health tech ecosystem. CMS expects that the provider directory data that it currently collects from MA organizations under the authority of § 422.111(m) will be compatible with and may ultimately feed into the NPD infrastructure. Accordingly, CMS's proposed implementation of the REAL Health Providers Act requirements, through the existing § 422.111(m) framework, as described here in this section, is intended to be a deliberate and forward-looking approach that will position MA organizations, CMS, and the public to realize the full transparency benefits of the NPD as it develops. CMS believes this integrated approach, leveraging existing regulatory requirements, building towards a centralized national directory, and now incorporating the enhanced statutory mandates of the REAL Health Providers Act to verify data accuracy, represents the most administratively sound and least burdensome path to ensuring beneficiaries have access to accurate, reliable, and readily available provider directory information.

Taken together, these layered requirements—the existing § 422.111(m) data submission framework, the developing NPD infrastructure, and the new REAL Health Providers Act requirements regarding accuracy, verification, cost sharing protections, and public reporting mandates—work to support the larger health tech ecosystem to form a cohesive and mutually reinforcing regulatory architecture designed to ensure that beneficiaries can rely on provider directory information when making critical health care decisions. For example, the REAL Health Providers Act establishes statutory accuracy and verification standards specific to MA organizations, the MPF effort builds near-term data infrastructure for plan comparison, and the NPD advances a broader multi-payer directory accessible to all. While each of these initiatives operates on a distinct timeline and authority, they are intentionally designed to complement and reinforce one another. The accuracy scoring and verification framework required under the REAL Health Providers Act, for example, will serve to strengthen the integrity of the underlying provider data that both MPF and the NPD will likely come to depend upon, helping to ensure a consistent and reliable foundation for the larger health tech ecosystem.

CMS's proposed regulatory changes align with the statutory requirements of the REAL Health Providers Act. The proposals impact various existing sections under 42 CFR part 422, including §§ 422.2, 422.111, 422.120, 422.202, 422.504, 422.2265, and 422.2267. In addition, CMS is proposing to add two new sections: § 422.123—Provider directory accuracy requirements and § 422.124—Cost ( printed page 66411) sharing protections for reliance on incorrect provider directory information. CMS's proposals contained herein also consider feedback received from interested parties during the June 15, 2026, public meeting co-hosted by CMS and the Office of the National Coordinator for Health Information Technology (ONC), to gather input on implementing the REAL Health Providers Act. This virtual public meeting included participation from health care providers and suppliers, companies that specialize in relevant technologies (for example, provider data management, directory solutions, interoperability, verification tools, and data standards), health insurers (including MA organizations and other health plans), and patient advocates. CMS's proposals also considered written feedback from interested parties submitted after the public meeting.

During the June 15, 2026, public meeting, participants broadly supported CMS's efforts to improve provider directory accuracy while emphasizing the importance of implementing these requirements in a manner that minimizes administrative burden and promotes standardized, interoperable data exchange. Participants consistently identified provider practice locations, specialty information, acceptance of new patients, telehealth capabilities, and provider participation status as among the most challenging provider directory data elements to maintain accurately. Several participants recommended establishing standardized definitions for key provider directory information, which informed CMS's proposal to establish consistent provider directory information requirements and definitions.

Interested parties also expressed strong support for a centralized, authoritative source of provider directory information and encouraged CMS to leverage interoperability standards, existing CMS data sources, and emerging technologies to improve directory accuracy while reducing duplicative verification activities. These comments are consistent with CMS's proposed approach of building upon the existing provider directory submission framework under § 422.111(m), supporting the development of the NPD, and permitting the use of CMS-maintained data sources and verification methods. In addition, interested parties emphasized the importance of transparent, repeatable verification methodologies and encouraged CMS to recognize verification approaches that reduce burden on both MA organizations and providers.

Interested parties also discussed prioritizing provider specialty types with historically higher rates of directory inaccuracies, including behavioral health providers, and recommended that CMS focus verification and oversight efforts where they would have the greatest impact on beneficiary access to care. These comments informed CMS's proposals to identify high-inaccuracy provider specialty types and develop a weighted provider directory accuracy scoring methodology that considers both the relative importance of provider directory information to beneficiary access and the administrative burden associated with analysis. Finally, interested parties highlighted the importance of beneficiary protections when provider directory information is inaccurate, reinforcing CMS's proposal to implement the enrollee cost sharing protections established under the REAL Health Providers Act.

Overall, these proposals support the Administration's goals of improving health care transparency, strengthening beneficiary access to accurate provider information, ensuring that beneficiaries are protected when they rely on information furnished by MA organizations, and integrating with health tech ecosystem initiatives. Specifically, these proposed changes align with the June 24, 2019, Executive Order 13877, “Improving Price and Quality Transparency in American Healthcare to Put Patients First” (hereinafter referred to as E.O. 13877) and the February 25, 2025, Executive Order 14221, “Making America Healthy Again by Empowering Patients With Clear, Accurate, and Actionable Healthcare Pricing Information” (hereinafter referred to as E.O. 14221). Through these proposed codifications implementing the REAL Health Providers Act, CMS seeks to promote provider directory accuracy and accountability among MA organizations to ensure that beneficiaries are provided with clear, accurate information on the network of providers available to meet their health care needs.

1. Definitions (§ 422.2)

CMS is using the existing definition of “provider” under § 422.2 for purposes of this proposed regulation, unless otherwise indicated. Pursuant to § 422.2, a provider is (1) any individual who is engaged in the delivery of health care services in a state and is licensed or certified by the state to engage in that activity in the state; and (2) any entity that is engaged in the delivery of health care services in a state and is licensed or certified to deliver those services if such licensing or certification is required by state law or regulation.

To use consistent terminology throughout all impacted regulation sections, CMS proposes adding several new provider directory related definitions to § 422.2. The REAL Health Providers Act amended the disclosure requirements at section 1852(c) of the Act to add new subsection (c)(3) entitled “Provider Directory Accuracy.” The statute provides that the obligations under this subsection will apply to “specified MA plans” as defined in section 1852(c)(3)(C) of the Act. Thus, consistent with section 1852(c)(3)(C) of the Act, CMS proposes to define “specified MA plan” at § 422.2 as: (1) a network-based plan as defined in § 422.2—which includes MA plans that are coordinated care plans (for example, health maintenance organizations, provider-sponsored organizations, regional or local preferred provider organizations (PPOs), and specialized MA plans for special needs individuals), network-based Medicare Savings Account plans, or cost plans—or (2) an MA private fee-for-service (PFFS) plan that meets the access standards under § 422.114, in whole or in part, through entering into contracts or agreements with a network of providers. In other words, the proposed definition of “specified MA plan,” and the related proposed requirements for specified MA plans described in this proposed rule, would apply to all types of MA plans except non-network regional PPOs that meet access requirements substantially through the authority of § 422.112(a)(1)(ii) instead of written contracts. Likewise, the proposed definition of “specified MA plan” and the related proposed requirements for specified MA plans, would not apply to Program of All-Inclusive Care for the Elderly (PACE) plans.

In addition, section 1852(c)(3)(B) of the Act defines “provider directory information” as “information enrollees may need to access covered benefits from a provider with which such organization offering such plan has an agreement for furnishing items and services covered under such plan, such as name, specialty, contact information, primary office or facility addresses where items or services are furnished, whether the provider is accepting new patients, accommodations for people with disabilities, cultural and linguistic capabilities, and telehealth capabilities.” Accordingly, CMS proposes to define “provider directory information” at § 422.2 to conform with this section of the Act as “information enrollees may need to access covered benefits from a provider with which an ( printed page 66412) MA organization offering a specified MA plan has an agreement for furnishing items and services covered under such plan, including, at a minimum, all of the following: (1) provider name; (2) specialty; (3) contact information, including telephone number(s); (4) primary office or facility address(es) where covered items or services are furnished; (5) whether the provider is accepting new patients; (6) accommodations for people with disabilities; (7) cultural and linguistic capabilities; (8) telehealth capabilities; and (9) common ownership or control disclosure.”

This proposed regulatory definition captures all the elements of the statutory definition and includes one additional element—common ownership or control disclosure. CMS interprets the “such as” in section 1852(c)(3)(B) of the Act to mean that the data elements specifically listed in the statute are required, but not exhaustive of the types of information that may be considered “provider directory information” (that is, information that enrollees may need to access covered benefits from a contracted provider) for purposes of the requirements provided under the REAL Health Providers Act. CMS believes that common ownership or control disclosure is necessary to inform plan and provider choice because vertical integration may affect care delivery arrangements, referral patterns, and negotiated charges or payment arrangements. Greater transparency regarding common ownership or control may also be useful for beneficiaries, caregivers, State Health Insurance Assistance Program (SHIP) counselors, agents, brokers, researchers, and other entities assisting beneficiaries or evaluating MA provider networks. In the MA marketplace, provider networks are a central feature beneficiaries use to compare plan options, assess whether they can access preferred providers, and understand how care may be delivered within a plan's network. Information indicating that a network provider, provider group, facility, or supplier is under common ownership or control with the MA organization or its parent organization may provide important context about the relationship between the plan and the providers from whom enrollees may obtain covered services. For example, such information may help beneficiaries and those assisting them understand whether a plan's network includes providers that are part of the same corporate family as the MA organization, which may be relevant to evaluating provider choice, potential care coordination arrangements, referral pathways, and the structure of the network. CMS also believes that this information may promote broader transparency in the MA marketplace by allowing researchers, policymakers, and other interested parties to better assess the prevalence and effects of vertical integration across MA networks, including how common ownership or control relationships may relate to network design, access to care, utilization patterns, and beneficiary decision-making.

Under the proposed definition for “provider directory information” at § 422.2, CMS proposes for common ownership or control disclosures to include any network provider, provider group, facility, or supplier that is owned or controlled, in whole or in part, directly or indirectly, by the MA organization, by the MA organization's parent organization, by a subsidiary or affiliate of the MA organization, or by any entity that is under common ownership or control with the MA organization. CMS considers a provider to share ownership or control with an MA organization if the provider and the MA organization are directly or indirectly owned or controlled by the same parent organization, ultimate parent organization, holding company, or other controlling entity, regardless of whether the MA organization itself directly owns the provider. For example, an MA organization may be one subsidiary of a parent or holding company, while a physician group, hospital system, or other network provider may be owned by a separate subsidiary of the same parent or holding company. In this scenario, the MA organization may not directly own the provider, and the provider may not be legally organized under the MA organization itself. However, because both the MA organization and the provider are owned or controlled, directly or indirectly, by the same parent or holding company, CMS would consider the provider to be under common ownership or control with the MA organization for purposes of the proposed provider directory disclosure requirement. The provider directory disclosure could state: “This provider is under common ownership or control with [MA organization name or parent organization name].”

As another example, an MA organization's parent organization may own a health care services subsidiary, and that subsidiary may own, control, or partially own a provider group through one or more intermediate entities, and such provider group may be in the MA plan's network. The provider group may operate under a different trade name, may contract with multiple health plans, and may not be directly owned by the MA organization. Nevertheless, if the MA organization and the provider group are connected through indirect ownership or control by the same parent organization, affiliate, subsidiary, or other controlling entity, then CMS would consider the provider group to be under common ownership or control with the MA organization for purposes of the provider directory disclosure requirement. In that circumstance, the directory could identify the relationship using standardized language, such as: “This provider group is under common ownership or control with [MA organization name or parent organization name].” CMS solicits comments on the proposed model language that should be used in the disclosure statement and whether different versions of the statement would be necessary to accommodate different types of ownership or affiliations. With this proposed model language, CMS aims to capture these various business relationships appropriately but also provide the information in a simple and understandable manner for beneficiaries.

This requirement to disclose common ownership or control would not alter, or otherwise affect any existing or future standards, definitions, reporting obligations, or analyses related to MA bid development, medical loss ratio reporting, related-party disclosures, financial audits, or any other program integrity, payment, accounting, or oversight requirements outside of this provider directory disclosure construct. CMS solicits comments on whether these examples appropriately describe the types of direct, indirect, affiliate, subsidiary, parent, and common-control relationships that should be included in the proposed provider directory disclosure requirement, and whether additional examples or exclusions would be helpful for MA organizations, providers, beneficiaries, and other users of provider directory information.

CMS notes that the proposed provider directory element of “accommodations for people with disabilities” is referring to notations in the provider directory for provider listings in which accommodations for people with disabilities exist. Such accommodations may include physical accessibility features (such as accessible entrances with ramps, elevators, accessible exam rooms and tables, accessible medical equipment, and accessible parking), auxiliary aids and services, and other necessary accommodations. MA organizations must adhere to all current ( printed page 66413) federal laws and regulations concerning accommodations for people with disabilities, including Section 504 of the Rehabilitation Act of 1973, Title II of the Americans with Disabilities Act (ADA) of 1990, and Section 1557 of the Affordable Care Act of 2010. Questions regarding this topic should be directed to the HHS Office for Civil Rights (OCR).

In addition, CMS notes that the proposed provider directory element of “cultural and linguistic capabilities” based on the language in the Act is similar to existing language at § 422.111(b)(3)(i). However, CMS proposes to adopt the terminology used by Congress for “cultural and linguistic capabilities” without retaining the additional language in current § 422.111(b)(3)(i) specifying that “each provider's” cultural and linguistic capabilities includes “languages (including American Sign Language) offered by the provider or a skilled medical interpreter at the provider's office.” In light of the intervening statutory requirement enacted by Congress, CMS believes it is appropriate to implement section 1852(c)(3)(B) of the Act using the terminology selected by Congress. This approach retains the requirement for MA organizations to include providers' cultural and linguistic capabilities in their provider directories and also reflects changes in Federal policy since publication of the April 12, 2023, Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly final rule. Executive Order 14151, “Ending Radical and Wasteful Government DEI Programs and Preferencing,” directed agencies, consistent with applicable law, to review Federal policies and regulations adopted in furtherance of prior diversity, equity, inclusion, and accessibility initiatives and to align agency actions with the policies established by that order. CMS recognizes that providers may have a variety of cultural and linguistic capabilities that could be included in an MA organization's provider directory. Therefore, by removing this additional language, CMS is providing added flexibility regarding the types of cultural and linguistic capabilities that MA organizations can include in their provider directories. As proposed, CMS intends to allow MA organizations to include information beyond the examples identified in § 422.111(b)(3)(i). This flexibility would allow MA organizations to highlight capabilities that respond to the specific needs of their enrollees and help beneficiaries identify providers who can meet those needs.

CMS also proposes to add a definition for “provider directory” to § 422.2, which would pull together provider directory categories of information (§ 422.111(b)(3)(i)(A), (b)(3)(i)(B), and (b)(12)) and be defined as “for specified MA plans, as defined in this section, the publicly available listing, maintained and distributed by an MA organization pursuant to § 422.2267(e)(11), of providers that are currently contracted and participating in that MA plan's provider network, and containing the information under § 422.111(b)(3)(i)(A), (b)(3)(i)(B), and (b)(12).” CMS's proposed definition for “specified MA plan” would apply here. Note that CMS is proposing to include the cross-reference to § 422.111(b)(3)(i)(B) in this proposed definition of “provider directory,” which eliminates the need to refer to “provider directory information” in this definition because CMS's proposed changes to § 422.111(b)(3)(i)(B) (discussed in section II.B.11. of this proposed rule) include a cross-reference to the definition of “provider directory information.”

Finally, CMS proposes to define “provider directory accuracy score” at § 422.2 as “the score reflecting the accuracy of provider directory information calculated and reported in accordance with § 422.123(d).” Regarding the cross-references to §§ 422.111(b)(12) and 422.123(d) in these two proposed definitions, these are two new proposed sections of the regulation which CMS discusses in sections II.B.4., II.B.5., II.B.6., and II.B.11. of this proposed rule. CMS solicits comments on these proposed changes to definitions at § 422.2.

2. Provider Directory Verification Requirements (§§ 422.123(a) and (b), 422.2265(b)(3) and (b)(15), and 422.111(h)(2))

The REAL Health Providers Act's addition of section 1852(c)(3) of the Act establishes new provider directory requirements for plan year 2028 and subsequent plan years, in which each MA organization offering a specified MA plan shall, for each specified MA plan offered by the organization, do the following: (1) maintain, on a publicly available internet website, an accurate provider directory that includes provider directory information; (2) not less frequently than once every 90 days (or, in the case of a hospital or any other facility determined appropriate by the Secretary, at a lesser frequency specified by the Secretary but in no case less frequently than once every 12 months), verify the provider directory information of each provider listed in such directory and, if applicable, update such information; (3) if the organization is unable to verify such information with respect to a provider, include in such directory an indication that the information of such provider may not be up to date; and (4) remove a provider from such directory within 5 business days if the organization determines that the provider is no longer a provider participating in the network of such plan.

To implement these new requirements of section 1852(c)(3) of the Act, CMS proposes to add new § 422.123—Provider directory accuracy. Within new proposed § 422.123, paragraph (a) would set forth the applicability of the section to each MA organization offering a specified MA plan for contract year 2028 and subsequent contract years. Although the statute uses the term “plan year,” the customary term that CMS uses is “contract year,” therefore, CMS proposes language using the term “contract year” throughout the proposed regulations. To codify section 1852(c)(3)(A)(i) of the Act, CMS proposes to amend § 422.2265(b)(3) to require that an MA organization's website includes an accurate provider directory for each specified MA plan that includes provider directory information for each provider that is currently contracted and participating in the plan's provider network. CMS also proposes a slight modification to the existing regulatory language at § 422.2265(b)(3), which currently reads: “A PDF or copy of a printable provider directory.” To ensure greater clarity in terminology, CMS proposes to revise this phrase to read as follows: “a PDF or otherwise printable electronic copy of the provider directory.” Section II.B.3. of this proposed rule includes a more detailed discussion of the proposed requirements for updating this version of the provider directory.

In conjunction with the proposed changes at § 422.2265(b)(3), and in line with the January 31, 2025, Executive Order 14192, “Unleashing Prosperity Through Deregulation,” CMS is taking the opportunity to streamline existing regulations. CMS proposes to make conforming changes to § 422.111(h)(2) to cross-reference §§ 422.2265, 422.120(a), and 422.2267(d) and remove duplicative information that is already addressed by the aforementioned regulations. Specifically, at § 422.111(h)(2), CMS proposes to require MA organizations to ( printed page 66414) have a publicly available internet website that complies with the website requirements in §§ 422.2265 and 422.120(a) and state that posting copies of required materials on the website does not relieve the MA organization of its responsibility to provide hard copies to enrollees upon request in accordance with § 422.2267(d) or when required by CMS. This proposed change would remove the existing reference to § 422.111(b) in § 422.111(h)(2) and replace it with a reference to the website requirements at § 422.2265. All the contents of a plan description under § 422.111(b) are already required on MA organizations' websites per § 422.2265, except existing § 422.111(b)(9), the quality improvement program. To preserve this requirement, CMS proposes to add a new paragraph (b)(15) to § 422.2265 to require an MA organization's website to include a description of the quality improvement program required under §§ 422.152 and 422.111(b)(9). The proposed change to § 422.111(h)(2) would also remove duplicative information about hardcopy requirements for required materials (such as the evidence of coverage, provider directory, and summary of benefits) and instead include a cross-reference to these requirements which are already outlined at § 422.2267(d).

To codify section 1852(c)(3)(A)(ii) and (iii) of the Act, CMS proposes to add new § 422.123(b) to set forth the new provider directory verification requirements. Aligning with the statute, at new proposed § 422.123(b)(1), CMS proposes to require each MA organization offering a specified MA plan to verify the provider directory information of each provider listed in that specified MA plan's provider directory not less frequently than once every 90 days, except in the case of hospitals and other facilities as listed in § 422.116(b)(2)(i), (iv), and (v)—that is, acute inpatient hospitals, critical care services (intensive care units), and surgical services (outpatient or ambulatory surgery center). For these excepted hospitals and other facilities, CMS proposes to require each MA organization offering a specified MA plan to verify the provider directory information of these entities not less frequently than once every 12 months. The statute provides CMS with discretion to impose verification requirements for hospitals or any other facility determined appropriate by the Secretary at a lesser frequency than once every 90 days (as is the case for other providers) but at a frequency no less than once every 12 months. At this time, CMS is proposing a 12-month verification frequency for these entities. CMS selected these three types of entities because CMS believes that data for these specific entities is generally more static, as they may not move locations as often as other providers or facilities given their size and facility requirements, therefore, verifying the information at least every 12 months is sufficient for these types of entities. This policy approach would also limit some of the burden associated with verification on both MA organizations and these facilities. In addition, CMS's proposed reference to hospitals and other facilities listed in § 422.116(b)(2)(i), (iv), and (v) is appropriate because MA organizations are familiar with this list of facilities for purposes of network adequacy. CMS seeks comments specifically on the proposed selection of other facilities listed in § 422.116(b)(2)(i), (iv), and (v) for the 12-month verification requirement. For all providers listed in the provider directory, CMS proposes that the MA organization must comply with the appropriate verification frequency (90 days or 12 months) and update the provider directory in accordance with CMS's updating requirements, if updates are needed. Provider directory updating requirements are discussed in section II.B.3. of this proposed rule.

Next, at new proposed § 422.123(b)(2), CMS proposes to require the MA organization to use one or more CMS-specified provider directory verification methods to meet the provider verification requirements, including verification using internal plan information, verification via telephone or email, verification using provider attestations, verification using data sources maintained by CMS, claims data, or other verification methods specified by CMS. By including internal plan information as a proposed CMS-specified provider directory verification method, CMS is referring to information such as current, accurate provider rosters or recent claims information. Regarding data sources maintained by CMS, CMS means provider data repositories, such as the National Plan and Provider Enumeration System (NPPES), and provider directory databases, such as the NPD, that are maintained by CMS. By including claims data, CMS is referring to data containing information on recent claims between the contracted provider and the MA organization.

By including data sources maintained by CMS and other verification methods specified by CMS in this proposed list, CMS would retain the flexibility to specify additional acceptable, CMS-approved verification methods in technical guidance. CMS is aware that this is a space where technology and the use of artificial intelligence is quickly evolving and CMS's work on the NPD is ongoing, and including this flexibility in proposed § 422.123(b)(2) would enable CMS to respond more quickly to advancements in verification methods, ultimately providing MA organizations with more options for meeting their provider directory verification obligations. CMS would provide technical guidance as necessary.

CMS anticipates that MA organizations may need to use more than one verification method to verify all the elements of provider directory information in the proposed provider directory verification requirements. For example, CMS recognizes that MA organizations may be accustomed to using NPPES. However, NPPES has both benefits and limitations, including the fact that certain provider directory information may not be available in NPPES, such as whether a provider is accepting new patients. As such, there will likely be a need for MA organizations to supplement use of NPPES with other verification method(s) to verify all the elements of provider directory information that CMS requires. In addition, CMS is also actively developing the NPD, which is intended to be a centralized, standardized repository meant to serve as the authoritative public-facing platform for provider directory information across the entire health tech ecosystem. CMS anticipates that once the NPD is fully operational, MA organizations might be able to use this source for verification, as it falls under the category of a data source maintained by CMS.

CMS issued guidance through the Health Plan Management System (HPMS) on January 3, 2020, and June 29, 2022, about the use of NPPES for determining the accuracy of provider directory data in CMS's various monitoring and enforcement activities. In the January 3, 2020, HPMS memorandum, CMS stated that the agency, in its monitoring and enforcement activities, would employ discretion should it uncover errors in directories that are consistent with NPPES data that has been updated or certified between January 1 and April 30, 2020, so long as any errors identified are corrected within 30 days. In the June 29, 2022, HPMS memorandum, CMS stated that it would continue to use discretion while monitoring and reviewing organizations' online provider directories for compliance and enforcement action and that during ( printed page 66415) compliance reviews, if CMS finds an error in an organization's online provider directory and the error matches the information in NPPES, then that error will not be considered an “error” for purposes of compliance so long as the organization contacts the provider, whose information was incorrect, within 30 days to encourage the provider to correct their information in NPPES. By proposing to include NPPES as one of the verification methods that MA organizations may use to verify provider directory information, and also because there would be other verification methods that MA organizations may use, CMS would not need to continue to use this discretion for compliance and enforcement actions if these provisions are finalized as proposed. Also, since issuing these memoranda, the landscape related to provider directories in MA has shifted due to the REAL Health Providers Act and CMS's efforts to develop the NPD. Therefore, if these provisions are finalized as proposed, CMS intends to rescind this previously issued guidance (in both the January 3, 2020, and June 29, 2022, HPMS memoranda) regarding MA organizations' usage of NPPES for purposes of verifying provider directory accuracy.

CMS notes that, in developing the proposal for the 90-day/12-month provider directory verification requirement at new proposed § 422.123(b)(2), CMS considered limiting which verification method(s) may be used by MA organizations for which provider directory elements. Including such limitations may potentially impose additional burden on MA organizations. At this time, CMS is not proposing any such limitations on MA organizations' use of the proposed verification method(s) for fulfilling their 90-day/12-month provider directory verification obligations as described in new proposed § 422.123(b)(1)(i) and (ii). However, as discussed in section II.B.5. of this proposed rule, at new proposed § 422.123(d)(3)(i), CMS is proposing to limit what verification method(s) may be used by MA organizations to evaluate the accuracy of certain provider directory data elements for purposes of calculating the estimated provider directory accuracy score (please refer to that section of this proposed rule for a more detailed discussion). CMS solicits comments on the considerations and proposals surrounding limiting verification approaches, for both new proposed § 422.123(b)(2) and (d)(3)(i). In addition, CMS intends to identify certain best practices in technical guidance, such as which verification methods might be more appropriate or reliable for the proposed 90-day/12-month provider directory verification requirement, depending on the particular provider directory data elements being verified.

To implement section 1852(c)(3)(A)(iii) of the Act, at § 422.123(b)(3), CMS proposes to require that if the MA organization is unable to verify provider directory information with respect to a provider during the applicable verification cycle, then the MA organization must include in the provider directory a clear indication that the information of such provider may not be up to date. An example of language that CMS believes would be sufficient for this proposed indicator is: “The provider's information may not be up to date.” If § 422.123(b)(3) is finalized as proposed, then CMS intends to update the Medicare Advantage and Section 1876 Cost Plan Provider Directory Model and Instructions with similar template language for the indicator. If the MA organization subsequently verifies or updates the information, then the MA organization must remove or revise the indicator consistent with CMS's provider directory updating requirements.

Finally, per existing statutory authority under section 1856(b)(1) of the Act to establish by regulation other standards for MA organizations consistent with, and to carry out, the Part C program, CMS is proposing, at new proposed § 422.123(b)(4), to require that each MA organization offering a specified MA plan must include a term in their contract with each contracted provider for a specified MA plan, obligating the contracted provider to maintain current and accurate provider directory information as defined in proposed § 422.2. The purpose of this new proposed contract requirement is to ensure that when the MA organization verifies provider directory information in accordance with proposed § 422.123(b), the information the MA organization obtains from each contracted provider is more likely to be current and accurate. This proposed contract requirement is intended to improve the reliability of the data that MA organizations obtain directly from their contracted providers, specifically the type of data collected using the first four CMS-specified verification methods outlined at proposed § 422.123(b)(2)(i) through (iv), which are internal plan information, telephonic verification, email verification, and provider attestations. CMS believes that this proposed provider contract term is necessary to assist MA organizations in carrying out successful verification efforts, which would ultimately support the broader effort to ensure accurate provider directories.

In summary, to implement several aspects of the REAL Health Providers Act, CMS is proposing the provider directory accuracy applicability requirement at new proposed § 422.123(a), verification requirements at new proposed § 422.123(b), proposed changes to the website requirement at § 422.2265(b)(3), a streamlining of existing regulations at § 422.111(h)(2), and a preservation of the existing requirement for a description of the quality improvement program on an MA organization's website at new proposed § 422.2265(b)(15). CMS solicits comments on these proposed changes.

3. Provider Directory Updating Requirements (§§ 422.123(c) and 422.2267(e)(11)(iv))

Implementation of the REAL Health Providers Act presents CMS with the opportunity to streamline other existing provider directory regulations, including rules around updating provider directories. After considering the proposed layout of the new rules for provider directory accuracy, CMS determined it would be prudent to move the existing updating requirements for provider directories to new proposed § 422.123, for purposes of logic and ease of reading. Therefore, CMS is proposing to move the updating requirements from § 422.2267(e)(11)(iv) to new proposed § 422.123(c). CMS is not changing the basic 30-day provider directory updating requirement, but CMS is proposing some changes in order to implement certain requirements of the REAL Health Providers Act. The current provider directory regulations apply to MA plans with provider networks, all of which are included in the proposed definition of “specified MA plan.”

The MA organization will still be required to update both the online provider directory and the PDF or otherwise printable electronic copy of the provider directory (as specified in proposed § 422.2265(b)(3)) within at least 30 days of receiving information requiring update, except that a provider must be removed from the directory no later than 5 business days after the MA organization determines that the provider is no longer participating in the specified MA plan's network. CMS is proposing to move this requirement to new proposed § 422.123(c)(1). This proposed 5-business-day updating requirement would apply to both the online provider directory and the PDF or otherwise printable electronic copy of the provider directory (as specified in proposed § 422.2265(b)(3)). In other ( printed page 66416) words, if this requirement is finalized as proposed, MA organizations would be required to update the PDF or otherwise printable electronic copy version of their provider directory within 5 business days, but this would not mean printing new physical hardcopies since the PDF or otherwise printable electronic copy of the provider directory is required to be posted on the MA organization's website. This 5-business-day updating requirement would apply to PDF or otherwise printable electronic copy of the provider directory posted on the MA organization's website and would not require an MA organization to mail a revised physical hardcopy directory to an enrollee within 5 business days. As discussed further later, for enrollees who have requested a physical hardcopy provider directory, CMS is separately proposing at § 422.123(c)(2) to require MA organizations to send a quarterly addendum containing updates to the provider directory. This quarterly addendum would provide a regular mechanism for keeping enrollees who rely on a previously furnished physical hardcopy directory informed of subsequent directory changes without requiring MA organizations to mail a revised physical hardcopy directory each time an update is made.

To codify section 1852(c)(3)(A)(iv) of the Act, at § 422.123(c)(4) CMS proposes to require that the MA organization must remove a provider from the provider directory no later than 5 business days after the date on which the MA organization determines that the provider is no longer participating in the network of the specified MA plan. This would be the only proposed exception to the 30-day provider directory updating requirement at new proposed § 422.123(c)(1).

In addition, although the REAL Health Providers Act does not include a specific timeframe for updating physical hardcopy provider directories, CMS would like to take the opportunity through this proposed rule to further clarify the policies regarding physical hardcopy updates via addenda. Currently, § 422.2267(e)(11)(iv)(B)(2) states that hardcopy directories that include separate updates via addenda are considered up to date. CMS has reconsidered this policy and determined that it would be beneficial to specify a regular cadence for updating physical hardcopy directories to avoid ambiguity or misinterpretation by MA organizations. Specifically, CMS proposes to require MA organizations to send a quarterly addendum containing updates to all enrollees who have requested a physical hardcopy provider directory. Sending a quarterly update only to those enrollees who have requested a physical hardcopy directory would meet the requirements for keeping physical hardcopy directories updated and avoid the need for MA organizations to mail updated physical hardcopy directories on a monthly basis, thus reducing burden. This policy would be a supportive beneficiary protection because it would keep enrollees informed with a predictable and regular cadence of updates if they are accustomed to using a physical hardcopy directory, and it would protect enrollees from making a misinformed decision based on an outdated version of the physical hardcopy directory. CMS proposes to add this requirement regarding the quarterly addendum for physical hardcopy provider directories at new proposed § 422.123(c)(2).

In addition, while CMS believes it is unlikely for plans or agents/brokers to use physical hardcopy directories at marketing events (and instead refer to or show prospective enrollees the online provider directory), CMS clarifies that if plans or agents/brokers do plan to distribute physical hardcopy directories, then they would need to print out the PDF or otherwise printable electronic copy of the provider directory that exists on the MA organization's website and use that current, up-to-date version if needed for physical distribution to prospective enrollees. This would ensure that prospective enrollees have access to the most updated provider directory that exists at that time.

Furthermore, due to the point-in-time nature of physical hardcopy directory updates and the fact that if CMS finalizes the proposed quarterly addenda policy then enrollees receiving a physical hardcopy directory would only receive four updates per year, CMS proposes to require that MA organizations include a disclaimer on the physical hardcopy provider directory that recommends beneficiaries check the online provider directory or contact the MA organization for the latest updates. CMS proposes to add this requirement at new proposed § 422.123(c)(3). CMS believes this type of disclaimer is essential to keep all beneficiaries (both prospective enrollees and current enrollees) informed and aware that the online directory is likely the most reliable version because of the ease and timeliness of making electronic updates. This would ensure that all beneficiaries have access to the most current and accurate information about the plan's provider network.

These proposed changes related to provider directory updating requirements at new proposed § 422.123(c) would replace and supplement existing updating requirements at § 422.2267(e)(11)(iv). Accordingly, CMS is proposing to amend § 422.2267(e)(11)(iv) to require that the provider directory be verified and updated in accordance with § 422.123(b) and (c) (for contract year 2028 and subsequent contract years).

In summary, CMS is proposing several changes to the provider directory updating requirements, including moving existing updating requirements from § 422.2267(e)(11)(iv) to § 422.123(c)(1), implementing section 1852(c)(3)(A)(iv) of the Act at § 422.123(c)(4), adding new requirements related to physical hardcopy directories at § 422.123(c)(2) and (c)(3), and updating § 422.2267(e)(11)(iv) to refer to § 422.123(b) and (c). CMS solicits comments on these proposed changes.

4. Provider Directory Accuracy Analysis and Sampling Methodology (§ 422.123(d)(1) and (2))

In addition to provider directory verification and updating requirements, the REAL Health Providers Act establishes new requirements regarding provider directory accuracy. Section 1857(e)(6)(A) of the Act requires that beginning with plan years beginning on or after January 1, 2028, each MA organization must conduct an annual analysis estimating the accuracy of the provider directory information of each specified MA plan using a random sample of providers included in such provider directory. Further, section 1857(e)(6)(A)(i)(I) and (II) of the Act states that this sample shall include a random sample of each specialty of providers with a high inaccuracy rate of provider directory information relative to other specialties of providers, as determined by the Secretary, and one type of specialty may be providers specializing in mental health or substance use disorder treatment. CMS believes it is important that the provider directory accuracy analysis focus on a blend of provider specialty types including those that are known to have a high inaccuracy rate, as required by the statute, but to further include other provider specialty types that do not fall within the high inaccuracy rate criteria. Following this process allows CMS to continue to test and identify areas of inaccuracy as they apply to provider specialty types.

To implement the new requirements of section 1857(e)(6)(A) of the Act, CMS proposes to add new § 422.123(d)(1) to establish the annual accuracy analysis requirement and § 422.123(d)(2) to set ( printed page 66417) forth the sampling frame and methodology requirements. At new proposed § 422.123(d)(1), beginning with contract years beginning on or after January 1, 2028, each MA organization would be required to conduct an annual analysis estimating the accuracy of all provider directory information, except for “provider name,” “cultural and linguistic capabilities,” and “common ownership or control disclosure,” of each specified MA plan. CMS's proposed definitions for “provider directory information” and “specified MA plan” at § 422.2 would apply here. CMS proposes to add the sampling frame and methodology requirements at new proposed § 422.123(d)(2), stating that the analysis must use a random sample of provider records and proposes specifying provider specialty types with high provider directory inaccuracy rates at new proposed § 422.123(d)(2)(ii). When determining provider specialty types with high provider directory inaccuracy rates, at new proposed § 422.123(d)(2)(i), CMS proposes that CMS will consider all provider specialty types included in the Medicare specialty codes and National Uniform Claim Committee (NUCC) taxonomy and may consider other provider specialty types and providers furnishing supplemental benefits.

In alignment with the statute, at new proposed § 422.123(d)(2)(ii)(A), CMS proposes to identify mental health or substance use disorder treatment provider specialty types specified by CMS as provider specialty types with high provider directory inaccuracy rates. Studies conducted regarding behavioral health providers support CMS's inclusion of mental health or substance use disorder treatment as a provider specialty type with high provider directory inaccuracy rates. In 2025, the HHS Office of Inspector General (OIG) found that, on average, 55 percent of behavioral health providers listed in plans' networks did not provide a single service to enrollees in 2023 (that is, were inactive providers).^[1] OIG also conducted a survey of a random sample of inactive providers from both MA and Medicaid managed care plans and found that 72 percent of the inactive providers should not have been listed as network providers in the plan directories.^[2] Other studies conducted on provider networks outside of MA have also found issues with mental health providers in provider networks.^[3]

CMS proposes to identify providers that fall under this provider specialty type in technical guidance using two sources, as listed in new proposed § 422.123(d)(2)(i)(A). The primary source CMS anticipates using is the Medicare physician/non-physician practitioner specialty codes identified in section 10.8 of chapter 26 of the Medicare Claims Processing Manual. Physicians self-designate their Medicare physician specialty on their Medicare enrollment application or on the internet-based Medicare Provider Enrollment, Chain, and Ownership System (PECOS). Non-physician practitioners are assigned a Medicare specialty code when they enroll based on their profession. Specialty codes are used by CMS for programmatic and claims processing purposes. For example, these specialty codes are used in MA to identify provider specialty types for purposes of network adequacy reviews. CMS understands that the industry standard that is used for provider specialty types is the NUCC taxonomy, and CMS publishes a crosswalk between the Medicare specialty codes and the NUCC taxonomy codes semiannually.^[4] Regarding the second source that CMS would use to determine the provider specialty types with high provider directory inaccuracy rates, in addition to the Medicare specialty codes, CMS anticipates considering the use of additional codes from the NUCC taxonomy where appropriate to augment the Medicare specialty codes. CMS seeks comments on this proposal.

CMS intends to identify the specific Medicare specialty codes and/or NUCC taxonomy codes that correspond to the provider specialty types with high provider directory inaccuracy rates, as described in proposed § 422.123(d)(2)(ii)(A), in annual technical guidance. CMS intends to propose the codes in draft guidance and request comments on the proposed codes. CMS then intends to issue final annual technical guidance with the final codes which will incorporate stakeholder feedback on what was proposed. CMS anticipates that the Medicare specialty codes that will meet the requirement at new proposed § 422.123(d)(2)(ii)(A) are 26 (Psychiatry), 27 (Geriatric Psychiatry), 86 (Neuropsychiatry), 62 (Psychologist), 68 (Clinical Psychologist), 80 (Licensed Clinical Social Worker), 79 (Addiction Medicine), D5 (Opioid Treatment Program), E1 (Marriage and Family Therapist), and E2 (Mental Health Counselor). CMS also is considering proposing some NUCC taxonomy codes in addition to these Medicare specialty codes, such as 104100000X (Behavioral Health & Social Service Providers/Social Worker), 101Y00000X (Behavioral Health & Social Service Providers/Counselor), and 363LP0808X (Physician Assistants & Advanced Practice Nursing Providers/Nurse Practitioner, Psychiatric/Mental Health). CMS seeks comments on the anticipated inclusion of these Medicare specialty codes and NUCC taxonomy codes in technical guidance and also whether there are other Medicare specialty codes or NUCC taxonomy codes that CMS should consider including in technical guidance. CMS also notes that providers can have many NUCC taxonomy codes and thus anticipates proposing that if the taxonomy codes match any of the NUCC taxonomy codes that a provider has, then they would be identified as a provider specialty type with high provider directory inaccuracy rates. CMS seeks comments on whether a subset of the NUCC taxonomy codes that a provider has should be considered instead of all of them, and, if so, how that subset may be defined.

CMS also considered using the network adequacy provider specialty types as defined under § 422.116(b)(1)(xxviii), (b)(1)(xxix), and (b)(2)(xiv) to define the scope of “mental health or substance use disorder treatment provider specialty types” as described in 422.123(d)(2)(ii)(A), but CMS identified some drawbacks to this alternative. The requirements at § 422.116(b) do not include all provider and facility specialty types but only those used for purposes of MA network adequacy reviews. Also, our proposal to primarily use the Medicare specialty codes aligns with the requirements at § 422.116(b), as those are also based on the Medicare specialty codes. Further, CMS aims to ensure the comparability of the resulting provider directory ( printed page 66418) accuracy scores and the MA network adequacy requirements have a specific different purpose that cannot be directly applied to the sampling frame. Although CMS did not propose this alternative, CMS is still actively considering this approach and seeks comment.

CMS is also considering some additional provider specialty types with high provider directory inaccuracy rates for inclusion at new proposed § 422.123(d)(2)(ii). CMS has previously conducted reviews of MA organizations' online provider directories. CMS conducted its most recent three rounds of reviews between June 2022 and June 2024. While CMS has published a report for the MA online provider directory reviews in the past, CMS did not publish a report for these most recent reviews.^[5] Similar to past reviews, the goal of these recent reviews was to gain a better understanding of MA provider directory accuracy, identify best practices for maintaining accurate provider directories, and, through appropriate compliance actions, drive industry improvement in providing more accurate provider directories. During the reviews conducted between June 2022 and June 2024, CMS examined the accuracy of online provider directories for 142 MA organizations that offered at least one eligible MA-PD plan.^[6] During each review round, CMS randomly sampled one contract offered by each MA organization, then randomly sampled an eligible plan from each contract. CMS designated some contracts to be “rural” and some to be “urban” to ensure a mix of urban and rural service areas for the eligible plan selected for each contract. If the eligible plan for a contract that was designated as “rural” only served urban counties, then the contract was re-designated as “urban” and another contract/eligible plan was designated as “rural.” Because many MA online provider directories require users to enter a zip code to search for providers, CMS selected a county within each plan's service area and then selected a zip code within the search county to use as the search zip code. During each review round, CMS assessed the accuracy of the provider directory listings of between 80 and 100 providers from each selected plan. In rounds one and two, CMS assessed the accuracy of 20 providers of each of the following four provider specialty types: (1) primary care providers (PCPs), (2) cardiologists, (3) oncologists, and (4) ophthalmologists.^[7] During round three, CMS added reviews of provider directory listings for a fifth provider specialty type (mental health providers), reviewing 20 mental health providers from each plan.^[8] CMS reviewed approximately one-third of eligible MA organizations during each review round. CMS found that out of the 11,360 providers and 18,852 locations reviewed across all three rounds, 44.29 percent of the location listings in the online provider directories contained at least one inaccuracy (“deficiency”), such as: The provider did not see patients at the location listed, the phone number was incorrect, the address was incorrect, the provider did not accept the plan at the location, or the provider's information could not be verified. Figure II.B.1 provides a high-level overview of the MA online provider directory review methodology. Reviewers captured provider directory data for sampled providers, placed calls to provider offices to verify the accuracy of the online provider directory data, and recorded findings in an MA organization-specific spreadsheet.

CMS made minor changes to the review methodology between the review rounds, incorporating lessons learned and refining the review approach. In round three, CMS incorporated two new final deficiencies: “Provider should not ( printed page 66419) be listed in the directory at this location—information could not be verified” and “Provider should not be listed in the directory at this location—does not accept plan” to capture more nuance about why a provider should not be listed at a location in the directory. Additionally, in round three, when reviewers found providers who only worked in a telehealth capacity, CMS assigned the provider directory record the deficiency of “Address needs to be updated” with a note indicating that the provider only sees patients in a telehealth capacity.

Table II.B.1 provides the review counts of individual providers and locations by provider type.

At the conclusion of the June 2022 through June 2024 review process, CMS analyzed the data from all three review rounds to highlight notable findings on MA organization performance. The data is summarized for each round and for all three rounds together. Table II.B.2 lists deficiency counts and rates for all three rounds, broken out by location and provider specialty type.

Given that this online provider directory review data is data that CMS has available, CMS considered proposing to use this data to identify provider specialty types with high provider directory inaccuracy rates. CMS considered including provider specialty types with a deficiency rate of 45 percent or above across all three rounds of review, which would include PCPs, cardiologists, and oncologists. CMS recognizes that there are limitations to using this data for this purpose, as it was originally gathered for a different purpose. This data is also limited because it only includes four provider specialty types that were incorporated in all three rounds of review, with one added provider specialty type incorporated in only the third (and last) round of review. Although CMS did not propose to include PCPs, cardiologists, and oncologists as provider specialty types with high provider directory inaccuracy rates, they remain under active consideration by CMS. CMS seeks comments on the inclusion of these provider specialty types as provider specialty types with high provider directory inaccuracy rates. CMS also seeks comments on whether there are any other provider specialty types that should be considered provider specialty types with high provider directory inaccuracy rates. If CMS were to include any other provider specialty types as provider specialty types with high provider directory inaccuracy rates, CMS would follow a similar process as described with the proposed inclusion of mental health or substance use disorder treatment provider specialty types, meaning CMS would review the available Medicare specialty codes and NUCC taxonomy codes, propose the codes in annual technical guidance for comment, and then issue guidance with the final list of codes taking into account commenters' feedback. If commenters on this proposed rule recommend that CMS identify any other provider specialty types in regulation, then CMS encourages commenters to include in their comments what Medicare specialty codes and/or NUCC taxonomy codes would be relevant for CMS to propose in annual technical guidance.

At this time, this is the information available to CMS to determine provider specialty types with high provider directory inaccuracy rates, however, as described in section II.B.6. of this proposed rule, CMS is considering collecting data from MA organizations in addition to the accuracy score, such as provider specialty type response rates by verification method or other sampling data by provider specialty type, which could inform future rulemaking regarding determinations of provider specialty types with high provider directory inaccuracy rates. This data could be supplemented with other external research. CMS seeks comments on other methods and other potential sources of data that CMS could use to determine provider specialty types with high provider inaccuracy rates. ( printed page 66420)

At new proposed § 422.123(d)(2)(iii), CMS proposes to require that MA organizations identify the sampling frame as consisting of provider records in the provider directory with a unique provider, address, and phone number. Thus, when considering the universe of possible provider records that may be chosen for the sample, each provider record that could be selected in that universe would need to be a unique provider at a specific address and phone number. This means that, for example, a provider could be included in the sample at one address but not at another address. Similarly, if there is a case where a provider has two different phone numbers at the same address, then one provider/address/phone combination could be selected to be in the sample, but not the other. CMS proposes this approach for the sampling frame because CMS is aiming to ensure that a provider record constitutes a single, unique listing in the provider directory, and CMS believes that using the unique provider, address, and phone number constitutes a single, unique listing. When determining a unique provider for their sampling frame, CMS recommends that MA organizations use the provider's National Provider Identifier (NPI) because the NPI uniquely identifies the provider. CMS notes that a notice that the provider information may be outdated, per the proposed requirement at new proposed § 422.123(b)(3) as discussed in section II.B.2. of this proposed rule, does not mean that records associated with the provider would be excluded for purposes of sampling. A provider with such a notice would still be considered part of the sampling frame. CMS seeks comments on this proposal.

CMS is also considering identifying the sampling frame for MA organizations as consisting of provider records that contain a unique provider and address. CMS identified a drawback to this approach because there may be cases where a provider has the same address but different phone numbers, potentially creating confusion for MA organizations when they are determining their sampling frame. CMS seeks comments on whether the proposed identification of the sampling frame as a provider record in the provider directory with a unique provider, address, and phone number is appropriate or whether only a unique provider and address would be needed to identify a unique provider record. CMS also seeks comments on other data elements that may be necessary to identify a unique provider record for the sampling frame.

CMS is proposing that MA organizations would create a sample set for purposes of the proposed accuracy analysis methodology as described in new proposed § 422.123(d)(2)(iv). At new proposed § 422.123(d)(2)(iv)(A), CMS proposes to require that MA organizations use a simple random sample with 65 percent of the sample made up of any providers in the provider directory except those with provider specialty types with high provider directory inaccuracy rates identified in § 422.123(d)(2)(ii), and 35 percent of the sample made up of providers with provider specialty types with high provider directory inaccuracy rates identified in § 422.123(d)(2)(ii). In its current proposal, CMS proposes only one provider specialty type with high provider directory inaccuracy rates at § 422.123(d)(2)(ii)(A), the provider specialty type of mental health or substance use disorder treatment. Therefore, if finalized as proposed, the 35 percent portion of the sample would be made up of only providers in the mental health or substance use disorder treatment provider specialty type. If there are more provider specialty types that CMS incorporates as provider specialty types with high provider directory inaccuracy rates, then CMS would include in regulation the portion of the 35 percent of the sample that should be made up of each provider specialty type. If this were to occur, CMS anticipates an even split in the sample amongst provider specialty types with high provider directory inaccuracy rates but will consider whether certain provider specialty types should make up more of the sample than others. CMS seeks comments on the proposed sampling methodology at new proposed § 422.123(d)(2)(iv). In addition, CMS intends to release annual technical guidance with additional information regarding its sampling methodology.

CMS is also considering stratified sampling based on county type as a way to create a sample set. CMS is considering assigning counties into two groups, one containing Large Metro, Metro, and Micro counties and a second group with Rural counties and Counties with Extreme Access Considerations (CEAC). CMS is considering defining a proportion of records that should come from each grouping. CMS is also considering using a three-group stratification of Large Metro and Metro counties making up one group, Micro counties making up a second group, and Rural and CEAC counties making up a third group, or having all five county types representing separate strata. CMS understands that the dynamics associated with each county type are different, but sampling this way may also introduce complications. For example, a specific provider may serve MA plan enrollees in both a Rural and Micro county, introducing additional steps into the sampling methodology. Due to CMS concerns about the possible additional layer of complexity and the consideration of administrative burden on MA organizations and providers, CMS has not proposed stratified sampling based on county type at this time but CMS is still actively considering this approach. CMS seeks comments about whether CMS should include any of these alternative approaches in the sampling methodology or consider other alternative approaches.

In the proposed sampling methodology described in § 422.123(d)(2), CMS is also considering specifying a number or percentage of records that must be included in the sample. CMS is concerned with ensuring that conducting accuracy analysis on the sample is not overly burdensome (that is., that the sample is not too large) but also that there are enough records in the sample to ensure that the accuracy scores calculated are meaningful (that is, that the sample is not too small). CMS seeks comments on the number or percentage of records that should be included in the sample.

CMS is considering whether the proposed sampling methodology described in § 422.123(d)(2) should specify a maximum number or percentage of records that may be incorporated in the sample. CMS understands that provider networks for specified MA plans vary considerably depending on the size of the MA organization, the number of plans offered, and where an MA organization operates, among other considerations. Conducting an accuracy analysis may be more burdensome for some MA organizations than for other MA organizations, some may prefer to use a larger sample size, and some may prefer to use a smaller sample size. MA organizations that are able to conduct provider directory accuracy analysis using a larger sample size may find that they can increase their accuracy score this way relative to an MA organization who prefers to use a smaller sample size, or they may find that using a larger sample size decreases their score while increasing the associated burden. Large differences in the sample sizes used by MA organizations may affect the comparability of the resulting accuracy scores. CMS is seeking comments about whether CMS should have a maximum ( printed page 66421) number or percentage of records that may be incorporated in the sample and what that maximum number or percentage should be. Specifically, CMS is seeking comments on such issues as, whether there should be different considerations based on the size of MA organizations or in which types of counties MA organizations operate (Large Metro, Metro, Micro, Rural, CEAC); whether there are other differences between MA organizations that CMS should consider when determining the maximum number or percentage of records in the sample; and how CMS can help to ensure that there is a level playing field among all MA organizations. While CMS has not proposed a specific value in regulation at this time, CMS seeks comments on what values for a maximum number or percentage may be appropriate as part of the sampling methodology CMS intends to adopt, as well as comments on the considerations discussed previously.

In addition, CMS is considering whether the proposed sampling methodology described in § 422.123(d)(2) should specify a minimum number or percentage of records both for each provider specialty type with high provider directory inaccuracy rates at § 422.123(d)(2)(ii) and for an overall minimum number or percentage of records that must be in the sample. As noted earlier, CMS is interested in balancing the need to ensure that the sample is large enough to be sufficient to calculate the accuracy scores but also not so large as to be overly burdensome for MA organizations. Some smaller MA organizations or MA organizations with plans in rural areas may have fewer providers in their networks than other MA organizations. Considering both goals of having enough of a sample for a meaningful accuracy score calculation and minimizing administrative burden on MA organizations and providers, CMS seeks comments on what the minimum number or percentage of providers for each provider specialty type with high provider directory inaccuracy rates should be. While CMS has not proposed a specific value in regulation at this time, CMS seeks comments on what values for a minimum number or percentage may be appropriate as part of the sampling methodology CMS intends to adopt, as well as comments on the considerations discussed as part of the sampling methodology CMS intends to adopt.

Since the provider directory accuracy score must be reported for each specified MA plan, as discussed in section II.B.6. of this proposed rule, CMS's understanding is that the sample that supports the accuracy score will also need to be drawn at the plan level. However, to limit the burden on both MA organizations and providers, CMS intends to require that MA organizations consolidate their samples across the MA organization. For example, if a provider appears in multiple samples because they are contracted to participate with multiple MA plans, and the MA organization chooses the verification method of email (as described later), then using that verification method one time would be sufficient for each sample the provider appears in, and there would be no need to email the provider multiple times.

As part of the annual provider directory accuracy analysis and sampling methodology that CMS proposes to implement in § 422.123(d)(1) and (d)(2), CMS is considering also setting parameters governing when MA organizations must draw samples for purposes of the proposed annual accuracy analysis. CMS is considering the possibility that the MA organizations would be required to draw samples on a specified date, or dates, each year. This would ensure that results are directly comparable across plans, would reduce the risk of gaming, and would simplify the ability of beneficiaries to compare provider directory accuracy across plans. CMS also recognizes that there may be certain disadvantages to this approach, including operational constraints related to a specific date, the potential for MA organizations to focus on accuracy efforts for a known date rather than maintaining accuracy on an ongoing basis, and that such an approach limits flexibility for MA organizations. Alternatively, CMS could allow MA organizations to choose the date on which they draw their samples for their specified MA plans. This approach would provide operational flexibility and may reduce the administrative burden associated with sampling, but it would reduce the comparability across plans, increase the risk of gaming, and may increase oversight complexity for CMS. CMS is also considering some hybrid approaches, such as defining a window (for example, one quarter) and randomly assigning a date to an MA organization within that quarter or announcing the date on which the sample should be pulled with minimal advance notice. While CMS has not proposed a specific timeframe for the sample drawing in regulation at this time, CMS seeks comments on these considerations as part of the annual provider directory accuracy analysis and sampling methodology that CMS intends to adopt.

In summary, CMS is proposing to codify the provider directory accuracy analysis requirement at new proposed § 422.123(d)(1) and the sampling methodology for such analysis at new proposed § 422.123(d)(2). CMS solicits comments on these proposed changes.

5. Provider Directory Accuracy Score and Scoring Methodology (§ 422.123(d)(3) and (4))

Section 1857(e)(6)(B)(i) of the Act requires that the Secretary shall specify plan verification methods, such as using telephonic verification or other approaches using data sources maintained by an MA organization or using publicly available data sets, that MA organizations may use for estimating accuracy scores of the provider directory information of specified MA plans offered by such organizations.

To implement these statutory requirements, first CMS proposes to require that MA organizations must estimate an accuracy score reflecting the accuracy of the provider directory information. Furthermore, CMS proposes that the accuracy score must be: (1) estimated using the verification methods specified in new proposed § 422.123(b)(2) for specified provider directory elements, (2) based on the verification results for the random sample specified in new proposed § 422.123(d)(2)(i) and (d)(2)(ii) using the sampling methodology specified in new proposed § 422.123(d)(2)(iii), and (3) represented in the form of a letter grade. CMS proposes to add these provider directory accuracy score requirements at new proposed § 422.123(d)(3).

At new proposed § 422.123(d)(3)(i), CMS proposes to limit what verification method(s) may be used by MA organizations to estimate the provider directory accuracy score, such that certain provider directory elements may only be verified using certain verification methods. CMS notes that this proposed limitation of verification method(s) for certain provider directory elements only applies to MA organizations' verification methods for purposes of estimating the accuracy score at new proposed § 422.123(d)(3), not to the verification methods for the 90-day/12-month verification at new proposed § 422.123(b)(2). At new proposed § 422.123(d)(3)(i)(A), CMS proposes to limit the verification method “internal plan information” to be used only to confirm network participation status (that is, that the provider is currently contracted and participating in that MA plan's provider ( printed page 66422) network) and specialty because it is possible that internal plan information may be dated and contain information about a provider that is not current (for example, an old address). At new proposed § 422.123(d)(3)(i)(B) and (d)(3)(i)(C), CMS proposes to limit the use of the methods “telephonic verification” and “email verification” to the following provider directory elements: specialty; contact information; primary office or facility address(es); whether the provider is accepting new patients; accommodations for people with disabilities; and telehealth capabilities. CMS believes that direct interaction with the provider through telephone or email communication is the most effective way to verify the accuracy of these provider directory elements. CMS has not proposed using telephone or email communication to verify network participation status because telephone and email communication are two verification methods that may cause a higher burden on providers, so considering that network participation can be verified using other verification methods, CMS has not proposed to include that here. Further, CMS proposes that the verification method of provider attestations at new proposed § 422.123(d)(3)(i)(D) would not be limited to any specified provider directory elements. That is, MA organizations would be permitted to use provider attestations to verify any provider directory element. Lastly, CMS proposes that the verification method of claims data at new proposed § 422.123(d)(3)(i)(E) may be used to confirm the provider directory elements of network participation status and specialty. At this time, CMS has not proposed any provider directory elements that can be verified for the purposes of the accuracy score with the verification method “data sources maintained by CMS.” CMS may revisit this verification method with the development of the NPD and may incorporate the NPD as a verification method that may be used for one or more provider directory elements. CMS seeks comments on, for purposes of the accuracy score, whether there are data sources maintained by CMS that commenters recommend for use as reliable sources for any of the provider directory data elements. Finally, if CMS specifies other verification methods in technical guidance, as noted in new proposed § 422.123(b)(2)(vii), then CMS will identify which provider directory elements the verification method may be used for, for purposes of estimating the accuracy score at new proposed § 422.123(d)(3).

CMS understands that certain verification methods depend on a response from a provider, and a provider may not respond. If a provider does not respond to one verification method, another verification method may be used, but it is possible that an MA organization could exhaust the possible verification methods for a specific provider directory data element for their specified MA plan. As part of the sampling methodology that CMS proposes to implement in § 422.123(d)(2), CMS may implement a process for an MA organization to move on to another permitted verification method. For example, a possibility may be that if a provider did not respond within 7 business days, including at least one reminder, then the MA organization may consider that verification method exhausted and move on to another. In the event that all possible verification methods are exhausted for a particular record, CMS seeks comments on whether an MA organization should incorporate a new record into its sample to replace the non-response. The ability to add additional records into the sample if there are non-responses would prevent the sample from becoming so small as to be insufficiently comparable to the samples of other specified MA plans. However, MA organizations may also choose to oversample in order to ensure that sufficient providers respond, which may increase the administrative burden on MA organizations and providers. CMS also understands that some provider specialty types may be more difficult to receive responses from than others, and therefore seeks comments on whether there should be requirements to fill the sample with the same type of provider as a non-responding provider. Given the possibility of non-response, CMS is also considering implementing a minimum response rate that each MA organization must meet for a specified MA plan and requests comments on what that minimum response rate should be. CMS also seeks comments on the provider non-responses and how they should be considered in the sampling methodology and verification methods.

The next provision of the REAL Health Providers Act that CMS is implementing is the provider directory accuracy scoring methodology. Section 1857(e)(6)(B)(ii) of the Act states that with respect to each verification method, the Secretary shall specify a methodology for MA organizations to use in estimating such accuracy scores, and that each such methodology shall take into account the administrative burden on plans and providers and the relative importance of certain provider directory information on enrollee ability to access care.

To describe the proposed provider directory accuracy scoring methodology, CMS will use an example throughout this section. This example is simplified for purposes of illustrating the scoring methodology. For each element in the proposed definition of provider directory information, Table II.B.3 indicates the results of the verification process the MA organization for MA plan Y would follow pursuant to the proposed sampling and verification methodology described in new proposed § 422.123(d)(2) and (d)(3):

( printed page 66423)

CMS proposes using a binary system of “accurate” and “not accurate” for each provider directory data element. Some of the data elements consist of multiple parts that make up the data element. For example, a provider's address may consist of a first address line, a second address line, a city, a state, and a zip code. A provider directory data element should only be considered “accurate” if all of the parts of that provider directory data element are correct. For example, if a provider's address has the correct first address line, city, and state, but wrong second address line and zip code, then the address would be considered “not accurate.” CMS notes that a difference in the address such as the use of the comment abbreviation “st” instead of “street” or “ct” instead of “court” would not prevent an address from being considered accurate as such differences would be considered non-material. CMS proposes this method because the aim of the accuracy score analysis is to see how correct each of the various elements are in the provider directory, and this means that each of the multiple parts that make up the data element must be correct for the whole data element to be correct.

CMS is considering offering a “partial” score if at least half of the multiple parts that make up the provider directory data element are correct. In that methodology, a score of “not accurate” would be 0, and a score of “accurate” would be 1, and if it was partially correct, the score would be “0.5.” In the address example mentioned previously, since 3 of the 5 parts of the data element were correct, that record would receive a score of 0.5 rather than 0. Some drawbacks of this approach are that it may unnecessarily complicate the scoring methodology and perpetuate inaccurate provider directory information. CMS did not propose this methodology but CMS is still actively considering this approach. CMS seeks comments on whether a score should be included for partial accuracy of any of the provider directory data elements.

CMS is also considering a confidence scoring approach to determine the accuracy or inaccuracy of a given provider directory data element. Using a confidence scoring approach, a score of “accurate” or 1 would be assigned to a provider directory data element if such data element matched least two or more verification methods, a score of “partially accurate” or 0.5 would be assigned if a provider directory data element matched at least one verification method, and a score of “inaccurate” or 0 would be assigned if a provider directory data element did not match any attempted verification methods. A concern that CMS identified is that this confidence scoring approach would be more burdensome because it would require validation against multiple sources. CMS has not proposed this methodology, but CMS is still actively considering this approach. CMS seeks comments on whether a confidence scoring approach should be used.

CMS is proposing a weighted provider directory accuracy scoring methodology at new proposed § 422.123(d)(4). CMS proposes to use the weights in Table II.B.4 for each element under consideration.

( printed page 66424)

CMS notes that “provider name,” “common ownership or control disclosure,” and “cultural and linguistic capabilities” are not elements incorporated into the proposed provider directory accuracy scoring methodology. Thus, even though these three provider directory elements are part of the definition of provider directory information as defined in proposed § 422.2, they would not count towards the accuracy score. CMS has not proposed that these elements be part of the accuracy scoring methodology. CMS did not propose to include “provider name” in the proposed provider directory accuracy scoring methodology because CMS believes this element is likely to be correct and is therefore of lower priority to incorporate into the scoring methodology. CMS did not propose to include “common ownership or control disclosure” in the accuracy score methodology because CMS has limited experience with this as a provider directory element and therefore a higher level of uncertainty regarding the burden on MA organizations and providers associated with collecting and maintaining this information. Lastly, CMS did not propose to include “cultural and linguistic capabilities” in the accuracy scoring methodology to reduce burden. This provider directory element may be difficult to consistently evaluate using the binary scoring methodology that CMS proposes. CMS believes that not proposing the inclusion of an element that is likely to contain information of a more varied and open-ended nature may limit some burden associated with the scoring methodology on MA organizations and providers. CMS seeks comments on whether “provider name,” “common ownership or control disclosure,” or “cultural and linguistic capabilities” should be incorporated into the accuracy scoring methodology, or if CMS should request that MA organizations collect data on the accuracy of these elements to inform potential future inclusion of these elements in the accuracy scoring methodology. CMS may consider whether to incorporate this information into future accuracy reporting after evaluating comments and experience with implementation.

CMS is proposing these weights to emphasize the accuracy of certain elements in the provider directory to focus the attention of MA organizations on specific elements most significant to ensuring beneficiaries can access care. CMS proposes a weight of 40 percent for network participation status (that is, per proposed § 422.2, that the provider listed in the directory is a provider with which the MA organization offering the MA plan has an agreement for furnishing items and services covered under such plan) because this is the most foundational piece of information in a provider directory. Beneficiaries expect that the providers listed in the directory are in the MA plan's network, and, as such, beneficiaries expect to be able to access care from these in-network providers at in-network cost sharing. An error in network participation status can lead a beneficiary to unknowingly receive out-of-network care, which may result in higher costs and undermine continuity of care.

CMS proposes a weight of 20 percent for both contact information and primary office or facility address. Beneficiaries and caregivers may frequently rely on contact information from the directory to call the provider to schedule an appointment, and an incorrect phone number creates an immediate barrier for a beneficiary to access care. Beneficiaries and caregivers also need an accurate primary office or facility address to physically reach the provider, so an incorrect address would create an immediate barrier to receiving care. Also, beneficiaries may choose which provider to schedule an appointment with based on the proximity of the address to their home or other places they frequently visit. If the address information is inaccurate, then a beneficiary may inadvertently call or schedule an appointment with a provider at an address that they cannot easily access.

CMS proposes a weight of 10 percent for the provider's specialty. Accurate specialty information helps beneficiaries identify the provider for the beneficiary's particular health care needs. Inaccurate specialty information may lead the beneficiary to contact several providers before one with the correct specialty can be identified, which may slow the beneficiary's access to needed care.

CMS proposes a weight of 3.5 percent whether the provider has accommodations for people with disabilities and has telehealth capabilities. These elements provide important information to beneficiaries as they seek access to care. Beneficiaries with disabilities may need certain accommodations, and knowledge of which providers can accommodate them is integral to their decision making. Knowledge of a provider's telehealth capabilities allows beneficiaries to choose a provider that offers the option for telehealth appointments. While these two elements with the proposed weight of 3.5 percent are meaningful and important for beneficiaries to access needed care, the potential for harm if any of these elements are incorrect is more limited because beneficiaries can still identify and contact providers even if these elements are inaccurate in the provider directory. Also, the accommodations for people with disabilities provider directory element affects a subset of the overall beneficiary population, which justifies a lower proposed weight relative to the universally applicable elements.

CMS proposes a weight of 3 percent for whether the provider is accepting new patients. This element shares a lot of similarities with whether the provider has accommodations for people with disabilities and has telehealth capabilities discussed previously. This is also an element which provides important information to beneficiaries as they seek access to care. Knowing whether a provider is ( printed page 66425) accepting new patients may help beneficiaries identify providers that may have available appointments. In addition, while this element is also meaningful and important for beneficiaries to access needed care, the potential for harm if this element is incorrect is more limited because beneficiaries can still identify and contact providers even if this element is inaccurate in the provider directory. CMS proposes a weight of 3 percent rather than 3.5 percent proposed for whether the provider has accommodations for people with disabilities and has telehealth capabilities because of the three elements, CMS believes whether the provider is accepting new patients may be an element that could change more frequently than other elements and therefore may be a challenging provider directory element for MA organizations to collect and maintain. Recognizing the possible additional burden associated with collecting and maintaining this element for both MA organizations and providers, CMS proposes a slightly lower weight than the other two similar elements. Further, as a practical matter, CMS also wanted to ensure the proposed weights added up to 100 percent, and the most straightforward way to do that was to use weights of 3.5 percent for two elements and 3 percent for one element.

Given these weights, CMS's proposed provider directory accuracy scoring methodology (also described in Table II.B.5) is that first, the MA organization would need to sum the number of accurate records for each element across all providers in the specified MA plan's sample and then divide the number of accurate records for each element by the number of providers in the sample to determine the Accuracy Percentage per Element. Then, CMS proposes that the MA organization would need to multiply the Accuracy Percentage by Element by the Element Weight in Table II.B.5, to determine the Weighted Score per Element. In the example earlier, the accuracy percentage for the element “Network Participation Status” is

5 divided by 6, or 5/6 = 0.833333

and then the weighted score for that element would be

0.833333 multiplied by 0.4, or 0.833333 * 0.4 = .333333.

To determine the Final Composite Score, CMS proposes that the MA organization would need to sum the Weighted Score per Element. Then, CMS proposes that the MA organization would need to multiply the Final Composite Score by 100 to convert to a percentage, then round to the nearest whole number to determine the Rounded Composite Score. As a result, CMS proposes that, to determine the final Provider Directory Accuracy Score, the MA organization would need to convert the Rounded Composite Score to the appropriate letter grade. CMS proposes that 90 percent to 100 percent would be equivalent to a grade of “A,” 80 percent to 89 percent would be equivalent to a grade of “B,” 70 percent to 79 percent would be equivalent to a grade of “C,” 60 percent to 69 percent would be equivalent to a grade of “D,” 50 percent to 59 percent would be equivalent to a grade of “E,” and 49 percent and below would be equivalent to a grade of “F.” Table II.B.5 illustrates this calculation for MA plan Y's scores in the example.

In this example, for MA plan Y, the accuracy score would be a “C” because the Rounded Composite Score is 73 percent. Note that while Table II.B.5 only includes 6 decimal places, CMS proposes that MA organizations should not round to the nearest whole number until they get to the Final Composite Score calculation. That calculation should then be rounded to the nearest whole number and be represented in the form of a percentage as the Rounded Composite Score. CMS is proposing these requirements for the provider directory accuracy scoring methodology in new proposed § 422.123(d)(4).

In developing this proposal, CMS considered a scoring methodology approach that incorporated the proposed verification requirements, described at new proposed § 422.123(b), into the accuracy score. Table II.B.6 shows the sample data for one of the example providers, Jane Doe, with accuracy records from both when the sample was drawn and during the most recent 90-day verification that the MA organization conducted. As seen in Table II.B.6, the results from the accuracy of the provider directory information may be different on the date that the sample is drawn as compared to the date of the 90-day verification.

( printed page 66426)

CMS is considering a methodology in which the MA organization use both records of provider directory accuracy data when they develop the accuracy score. This may provide additional incentives for MA organizations to ensure their verification activities are thorough and also not unduly penalize MA organizations if through most of the year the provider directory information is correct but happened to be incorrect when the sample was drawn. A possible drawback for this approach is that MA organizations could choose the exact timing that they conduct their verification as long as it is consistent with CMS requirements at new proposed § 422.123(b), which may introduce opportunities for gaming, and the resulting accuracy scores may also be less of a direct “apples-to-apples” comparison between specified MA plans given these differences. CMS considered several different ways to incorporate the verification results into the accuracy score methodology. For example, CMS considered incorporating the most recent verification for the provider and also considered incorporating the results from all of the 90-day and 12-month verifications that the MA organization completed. Additionally, CMS considered whether the verification results should be weighed equally with the sample, whether the sample should be weighed more than the verification results, or whether the verification results should be weighed more than the sample. CMS further considered whether specific verification methods would have to be used if the verification results were incorporated into the provider directory accuracy score. For example, CMS considered requiring that only verification results that used the same verification method as the sample could be included. CMS has not proposed incorporating the verification results into the accuracy score at this time because a more complex scoring methodology may increase the burden on MA organizations and providers, but CMS is still actively considering these approaches and interested in comments on whether CMS should consider an accuracy scoring methodology that incorporates the verification results.

CMS is also considering whether certain provider specialty types with high provider directory inaccuracy rates should be weighed in the accuracy score more so than other provider specialty types and whether certain provider specialty types, regardless of whether it is considered a provider specialty type with high provider directory inaccuracy rates, should be weighed in the accuracy score more so than other provider specialty types. A drawback of either of these approaches is that they would likely add additional complexity into the provider directory accuracy scoring methodology. CMS has not proposed either of these approaches but is still considering them and seeks comments on whether accuracy scores should be calculated differently for provider specialty types with high provider directory inaccuracy rates or if scores for certain provider specialty types should be calculated differently regardless of whether it is considered a provider specialty type with high provider directory inaccuracy rates.

CMS is further considering whether geographical considerations should be part of the scoring methodology. CMS is considering whether records in the sample with an address in a rural or CEAC county should have different weights associated with the provider directory data elements or whether some provider directory data elements should not be included in the scoring methodology for records in the sample with an address in a rural or CEAC county. CMS is also considering whether specified MA plans with 75 percent or more of their service area in rural and CEAC counties should have a different scoring methodology than other plans. CMS recognizes that a drawback of this approach may be that it represents less of a direct “apples-to-apples” comparison among specified MA plans and also that it may add additional complexity to the scoring methodology. CMS has not proposed different scoring methodologies based on geographic considerations but is still actively considering this approach. CMS seeks comments on whether different scoring methodologies would be appropriate and if so, how the scoring methodology should differ and what criteria should be used to identify which scoring methodology an MA organization should use when determining its accuracy score for a specified MA plan.

In alignment with the statute, as CMS developed this proposed accuracy scoring methodology, CMS considered the relative importance of certain provider directory information on enrollee ability to access care and the administrative burden of verification on MA organizations and providers. As described at new proposed § 422.123(d)(4), CMS proposes to have a weighted provider directory accuracy scoring methodology, in which provider directory information elements are weighed according to their relative importance for beneficiary access to care. By choosing to weigh specific pieces of information, CMS emphasizes the accuracy of certain elements of provider directory information over others.

In summary, CMS is proposing to codify the provider directory accuracy score requirements at new proposed § 422.123(d)(3) and the provider directory accuracy scoring methodology requirements at new proposed § 422.123(d)(4). CMS solicits comments on these proposed changes. ( printed page 66427)

6. Provider Directory Accuracy Reporting to CMS (§ 422.123(d)(5))

Section 1857(e)(6)(A)(ii) of the Act requires that beginning with plan years beginning on or after January 1, 2028, each MA organization must submit to the Secretary a report containing the results of the analysis conducted under clause (i), including an accuracy score for such provider directory information (as determined using a plan verification method specified by the Secretary under subparagraph (B)(i)).

CMS proposes to codify this requirement at new proposed § 422.123(d)(5)(i), requiring that the MA organization must submit to CMS an annual provider directory accuracy report containing the results of the accuracy analysis for its specified MA plans. CMS proposes that the report must contain the provider directory accuracy score for each specified MA plan. In addition to this basic statutory requirement, CMS is considering requiring additional elements for the annual provider directory accuracy report so that CMS can monitor MA organizations' implementation of the new provider directory accuracy requirements and can issue updated technical guidance taking into account the experience and burden of MA organizations. Furthermore, CMS is also aware of section 6220(b)(3) of the CAA, which states that the Comptroller General of the United States (or the Government Accountability Office, GAO) shall conduct a study and corresponding report including an analysis of the use of cost sharing protections; the trend in provider directory information accuracy scores submitted to CMS, both overall and among providers specializing in mental health or substance use disorder treatment; provider response rates by plan verification methods; administrative costs to providers and MA organizations; and other items determined appropriate by the Comptroller General (or GAO). Therefore, as CMS considers what reporting data to collect from MA organizations, CMS is bearing in mind what information the GAO may be interested in for purposes of the GAO study and corresponding report. Specifically, in addition to the provider directory accuracy score, CMS is considering requiring that the annual provider directory accuracy report also contain elements, including but not limited to provider specialty type response rates by verification method or other sampling data by provider specialty type (including possibly requiring reporting based on the NUCC provider taxonomy code set), estimated administrative costs to the MA organization, estimated administrative costs to the MA organization's contracted providers, and data on the use of cost sharing protections. CMS requests comments on whether these additional reporting elements should be required. CMS will take into account commenters' feedback and may finalize the collection of these additional data elements in the final rule should such an outcome be supported.

In addition, regarding timing for MA organizations' annual submission of the provider directory accuracy report, at new proposed § 422.123(d)(5)(ii), CMS proposes that the report must be submitted not later than the first Monday in April of the year following the contract year being measured, in a form and manner specified by CMS. In proposing this date, CMS intends to give MA organizations at least three months to compile the required information and complete their provider directory accuracy report for the previous contract year. CMS solicits comments specifically on this proposed annual reporting deadline and whether it provides MA organizations with sufficient time. CMS also solicits comments on all aspects of these proposed changes regarding provider directory reporting at new proposed § 422.123(d)(5).

CMS is also considering whether to require that the annual provider directory accuracy analysis and resulting provider directory accuracy score be independently reviewed and certified by a qualified third party prior to submission to CMS. CMS believes that an independent review could promote consistency in the application of the sampling methodology, strengthen confidence in the reported accuracy scores, and provide an additional safeguard against variability in implementation across MA organizations. Similar to other CMS reporting requirements that require independent certification or attestation, the third party would be responsible for evaluating whether the MA organization's analysis was conducted in accordance with CMS requirements and that the reported results reasonably reflect the underlying provider directory information.

CMS seeks comments on whether an independent third-party certification requirement should be adopted, the qualifications such entities should possess, whether certification should be performed under generally accepted attestation or audit standards, and whether CMS should establish independence requirements comparable to those used for other CMS certification and reporting requirements.

7. Exception for Specified MA Plans With Low Enrollment

Section 1857(e)(6)(C) of the Act specifies that the Secretary may waive the requirements of paragraph (e)(6) “Provider Directory Accuracy Analysis and Reports,” in the case of a specified MA plan with low enrollment (as defined by the Secretary). CMS is considering whether to implement this statutory authority to exempt low-enrollment specified MA plans from the annual provider directory accuracy analysis and reporting requirements. Since the statute allows the Secretary to define what low enrollment means, CMS is contemplating various approaches for this definition if the low-enrollment exception were to be implemented. One approach might be to use a threshold for low enrollment that is already used in other areas of the MA program. For example, CMS could potentially apply similar criteria as the existing minimum enrollment threshold for MA plans, such as 500 enrollees for non-special needs plans (non-SNPs) and 100 enrollees for SNPs. Alternatively, CMS could apply similar criteria as is currently used for the Star Ratings threshold, which is 30 enrollees.

Considering these approaches, if CMS implements the low-enrollment exception so that specified MA plans with low enrollment do not have to complete the annual provider directory accuracy analysis and report, then some of the administrative burden on smaller plans may be eased, though all MA organizations offering specified MA plans, including low-enrollment plans, would still be subject to the verification and updating requirements in proposed § 422.123(b) and (c). There would also be a consistency in approach in terms of other areas of the MA program in which low enrollment thresholds are used. However, CMS believes that provider directory accuracy is important for all specified MA plans, regardless of the number of enrollees. It is important to balance the burden on specified MA plans and the need for enrollees to have accurate provider directories to ensure they can access care. CMS is inclined towards making the annual provider directory analysis and reporting requirements applicable to all specified MA plans, regardless of enrollment size, in which case CMS would not implement an exception to these new requirements for specified MA plans with low enrollment. CMS strongly supports the idea that accurate provider directories are important regardless of the plan size. In addition, the fact that ( printed page 66428) some traditionally smaller sized MA organizations tend to offer SNPs, which may include more vulnerable enrollees, leads CMS to believe that a waiver for enrollment size may not be in the best interest of the beneficiary. Taking into account all of these factors, CMS solicits comments on whether and, if so, how to implement the statutory authority to exempt low-enrollment specified MA plans from the annual provider directory accuracy analysis and reporting requirements.

8. Contract Requirement for MA Organizations (§ 422.504(a)(22))

Section 1857(e)(6)(A) of the Act requires that, beginning with plan years beginning on or after January 1, 2028, each CMS contract with an MA organization shall require the MA organization, for each specified MA plan it offers, to annually conduct a provider directory accuracy analysis using a random sample of providers in accordance with subparagraph (A)(i) and submit to the Secretary a report containing the results of such analysis, including a provider directory accuracy score. To codify this statutory requirement, CMS proposes to add new paragraph (a)(22) to the regulations for contract provisions at § 422.504, stating that in the contract between the MA organization and CMS, the MA organization agrees to comply with the provider directory accuracy requirements under § 422.123(d)—for contract year 2028 and subsequent contract years—for each specified MA plan. CMS solicits comments on this proposed change.

9. Provider Directory Public Transparency (§ 422.123(e))

Section 1857(e)(6)(D) of the Act requires that, beginning with plan years beginning on or after January 1, 2029, the Secretary shall post accuracy scores (as reported under subparagraph (A)(ii)), in a machine-readable file, on an internet website maintained by CMS. To codify this public transparency requirement, CMS proposes to add new § 422.123(e), which would state that beginning with contract years beginning on or after January 1, 2029, CMS will post provider directory accuracy scores as reported under paragraph (d)(5) of this section in a machine-readable file on the CMS website. If finalized as proposed, this would mean that in contract year 2029, CMS would post the contract year 2028 provider directory accuracy scores that MA organizations would be required to report to CMS by April 2029 in accordance with proposed § 422.123(d)(5). In addition to this proposed public online posting in a machine-readable file, CMS is considering posting the scores through various Application Programming Interfaces (APIs) that CMS offers. CMS is currently also considering posting the provider directory accuracy scores of MA organizations on the MPF website. CMS solicits comments on this proposed change.

10. Enrollee Cost Sharing Protections When Provider Directories Are Inaccurate (§§ 422.124 and 422.202(f))

Section 1852(d) of the Act establishes provider directory cost sharing protections for enrollees who rely on incorrect provider directory information. Specifically, if a provider is in the provider directory of a specified MA plan on the date an enrollee makes an appointment, but at the time of the appointment when the item or service is furnished by the provider, it is determined that the provider is no longer in-network, then the MA organization must limit enrollee cost sharing to the lesser of the in-network or otherwise applicable cost sharing amount. These protections take effect beginning in contract year 2028 and apply to all subsequent contract years.

To implement the new cost sharing protections contained within section 1852(d) of the Act, CMS proposes to add new regulations at § 422.124, which would outline the scope of the protections, and the process enrollees must follow to access them. The protections would apply under proposed § 422.124(a) and (b) when an enrollee receives services from an out-of-network provider who was listed as in-network in the specified MA plan's directory on the date the appointment was made, and those services would otherwise be covered. In such cases, the MA organization would limit the enrollee's cost sharing to whichever amount is less, the in-network or otherwise applicable cost sharing amount. To initiate the process, the enrollee or their authorized representative would submit a request for the cost sharing protections to the MA organization, which would treat the request as an organization determination or reconsideration request per § 422.124(c). The MA organization would then determine eligibility by: (1) confirming the date the appointment was made per § 422.124(d); and (2) verifying whether the provider appeared in the specified MA plan's online directory on that date per § 422.124(e). If the MA organization cannot obtain the documentation necessary to make that determination from provider documentation, attestation, or a provider directory archive, the protections would be applied in the enrollee's favor per § 422.124(f). Once the MA organization confirmed that the protections apply, the lower cost sharing would be reflected in the enrollee's bill and maximum out-of-pocket (MOOP) calculation consistent with § 422.124(g).

Regarding the scope of the protections, CMS proposes to add § 422.124(a) and (b) providing that the cost sharing protections would apply if an enrollee in a specified MA plan is furnished an item or service from a provider that is not participating in the MA plan's network, but that provider is listed in the MA plan's provider directory as defined in § 422.2 on the date the appointment is made. The protections apply if the item or service would otherwise be covered under the MA plan if furnished by an in-network provider. In such cases, the MA organization offering the MA plan must ensure that the enrollee pays no more than the lesser of either: (1) the amount of cost sharing that would apply if the provider had been participating in the network of the plan; or (2) the amount of cost sharing that would otherwise apply.

CMS proposes adding § 422.124(c) to require the MA organization to apply the provider directory cost sharing protections without requiring an enrollee request when the MA organization knows or reasonably should know that the protections apply. In other words, if an enrollee or authorized representative references the use of incorrect provider directory information when requesting an organization determination or reconsideration for an out-of-network cost sharing bill but does not appear to be aware of the provider directory cost sharing protections, the MA organization must inform the enrollee of the available protections and evaluate whether the protections apply to the claim or claims. CMS also proposes to permit an enrollee or the enrollee's authorized representative to request application of the protections verbally or in writing to their MA organization. CMS proposes at § 422.124(c)(1) that such requests would be processed as organization determinations or reconsideration requests, as applicable, consistent with subpart M of this part. Consistent with current practice, when an enrollee or provider believes an item or service may not be covered, or could be covered only under specific conditions, a pre-service organization determination should be requested from the MA organization. If the item or service is denied, the standardized ( printed page 66429) denial notice must include information about the enrollee's appeal rights.

To confirm the date on which the appointment was made, CMS proposes to require at § 422.124(d) that MA organizations include a term in each provider contract for a specified MA plan obligating the provider to supply documentation of the earliest date on which the enrollee's appointment was scheduled, regardless of any subsequent rescheduling. For example, if an enrollee makes an appointment on April 12, 2028, and reschedules the appointment on May 15, 2028, the MA organization would look at the provider directory on April 12, 2028, to see if the provider was listed as in-network. At § 422.124(d), CMS proposes that acceptable documentation would include a paper or electronic record from the provider's scheduling system or confirmation sent to the enrollee or their authorized representative from the provider. If a record of the date the appointment was made is not reasonably obtainable, a signed attestation from the provider, accompanied by any available corroborating information such as a calendar entry, a referral record, electronic communications, or a phone log, if available would be sufficient to show the approximate date the appointment was made. CMS proposes that this contract term survives the expiration or termination of the contract between the MA organization and the provider for not less than 10 years, beginning on the date the contract expiration or termination becomes effective, thereby ensuring that providers who were previously participating in the specified MA plan's network remain obligated to supply documentation regarding the date on which the enrollee's appointment was made, even after departing from the network.

In order to verify the accuracy of the provider directory, at § 422.124(e) CMS proposes to add a requirement that the MA organization would determine whether the provider was listed as an in-network provider in the specified MA plan's online provider directory on the date the appointment was made by referencing archived electronic provider directory data maintained online by the MA organization. Archived provider directory data must be sufficient to identify whether any provider was listed in the specified MA plan's online directory at any point on a given date, retained for not less than ten years consistent with § 422.504(d), and made available to CMS upon request within 5 business days. If the archived provider data provided indicates that the provider in question was listed in the specified MA plan's online provider directory at any point during a given day, whether in the morning or later in the afternoon, the provider would be considered to have been listed in the online directory for that entire day for the purpose of determining whether the cost sharing protections apply. In addition, a notice that the provider information may be outdated, per the requirement at new proposed § 422.123(b)(3) in this proposed rule, would not affect an enrollee's eligibility for the cost sharing protections.

CMS solicits comments on whether the provider directory data used to determine whether the cost sharing protection applies should be limited to the online provider directory as proposed here, or whether the cost sharing policy should similarly apply to the contents of a physical hardcopy of the provider directory upon which an enrollee relied given that MA organizations have an obligation to provide enrollees with a physical hardcopy of a current provider directory upon request in accordance with § 422.2267(d). For example, under the proposed requirement at § 422.123(c)(2), an MA organization must send a quarterly addendum with provider directory updates to all enrollees who have requested a physical hardcopy provider directory. CMS is seeking comments on whether, under this proposed framework, an enrollee who uses the most current physical hardcopy directory available (that is, a physical hardcopy version with up-to-date addenda) to schedule an appointment—even if that physical hardcopy differs from the online directory on the date of the appointment—should qualify for the cost sharing protections described in proposed § 422.124. CMS also solicits comments on the duration of the proposed data retention requirement and whether MA organizations should be required to publicly post daily versions of their provider directories instead of being made available to CMS upon request within 5 business days as proposed. CMS believes that inclusion of such a requirement may be necessary to ensure accuracy and ease the review of archived provider directories. Finally, CMS seeks public comment on whether formatting requirements for archived provider directory information should be established, such as through a log of provider updates or removals or another auditable archive sufficient to identify the directory status of a provider on a given date.

CMS proposes at § 422.124(f) that if the MA organization is unable to obtain documentation demonstrating the date on which the appointment was scheduled or is unable to verify archived provider directory data within the applicable standard or expedited organization determination timeframes provided under 42 CFR 422 subpart M, the provider directory cost sharing protections must be applied in favor of the enrollee. This default application may be reversed only if the MA organization is able to clearly demonstrate that the cost sharing protections do not apply.

To apply the cost sharing protections, at § 422.124(g)(1) CMS proposes that if the MA organization collects cost sharing from an enrollee in excess of the amount permitted under the provider directory cost sharing protections, and the protections apply, the MA organization must refund the excess amount to the enrollee consistent with § 422.270(b). Additionally, when the protections apply and a refund is issued, at § 422.124(g)(2) CMS proposes that MA organizations treat that cost sharing as in-network cost sharing for purposes of any applicable MOOP limit, consistent with § 422.100(f)(4).

The purpose of the cost sharing protections created by the REAL Health Providers Act is to protect MA enrollees who rely on the provider directory of a specified MA plan to schedule an appointment with an in-network provider and later discover that the provider is out-of-network. The following example illustrates a scenario when the cost sharing protection would apply. An MA enrollee needs to see a cardiologist, checks their MA plan's online provider directory, and finds Dr. Smith listed as an in-network provider. On January 5, 2028, they schedule an appointment with the provider's office for March 6, 2028. The enrollee receives items and services from Dr. Smith on March 6, 2028, and subsequently receives an EOB reflecting cost sharing at the out-of-network rate, higher than the in-network rate the enrollee expected. The enrollee contacts their MA organization to see why the bill is so high and explains that the doctor was listed on their plan's provider directory at the time the appointment was made. The MA organization educates the enrollee about the provider directory cost sharing protections and offers to determine whether the enrollee qualifies. The enrollee agrees and the MA organization works with the enrollee's provider's office to confirm the appointment was made on January 5, 2028, and verifies via its archived provider directory data that Dr. Smith was listed as in-network on the same date. The MA organization then applies the protections, capping the enrollee's ( printed page 66430) cost sharing at the in-network rate, refunding any excess cost sharing the enrollee may have already paid, and counts the cost sharing toward the enrollee's in-network MOOP limit.

Notably, if Dr. Smith's office has no scheduling records available or an archive of the plan directory was unavailable, the MA organization would still be required to apply the protections in the enrollee's favor unless the MA organization was able to clearly demonstrate that the cost sharing protections do not apply, such as proof that the provider was never in the specified MA plan network.

These proposed requirements are designed to strengthen enrollee protections and reduce the risk of unexpected higher out-of-network costs resulting from inaccurate provider directory information. CMS believes these proposals align with the statutory goal of ensuring all enrollees have timely access to the new cost sharing protections and incentivizing MA organizations to maintain accurate and up-to-date directories on an ongoing basis. CMS proposes that the burden of proof for determining whether these protections apply rests with the MA organization, not the enrollee, and that MA organizations must make reasonable, good-faith efforts to gather all relevant documentation prior to rendering an eligibility determination from the provider consistent with the contract term requirements at § 422.124(d). The impact of the proposed policy changes is discussed in the Collection of Information Requirements and Regulatory Impact Analysis under sections III.A. through D. and IV.A. through K. of this proposed rule, respectively. CMS seeks comments on ways to improve enrollee access to the cost sharing protections, the operational feasibility of these requirements, including the processes MA organizations would use to verify whether an enrollee relied on directory information at the time an appointment was made, and whether additional documentation or verification standards are necessary to ensure the integrity and effective administration of these protections.

11. Provider Directory Disclosure Requirements (§§ 422.111(b)(3)(i), (b)(12), and (k) and 422.120(b)(1))

The REAL Health Providers Act also affects CMS's current MA disclosure requirements. First, section 1852(c)(1)(C) of the Act requires MA organizations, for plan year 2028 and subsequent plan years, in the case of a specified MA plan, to disclose to enrollees the information described in paragraph (c)(3)(B) (that is, provider directory information). CMS's current regulatory text corresponding to this section of the statute is located at § 422.111(b)(3)(i). where the disclosure requirement for the provider directory currently states “the number, mix, and distribution (addresses) of providers from whom enrollees may reasonably be expected to obtain services; each provider's cultural and linguistic capabilities, including languages (including American Sign Language) offered by the provider or a skilled medical interpreter at the provider's office.”

To codify the new provider directory disclosure requirement in the statute, CMS proposes to amend § 422.111(b)(3)(i) to include both phrases “the number, mix, and distribution of providers from whom enrollees may reasonably be expected to obtain covered benefits” and “provider directory information as defined in § 422.2 and in accordance with § 422.2267(e)(11).” The reason for the proposed removal of “(addresses)” is to avoid duplication because the proposed definition of provider directory information at § 422.2 includes “Primary office or facility address(es) where covered items or services are furnished” as one of the proposed required pieces of information. Further, CMS's proposed cross-reference to the definition of provider directory information at § 422.2 aligns with the statute, and the additional proposed cross-reference to § 422.2267(e)(11) would ensure that provider directory requirements related to timing of required disclosure, verification, and updates are also captured. In addition, as discussed in section II.B.1. of this proposed rule, CMS is proposing to remove the phrase “each provider's cultural and linguistic capabilities, including languages (including American Sign Language) offered by the provider or a skilled medical interpreter at the provider's office” from § 422.111(b)(3)(i). CMS believes that the codification of the statutory term “cultural and linguistic capabilities” from section 1852(c)(3)(B) of the Act for the proposed definition of “provider directory information” at § 422.2 suffices. For ease of reading of the regulatory text, CMS's proposal at § 422.111(b)(3)(i) includes a breakdown of the different disclosure elements in the form of paragraphs (b)(3)(i)(A) through (E), wherein “the number, mix, and distribution of providers from whom enrollees may reasonably be expected to obtain covered benefits” and “provider directory information as defined in § 422.2 and in accordance with § 422.2267(e)(11)” would be located at proposed subparagraphs (b)(3)(i)(A) and (B), and the remaining subparagraphs would contain existing § 422.111(b)(3)(i) regulatory text that CMS is not proposing to modify.

The REAL Health Providers Act also establishes provider directory disclosure requirements related to the cost sharing protections and the accuracy score. First, section 1852(d)(7)(B)(i) and (ii) of the Act requires that for plan year 2028 and subsequent plan years, each MA organization that offers a specified MA plan shall: (1) notify enrollees of their cost sharing protections under this paragraph and make such notifications, to the extent practicable, by not later than the first day of an annual, coordinated election period under section 1851(e)(3) of the Act with respect to a year; and (2) include information regarding such cost sharing protections in the provider directory of each specified MA plan offered by the MA organization. Second, section 1851(d)(4)(F) of the Act requires that, beginning with plan years beginning on or after January 1, 2029, in the case of a specified MA plan, the accuracy score of the plan's provider directory (as reported under section 1857(e)(6)(A)(ii) of the Act) must be listed prominently on the MA plan's provider directory.

To codify these new provider directory disclosure requirements, CMS is proposing to add new paragraph (b)(12) to § 422.111, titled “Cost sharing protections and accuracy score in provider directory.” In new proposed § 422.111(b)(12), each MA organization offering a specified MA plan would be required to disclose, in a form and manner specified by CMS, information within the provider directory regarding cost sharing protections and accuracy, including: (1) for contract year 2028 and subsequent contract years—by no later than the first day of the annual coordinated election period under § 422.62(a)(2)—a plain-language description of the enrollee cost sharing protections required under § 422.124; and (2) for contract year 2029 and subsequent contract years, the most recent provider directory accuracy score reported to the Secretary in accordance with § 422.123(d)(5), prominently displayed. Pursuant to CMS's current regulations at § 422.2267(e)(11), MA organizations are required to provide the provider directory to current enrollees no later than the start of the annual coordinated election period. Thus, by including the specified cost sharing protection and accuracy information to enrollees in the provider directory as proposed in ( printed page 66431) § 422.111(b)(12), CMS is proposing that MA organizations would also be considered to satisfy the statutory requirement under section 1852(d)(7)(B)(i) of the Act that such notification must be made by MA organizations, “to the extent practicable, by not later than the first day of an annual, coordinated election period under section 1851(e)(3) of the Act with respect to a year.”

For the proposed disclosure requirement at new proposed § 422.111(b)(12)(ii) that the MA organization prominently display the most recent provider directory accuracy score, CMS believes the most appropriate place for the accuracy score would be at the end of the introduction to the provider directory, before the list of network providers. In addition, CMS believes that providing a simple explanation alongside the accuracy score would be sufficient, for example, “Information Accuracy: [insert letter grade score]. We have rated this directory based on how correct the information we provide is. We always aim to give you the most accurate details possible.” If § 422.111(b)(12) is finalized as proposed, then CMS intends to update the Medicare Advantage and Section 1876 Cost Plan Provider Directory Model and Instructions with similar template language for the new disclosure requirements for the provider directory.

In addition, consistent with section 1852(d)(7)(B)(iii) of the Act, CMS is proposing to amend the heading of § 422.111(k) to clarify that the paragraph addresses the Explanation of Benefits (EOB) and add § 422.111(k)(6) to require that a notification about the cost sharing protection be included in the first EOB issued in a plan year.^[9] CMS proposes that the first EOB issued in a plan year for each specified MA plan would include a plain-language description of the provider directory cost sharing protections available to enrollees under § 422.124; a toll-free telephone number and website URL through which an enrollee or their representative may request application of the protections, and information describing how an enrollee or their representative may request a correction if cost sharing was applied in a manner inconsistent with those protections. If § 422.111(k)(6) is finalized as proposed, then CMS intends to update the EOB model document with template language, such as “If you receive items or services from an out-of-network provider who was listed in your plan's provider directory as in-network on the date your appointment was made, and those services would otherwise be covered, your cost sharing is limited to the in-network cost sharing amount.” In addition, CMS would update the Medicare Advantage and Section 1876 Cost Plan Provider Directory Model and Instructions with similar template language regarding the enrollee cost sharing protections if § 422.111(b)(12)(i) is finalized as proposed. CMS has also considered adding notification about the cost sharing protection in the Summary of Benefits (SB) as well as the Evidence of Coverage (EOC), as that would ensure that beneficiaries receive both pre-enrollment (via the SB) and post-enrollment (via the EOC) notification. CMS solicits comments on including the notification in these two additional materials.

Lastly, after reviewing all existing provider directory sections in the regulation, CMS believes that a conforming change to the provider directory API requirements at § 422.120(b)(1) is necessary to ensure consistency in regulatory language. Currently, § 422.120(b)(1) requires that the API must provide a complete and accurate directory of the MA plan's network of contracted providers, including “names, addresses, phone numbers, and specialties, updated no later than 30 calendar days after the MA organization receives provider directory information or updates to provider directory information.” CMS proposes to amend § 422.120(b)(1) to remove the references to names, addresses, phone numbers, specialties, and the 30-day updating requirement, and replace this information with cross-references to the proposed definition for provider directory information at § 422.2 and the proposed provider directory verification and updating requirements at new proposed § 422.123(b) and (c). This proposed modification simplifies the regulatory text, ensures consistency, and avoids the need to update regulatory language in multiple sections in the future. CMS believes that this change is also a productive step towards ensuring that the proposed definition of provider directory information at § 422.2 is applied consistently to all formats of the provider directory (including the API) that an MA organization produces.

In summary, CMS is proposing to codify the provider directory disclosure requirements at § 422.111(b)(3)(i), (b)(12), and (k), and to make a conforming change to the provider directory API requirements at § 422.120(b)(1). CMS solicits comments on these proposed changes.

12. Conclusion

As discussed in section II.B. of this proposed rule, CMS believes that the accuracy scoring and verification framework required under the REAL Health Providers Act will serve to strengthen the integrity of the underlying provider data that both MPF and the NPD will likely come to depend upon, helping to ensure a consistent and reliable foundation for the larger health tech ecosystem. In addition, CMS recognizes that the data flow contemplated under this framework—in which MA organizations submit data to CMS, the NPD conceivably ingests that data and may enrich that data from additional sources, and MA organizations then publish NPD-informed directories—could raise questions about the appropriate scope of MA organization accountability for accuracy scores. CMS wishes to clarify that MA organization accountability under the REAL Health Providers Act as proposed herein attaches to the data the MA organization submits, verifies, and attests to, and to the rigor of the MA organization's own verification processes, rather than to data elements that may be added or modified by the NPD from sources outside the MA organization's control. MA organizations will retain an independent obligation under the REAL Health Providers Act to verify their provider directory information on the prescribed cycle as defined under § 422.123(b), if finalized. In addition, as CMS's various provider directory initiatives mature, CMS anticipates a process that will allow MA organizations to reconcile any discrepancies between NPD-returned data and their own verified records prior to publication if such discrepancies are identified. CMS will provide further guidance on the delineation of accountability between MA organization-originated and NPD-enriched data elements as the NPD infrastructure continues to be developed, implemented, and operationalized. This delineation of accountability approach could possibly include a safe-harbor component, as NPD infrastructure matures to be able to accept validated data programmatically from health care providers and organizations.

CMS seeks comments on whether this proposed approach effectively integrates the REAL Health Providers Act requirements with the existing § 422.111(m) framework and the developing NPD initiative in a way that is practical and achieves the statute's goals. CMS is particularly interested in ( printed page 66432) whether any conflicts or gaps exist among these three frameworks that this proposed implementation does not adequately address, and whether additional guidance is needed prior to the contract year 2028 effective date of the REAL Health Providers Act mandates. More broadly, CMS welcomes input on any aspects of provider directory accuracy, verification burden, data standardization, or beneficiary transparency that interested parties believe CMS has not fully considered, including potential specific mechanisms for an effective technology-based safe harbor that allows for the NPD to mediate accountability.

C. Modernizing and Ensuring PBM Accountability (Section 6224 of the Consolidated Appropriations Act, 2026)

1. Background

Section 6224 of CAA (Pub. L. 119-75, enacted February 3, 2026) added sections 1860D-12(h) and 1857(f)(3) of the Act, which establish new and enhanced requirements under the Medicare Part D program that address, among other issues, compensation and data transparency for pharmacy benefit managers (PBMs). CMS is proposing to implement these requirements through this rulemaking.

PBMs provide services such as drug price negotiation, prescription claims adjudication, formulary development, and pharmacy network contracting for insurance plans, including Part D plan sponsors that manage the Part D prescription drug benefit. Federal agencies, academics, and others have raised concerns that PBM business practices and corporate structure have contributed to the high cost of prescription drugs in the United States.^[1]

In 2022, the Federal Trade Commission (FTC) issued special orders pursuant to section 6(b) of the Federal Trade Commission Act to the six largest PBMs to gather information about their business practices. After studying the information received, the FTC released two reports: a 2024 report titled “Pharmacy Benefit Managers: The Powerful Middlemen Inflating Drug Costs and Squeezing Main Street Pharmacies” and a 2025 report titled “Specialty Generic Drugs: A Growing Profit Center for Vertically Integrated Pharmacy Benefit Managers.” ¹⁰ These reports discussed several concerning aspects of the PBM industry, including a market featuring a high degree of concentration and vertical integration (with the three largest PBMs, which are integrated with both pharmacies and health plans, processing about 80 percent of prescription drug claims in the United States), higher payment rates for pharmacies that are affiliated with PBMs (especially specialty pharmacies) compared to unaffiliated pharmacies, opaque contract terms that disadvantage smaller and independent pharmacies, formulary placement decisions that favor higher-cost branded drugs over generics in exchange for higher rebates, and significant spread pricing in which PBMs retain a portion of the amount that a health plan pays the PBM for a drug rather than passing on the full amount to the pharmacy for specialty generics.

The FTC reports also expressed concern with PBM-affiliated rebate aggregators, also referred to as PBM group purchasing organizations (PBM GPOs), which do not function as traditional GPOs but rather as spin-off entities to which PBMs have shifted the function of rebate negotiation with pharmaceutical manufacturers. There are three PBM GPOs in this category, affiliated with the three largest PBMs in the United States. The first FTC report ¹¹ referenced previously discussed the recent formation of these entities—which the FTC noted likely occurred in an attempt to take advantage of the antikickback safe harbor for GPOs. The FTC issued supplemental orders to collect information from those three PBM GPOs in 2023 but noted in its second report that the PBM GPOs had provided only a partial response to these orders.^[12] While PBM GPOs themselves are relatively new, they are representative of a consistent pattern of utilization of complex affiliate structures and vertical and horizontal integration in the PBM industry and demonstrate PBMs' ability to adapt in the face of changing legislative and regulatory dynamics.

Academics have similarly raised concerns with PBMs' impact on the price of drugs. Revenue retained by PBMs at several points in the pharmaceutical supply chain—including pharmacy spread pricing, retention of a portion of the rebate negotiated with the pharmaceutical manufacturer, and increasing ownership of 340B contract pharmacies—is often not transparent to health plans and may contribute to high drug prices.^[13] Because PBM compensation is often linked to the price of the drug, there are perverse incentives for PBMs to favor higher cost drugs; ^[14] one recent article estimated that if compensation for wholesalers, pharmacies, and PBMs were delinked from list prices, net drug spending could be reduced by approximately 15 percent.^[15] As similarly noted by the FTC, the PBM market is also highly concentrated and vertically integrated; almost all major PBMs operate their own mail order or specialty pharmacies (and some retail pharmacies), and the largest health insurers in the country either own PBMs or share a common ownership structure with PBMs.^[16]

In addition to the reports that the FTC has issued following its issuance of 6(b) orders, the FTC has also filed lawsuits against the three largest PBMs and their affiliated PBM GPOs in September 2024, alleging that their rebating practices for insulin products were anticompetitive, unfair, and artificially inflated list prices. Specifically, the FTC claimed that PBMs gave insulin products with higher list prices favorable formulary placement due to the potential to extract and retain higher rebates and price-linked fees associated with such products, which caused pharmaceutical manufacturers to artificially inflate list prices and prevented patients from accessing insulin products with lower list prices and lower cost-sharing. The FTC reached settlements with two of the PBMs—Express Scripts, Inc. (ESI), announced in February 2026,^[17] and Caremark, announced in July 2026.^[18] The proposed ESI consent order include requirements to prohibit formulary placement on the basis of wholesale acquisition cost (WAC) (also known as list price), to pass through rebates at the point of sale so that they will be incorporated into patient cost-sharing, to provide a standard offering to plan sponsors allowing them to transition away from rebate guarantees and spread pricing, to delink fees paid from ( printed page 66433) pharmaceutical manufacturers to PBM GPOs from drug prices, and to maintain PBM GPO activities in the United States (two of the three major PBM GPOs had been established off shore), among other requirements.^[19]

CMS has already made some efforts to address PBM practices in Medicare. In the May 9, 2022, Federal Register (87 FR 27704), we addressed opaque performance-based penalties and price concessions from pharmacies that PBMs sometimes applied after the point of sale, preventing pharmacies from having access to predictable, transparent payment structures. CMS analysis showed that pharmacy price concessions grew more than 107,400 percent between 2010 and 2020. These practices rendered prescription drug prices less transparent and less representative of the actual amount the plan sponsor paid to the pharmacy for the drug dispensed. The new requirements, finalized in the final rule, “ Medicare Program; Contract Year 2023 Policy and Technical Changes to the Medicare Advantage and Medicare Prescription Drug Benefit Programs,” restructured the financial relationship between plan sponsors, PBMs, and pharmacies by mandating transparency for all pharmacy price concessions at the point of sale.

The new requirements changed the definition of the negotiated price for a covered Part D drug at 42 CFR 423.100 to include all pharmacy price concessions at the point of sale, and not just those that could be reasonably determined at the point of sale. Beginning in 2024, a patient's cost share is based on the lowest possible reimbursement that a pharmacy could receive for that drug. CMS has noted a significant decrease in plan-reported pharmacy price concessions. Pharmacy direct and indirect remuneration (DIR) changed from a positive amount in CY 2023 (meaning Part D plan sponsors and PBMs recouped more from pharmacies in price concessions than they paid to pharmacies in bonus payments) to a negative amount in CY 2024 (meaning Part D plan sponsors and PBMs recouped less from pharmacies in price concessions than they paid to pharmacies in bonus payments).^[20] Pharmacy payment for covered Part D drugs is now more transparent and predictable for pharmacies.

Section 6224 of the CAA builds on prior efforts to address PBM practices. The law introduces enhanced requirements for remuneration that PBMs may receive for services in connection with the utilization of covered Part D drugs. Generally, section 6224 of the CAA requires that such remuneration be restricted to bona fide service fees that may not be tied to the price of a drug or the rebates, discounts, or other price concessions negotiated. The law also introduces requirements for increased transparency, such as a new requirement for PBMs to report certain information such as drug prices and utilization, DIR, formulary placement of branded and generic drugs, information about payment rates at affiliated and unaffiliated pharmacies, and information on affiliates and brokers, to both Part D plan sponsors and the Secretary of Health and Human Services (HHS) annually. These requirements are to be effectuated through written agreements between Part D plan sponsors—inclusive of both sponsors offering standalone Part D prescription drug plans (PDPs) and sponsors offering Medicare Advantage prescription drug (MA-PD) plans that combine Medicare Advantage and Part D prescription drug benefits—and PBMs beginning with contract year 2028.

An overview of the new requirements included in section 6224 of the CAA related to Part D plan sponsor contract requirements and federal oversight and enforcement mechanisms is provided later in this section, as well as a summary of the proposed policies that are required to implement this law. The remainder of this discussion is organized to address the major provisions of the law in more detail.

• Section II.C.2. of this proposed rule defines key terms.
• Section II.C.3. of this proposed rule discusses the definition of a pharmacy benefit manager.
• Section II.C.4. of this proposed rule discusses the definition of an affiliate.
• Sections II.C.5 through C.10. of this proposed rule discuss remuneration and transparency requirements of the written agreement between Part D plan sponsors and PBMs acting on behalf of such sponsors.
• Section II.C.11. of this proposed rule addresses additional compliance and enforcement mechanisms available to Part D plan sponsors and CMS.
• Section II.C.12. of this proposed rule addresses confidentiality of information shared under the new requirements of the CAA.
• Section II.C.13. of this proposed rule addresses severability.

a. Overview of Part D Plan Sponsor Contract Requirements for Written Agreements With PBMs

Section 6224 of the CAA amended section 1860D-12 of the Act by adding a new subsection (h)(1), which specifies that beginning with contract year 2028, any Part D plan sponsor with a contract under section 1860D-12 of the Act to offer a prescription drug plan must have a written agreement, containing certain requirements, with any PBM acting on its behalf. The requirements that must be in the written agreement with the PBM address remuneration derived by PBMs and their affiliates in connection with the utilization of Part D drugs, transparency regarding guarantees and cost performance evaluations, reporting of information by PBMs to Part D plan sponsors and the Secretary, and enforcement mechanisms provided to the Part D plan sponsor. We briefly describe each of the topics that the written agreement between the Part D plan sponsor and the PBM must address; each topic is addressed in greater detail in subsequent sections of this rule.

(1) Remuneration

Section 1860D-12(h)(1)(A)(i) of the Act, as added by the CAA, generally requires that PBMs and any affiliates of such PBMs not derive any remuneration with respect to any services provided on behalf of any entity or individual, in connection with the utilization of covered Part D drugs, other than bona fide service fees. Included in the definition of bona fide service fees is that such fees must be flat dollar amounts, reflective of fair market value (as specified by the Secretary through notice and comment rulemaking), for an itemized service, and that they may not be contingent on the amount of rebates, discounts, fees, or other direct or indirect remuneration; drug price; coverage or formulary placement; and any other amounts or methodologies prohibited by the Secretary.

There are certain exceptions to the requirement that PBMs and their affiliates only receive remuneration in the form of bona fide service fees. First, section 1860D-12(h)(1)(A)(ii) of the Act allows PBMs or their affiliates to receive incentive payments paid by a Part D plan sponsor if they meet certain requirements. Second, section 1860D-12(h)(1)(A)(iii) of the Act provides that rebates, discounts, or other price concessions received by a PBM or an affiliate of a PBM from manufacturers are not considered a violation of the bona fide service fee requirement if they are fully passed through to a Part D plan ( printed page 66434) sponsor and are compliant with all regulatory and sub-regulatory requirements related to DIR for manufacturer rebates, discounts, and other price concessions. Third, these remuneration requirements do not prohibit flat dispensing fees or reimbursement or payment for ingredient costs to PBMs or affiliates of PBMs that acquire or dispense prescription drugs, nor do they modify regulatory requirements or sub-regulatory program instruction or guidance related to pharmacy payment, reimbursement, or dispensing fees, in accordance with the rule of construction at section 1860D-12(h)(4) of the Act.

Section 1860D-12(h)(1)(A)(iv) of the Act requires that components of subsets of remuneration agreements between PBMs or their affiliates and other entities involved in the dispensing or utilization of covered Part D drugs be subject to review by the Secretary, in consultation with the Office of the Inspector General of the Department of Health and Human Services, as determined appropriate by the Secretary, for consistency with fair market value. It also requires that the PBM disgorge any remuneration received by the PBM or its affiliate that is in violation of the requirements added by the CAA to the Part D plan sponsor.

(2) Transparency

The CAA also introduces new requirements regarding transparency that must be reflected in the written agreements between Part D plan sponsors and PBMs. Part D plan sponsors must include in their written agreements with PBMs a requirement that PBMs “define, interpret, and apply” terms in a fully transparent and consistent manner for purposes of evaluating PBM performance against pricing guarantees or similar cost performance measurements. Pricing guarantees are agreements under which PBMs guarantee Part D plan sponsors a certain price for drugs—often represented as a percent off list price for specific categories of drugs, such as brand, generic, or specialty drugs—and either retain or reimburse the Part D plan sponsor for the difference between that price and the actual price negotiated with a pharmacy. As discussed later in this rule, PBMs' interpretation of certain terms such as `generic' or `specialty' can significantly impact their ability to retain revenue through price guarantees.

Section 1860D-12(h)(1)(C) of the Act, as added by the CAA, requires that PBMs annually submit a report to the Part D plan sponsor and the Secretary of HHS beginning no later than July 1 of 2028. This report is to include information on dispensed drugs covered by the plan, information about affiliate pharmacies, information on cost-sharing and formulary placement for reference listed drugs and reference products compared to their generic or biosimilar biological products, plan spending, PBM remuneration, benefit design parameters, information on brokers and consultants, and a list of affiliates.

Finally, PBMs must also provide a written explanation of certain information to Part D plan sponsors within 30 days of finalization of a contract or agreement between the PBM or an affiliate of the PBM and a manufacturer that makes rebates, discounts, payments, or other financial incentives related to one or more covered Part D drugs or other prescription drugs, as applicable, directly or indirectly contingent upon coverage, formulary placement, or utilization management conditions on any other covered Part D drugs or other prescription drugs.

(3) Enforcement by the Part D Plan Sponsor

In addition to the previous requirements, the CAA also requires that the written agreement between the Part D plan sponsor and PBM include certain mechanisms that the Part D plan sponsor may use to enforce the new requirements. Section 1860D-12(h)(1)(D) of the Act, as added by the CAA, requires that not less than once a year, at the request of the Part D plan sponsor, the PBM allow for an audit of the PBM to ensure compliance with all terms and conditions of the written agreement. Additionally, sections 1860D-12(h)(2)(A)(ii) and (iii) of the Act provide that the written agreement between the Part D plan sponsor and the PBM must require that the PBM or any affiliate of such PBM reimburse the Part D plan sponsor for any civil money penalty imposed on the Part D plan sponsor as a result of the failure of the PBM or affiliate to meet the requirements of section 1860D-12(h)(1) of the Act that are applicable to the PBM or affiliate, and must require in a written agreement with the PBM that the PBM or its affiliate be subject to punitive remedies for breach of contract for failure to comply with the requirements under section 1860D-12(h)(1) of the Act.

b. Overview of Federal Enforcement and Compliance Mechanisms

Sections 1860D-12(h)(2) and (3) of the Act, as added by the CAA, introduce certain enforcement and compliance mechanisms related to section 1860D-12(h) of the Act. Section 1860D-12(h)(2)(A)(i) of the Act requires that each Part D plan sponsor shall disgorge to the Secretary any amounts disgorged to the Part D plan sponsor by a PBM due to violations of the remuneration requirements under section 1860D-12(h)(1)(A) of the Act. Additionally, section 1860D-12(h)(2)(B) of the Act specifies that the Secretary shall make available and maintain a mechanism for manufacturers, Part D plan sponsors, pharmacies, and other entities that have contractual relationships with PBMs or their affiliates to report, on a confidential basis, alleged violations of section 1860D-12(h)(1)(A) or (C) of the Act to the Secretary. Section 1860D-12(h)(2)(C) of the Act requires that a Part D plan sponsor shall not retaliate against an individual or entity for such reporting of an alleged violation, nor coerce, intimidate, threaten, or interfere with the ability of an individual or entity to report any such alleged violations. In addition, section 1860D-12(h)(3) of the Act requires that each Part D plan sponsor furnish to the Secretary an annual certification of compliance with section 1860D-12(h) of the Act, as well as information the Secretary determines necessary to carry out section 1860D-12(h) of the Act; the Secretary may implement this requirement by program instruction.

c. Summary of Proposed Policies Related to Section 6224 of the CAA

CMS is proposing to implement section 1860D-12(h) of the Act as follows:

• Proposed § 423.2800 establishes the basis and scope of the new subpart BB, titled “Modernizing and Ensuring Pharmacy Benefit Manager Accountability.”
• Proposed § 423.2802 defines several key terms that are set forth in the statute and warrant additional definition to effectively implement the law and clearly delineate its applicability.
• Proposed §§ 423.2804 and 423.2806 provide further detail on the definitions of PBM and affiliate.
• Proposed § 423.2808 describes the contractual requirements for Part D plan sponsors, further described in subsequent sections.
• Proposed § 423.2810 addresses requirements related to remuneration, including specifying fair market value for bona fide service fees and incentive payments.
• Proposed § 423.2812 establishes requirements for PBMs to provide transparency regarding guarantees and cost performance evaluations. ( printed page 66435)
• Proposed § 423.2814 establishes requirements for PBMs to report information to Part D plan sponsors and the Secretary annually, beginning no later than July 1, 2028, and further defines certain terms related to such reporting.
• Proposed §§ 423.2810, 423.2816, 423.2818, and 423.2820 address requirements for compliance and enforcement mechanisms to be used by both Part D plan sponsors (such as audit rights) and CMS (such as annual requirements for Part D plan sponsor certifications of compliance and disgorgement of fees in violation of the remuneration requirements established at proposed § 423.2810).
• Proposed § 423.2822 addresses confidentiality and use of information disclosed by PBMs or their affiliates to Part D plan sponsors or CMS.

We published a request for information (RFI) on Pharmacy Benefit Manager Compensation and Data Collection on June 18, 2026 (91 FR 36776) to solicit technical input on the services and business practices of PBMs and their affiliates to inform this rulemaking.^[21] The comments that we received in response to that RFI informed the proposals in this rule, and we thank commenters for their input.

2. Definitions

In this proposed rule, CMS proposes to codify the definitions of terms consistent with the meanings given in section 1860D-12(h) of the Act. At proposed § 423.2802, CMS proposes definitions for the following terms in section 1847A of the Act that are discussed in greater detail in subsequent sections of this proposed rule:

• Affiliate, discussed in section II.C.4. of this proposed rule.
• Bona fide service fee, discussed in section II.C.6. of this proposed rule.
• Fair market value, discussed in section II.C.6. of proposed rule.
• Fully passed through, discussed in section II.C.6. of this proposed rule.
• Incentive payment, discussed in section II.C.6. of this proposed rule.
• Intermediary, discussed in section II.C.3. of this proposed rule.
• Pharmacy benefit manager (PBM), discussed in section II.C.3. of this proposed rule.
• PBM function, discussed in section II.C.3. of this proposed rule.
• Related service, discussed in section II.C.3. of this proposed rule.
• Remuneration, discussed in section II.C.6. of this proposed rule.

3. Pharmacy Benefit Manager (PBM)

Section 1860D-12(h)(7)(C) of the Act defines a PBM as “any person or entity that, either directly or through an intermediary, acts as a price negotiator or group purchaser on behalf of a PDP sponsor or prescription drug plan, or manages the prescription drug benefits provided by such sponsor or plan, including the processing and payment of claims for prescription drugs, the performance of drug utilization review, the processing of drug prior authorization requests, the adjudication of appeals or grievances related to the prescription drug benefit, contracting with network pharmacies, controlling the cost of covered Part D drugs, or the provision of related services. Such term includes any person or entity that carries out one or more of the activities described in the preceding sentence, irrespective of whether such person or entity calls itself a 'pharmacy benefit manager.' ”

This definition is functional in nature. An entity may qualify as a PBM based on the activities it performs, regardless of how it describes itself. The Act identifies the functions of a PBM as including the processing and payment of prescription drug claims, drug utilization review, processing of prior authorization requests, adjudication of appeals or grievances related to the prescription drug benefit, contracting with network pharmacies, controlling the cost of covered Part D drugs, and the provision of related services, but does not limit the scope of the PBM definition to the persons and entities that engage in those activities. In addition, a person or entity may qualify as a PBM even if it carries out these functions indirectly through an intermediary.

Determining whether a particular entity is: (1) a PBM; (2) an affiliate as defined in section 1860D-12(h)(7)(A) of the Act and discussed in section II.C.4. of this proposed rule; or (3) neither is necessary to establish the entity's obligations under section 1860D-12(h) of the Act.

Specifically, a PBM—but not an affiliate—must have a written agreement with the Part D plan sponsor under which the PBM and its affiliates agree to satisfy certain requirements as specified in section 1860D-12(h) of the Act. The PBM—but not its affiliates—also bears responsibility, under its statutorily required contractual arrangement with the Part D plan sponsor, for submitting an annual report to the Part D plan sponsor and the Secretary under section 1860D-12(h)(1)(C)(i) of the Act, as discussed in section II.C.8. of this proposed rule Although an affiliate may hold information that must be reported, the affiliate is not responsible for submitting that information directly to the Part D plan sponsor or the Secretary.

The PBM also has audit-related obligations under its contractual arrangement with the Part D plan sponsor, as required by section 1860D-12(h)(1)(D) of the Act. The PBM must allow an annual audit at the request of the Part D plan sponsor and must provide relevant records, data, contracts, and other information requested by the Part D plan sponsor. Although an affiliate's records may be produced during an audit, the PBM is responsible for providing information held by its affiliates to the Part D plan sponsor.

Under the contractual requirements mandated by section 1860D-12(h)(1)(B)(i) through (iii) of the Act, a PBM is further responsible for defining, interpreting, and applying pricing guarantee and cost-performance terms transparently and consistently; identifying exclusions; and providing WAC-based equivalents when required. These responsibilities are not imposed directly on affiliates.

Finally, pursuant to the contractual requirements mandated by section 1860D-12(h)(1)(A)(vi)(I) of the Act, a PBM must enter into written agreements with its affiliates requiring them to identify and disgorge impermissible remuneration and must attest that it has entered into those agreements.

(i) Contract Requirement

As a threshold matter, an entity qualifies as a PBM under section 1860D-12(h)(7)(C) of the Act if it: (1) directly, or through an intermediary, performs at least one PBM function; and (2) performs that function on behalf of a Part D plan sponsor or prescription drug plan. Separately, section 1860D-12(h)(7)(A) of the Act defines an “affiliate”—with respect to any PBM or Part D plan sponsor—to include any entity that, directly or indirectly, acts as a contractor, principal, or agent to such PBM or Part D plan sponsor insofar as it performs any of the functions described in 1860D-12(h)(7)(C) of the Act.

These two definitions create a potential overlap. Absent clarification, a contractor or agent of a PBM that performs one or more PBM functions could simultaneously be considered to: (1) qualify as a PBM in its own right under subparagraph (C) because it performs PBM functions and the definition captures entities performing even a single such function regardless of ( printed page 66436) self-identification; and (2) qualify as an affiliate of the contracting PBM under subparagraph (A)(ii) because it is acting as a contractor performing those same functions. For example, based solely on the requirements related to the performance of PBM functions, a third-party claims processor retained by a PBM to process Part D prescription drug claims for a Part D plan sponsor could qualify as a PBM under subparagraph (C) because it performs a PBM function on behalf of a Part D plan sponsor, while also qualifying as an affiliate under subparagraph (A)(ii) because it performs that function as the PBM's contractor.

Section 1860D-12(h)(1) of the Act also establishes a general rule that any contract entered into with a Part D plan sponsor under this part with respect to a prescription drug plan offered by such sponsor must provide that any PBM acting on behalf of such sponsor has a written agreement with the Part D plan sponsor under which the PBM agrees to certain requirements as specified in section 1860D-12(h) of the Act.

Based on this statutory structure, we propose to clarify that an entity qualifies as a PBM only if it holds a written agreement with a Part D plan sponsor, either directly or through a parent organization of such Part D plan sponsor. We believe this clarification resolves the definitional overlap between PBMs and their affiliates and is consistent with the Act's requirement of a contractual relationship between a PBM and a Part D plan sponsor. We intend that this proposed requirement for a written agreement between a PBM and the Part D plan sponsor can be met by an agreement between the PBM and the parent organization of the Part D plan sponsor to account for instances in which the parent organization possesses delegated contracting authority for subsidiary Part D plan sponsors. We note that our proposal to allow for a Part D plan sponsor to meet its obligation to have a written agreement under section 1860D-12(h)(1) of the Act through its parent organization is consistent with the implementation of section 1860D-12(b)(1) of the Act, under which a Part D plan sponsor may also meet its contract requirements through a written agreement by its parent organization when the parent organization has a legally enforceable delegation of Part D plan sponsor's contracting authority (see, for example, 42 CFR 423.503(a)(3) and 423.504(b)(8)).

Accordingly, we propose to establish at 42 CFR 423.2804(a) a general rule for PBM status. An entity would qualify as a PBM, regardless of how it describes itself, if: (1) the entity has a written contract with the Part D plan sponsor, either directly or through a parent organization of such Part D plan sponsor; and (2) the entity, directly or through an intermediary, performs at least one PBM function on behalf of a Part D plan sponsor or prescription drug plan with which it has such written contract.

We solicit comment on this proposal.

(ii) Related Services and PBM Functions

As described earlier in this section, a PBM is any person or entity that acts as a price negotiator or group purchaser on behalf of a Part D plan sponsor or prescription drug plan, or that manages the prescription drug benefits provided by such a sponsor or plan. Section 1860D-12(h)(7)(C) of the Act identifies the functions of a PBM as including the processing and payment of prescription drug claims, drug utilization review, processing of prior authorization requests, adjudication of appeals or grievances related to the prescription drug benefit, contracting with network pharmacies, controlling the cost of covered Part D drugs, and the provision of related services. Because the Act introduces this list with the word “including” and separately references “the provision of related services,” these enumerated functions are illustrative rather than exhaustive.

To give effect to the “related services” language, CMS considered identifying specific additional functions to treat as PBM functions beyond the six functions enumerated in the statute. That approach would provide certainty, but we believe it could improperly narrow the definition to a fixed list, which would be inconsistent with the statute's broad language. A fixed list could suggest that unlisted functions are excluded, even when they are closely related to the enumerated ones. The Act's use of “including” and its separate reference to “related services” signal that the enumerated functions are illustrative examples. Accordingly, codifying a fixed list of additional functions, however carefully constructed, could be contrary to the statute's open-ended language.

At the same time, we believe “related services” should be defined with sufficient precision to give PBMs and their affiliates compliance parameters given that performing a PBM function on behalf of a Part D plan sponsor or prescription drug plan carries significant regulatory obligations. We believe the best approach is to treat “related services” as services that have a direct nexus to the functions enumerated in the statute. This approach would treat the statutory list as illustrative while still requiring a meaningful connection to those functions.

To provide compliance parameters, we have sought to draw on concepts that are commonly understood to anchor the proposed direct-nexus standard. 42 CFR part 423 does not currently define “price negotiator,” “group purchaser,” “drug benefit management,” “prescription drug benefit management,” or “pharmacy benefit management services” as standalone terms, so no existing overarching definitions are available in the context of the Part D program. However, we propose to use three commonly understood concepts to give the directnexus standard an appropriate level of specificity.

First, an “integral part” concept could provide an administrable test for determining when a service is sufficiently connected to an enumerated PBM function to be classified as having a direct nexus to that function—specifically, by asking whether the service is an essential component (that is, “integral part”) of that function's performance. For example, in the context of PBM functions, an entity that performs only one step in adjudicating appeals or grievances may be considered to have not performed “the adjudication of appeals or grievances” as defined in section 1860D-12(h)(7)(C) of the Act. However, that entity may have performed a function that is an “integral part” of appeals or grievance adjudication. However, relying exclusively on this concept would likely be too narrow.

Second a “necessity” standard offers an additional element for operationalizing the direct-nexus approach—capturing not only functions that are components of an enumerated activity but also functions without which an enumerated activity could not reasonably be performed. In the context of PBM functions, this could include, for example, maintaining and operating the data-exchange infrastructure used to transmit claims data for payment processing, prior authorization review, or other purposes. Although maintenance of data-exchange infrastructure is not itself an integral component of the functions enumerated in statute, this maintenance activity could nonetheless be considered necessary to carry out such functions to the extent that payment processing and prior authorization review could not be reliably performed without it.

Third, we believe there is value in including a “support” concept in the definition of direct nexus. Many PBM activities are highly complex and PBMs ( printed page 66437) sometimes rely on other organizations to perform key elements of those activities to support them. This “support” concept provides a third basis for defining “related services” under the direct-nexus standard—one that extends beyond functions that are a component of, or necessary to, the performance of an enumerated activity to encompass functions that, while not strictly necessary, contribute to the actual operation of those activities. For example, data analysis services—such as producing dashboards, utilization reports, and trend analyses related to cost control, formulary management, or drug utilization review—could be viewed as distinct from the underlying PBM function of controlling the cost of covered Part D drugs in the sense that they are not integral to, or necessary for, carrying out that function. But data analysis may nonetheless support the execution of this function.

Together, we believe these three concepts give the direct-nexus standard the precision and administrability necessary for effective compliance. Accordingly, we propose to define “related service” at 42 CFR 423.2802 as any activity, service, or function that is performed on behalf of a Part D plan sponsor or prescription drug plan and has a direct nexus to the activities that are enumerated in the definition of PBM function and propose that the requisite direct nexus to the enumerated activities will exist if the activity is: (1) integral to such enumerated activity; (2) necessary to carry out such enumerated activity; or (3) performed in support of such enumerated activity. We also propose to define “PBM function” at § 423.2802 to include any activity described in section 1860D-12(h)(7)(C) of the Act inclusive of any related service as we propose to define that term at § 423.2802.

CMS considered including a limiting clause to exclude activities incidentally related to PBM functions but concluded that such a clause would raise concerns similar to those posed by a fixed enumerated list. Moreover, we believe the “related service” definition as proposed would not include activities incidentally related to PBM functions such that a limiting clause would be necessary. Notably, the term “related services” at section 1860D-12(h)(7)(C) of the Act is listed with the enumerated PBM services rather than activities that a PBM or Part D plan sponsor would need to conduct under the ordinary course of business as a company (such as accounting or paying taxes). For example, our proposed definition of “related service” would not include the provision of professional services that, while necessary to the operations of a PBM, Part D plan sponsor, or prescription drug plan, do not have a direct nexus to the activities that are enumerated in the definition of PBM function. Accounting, auditing, legal, information technology and other professional services that are commonly performed on behalf of any company in the health care industry, but are not related to the enumerated PBM functions, do not become a “related service” that is a PBM function under the proposed definition simply because that service is performed for a PBM, Part D plan sponsor or prescription drug plan. Likewise, we believe the proposed definition of “related service” would not include services by commercial entities that offer information, datasets, technology platforms, or similar products on standardized or generally applicable commercial terms. For example, while information regarding WAC may be necessary to controlling the cost of covered Part D drugs, the sale of data from a drug pricing compendium does not become a “related service” under the proposed definition simply because the purchaser of that data of general applicability is a PBM, Part D plan sponsor or prescription drug plan. If the drug pricing compendium did not perform that data provision service on behalf of a Part D plan sponsor, but rather provided widely commercially available data of general applicability to a variety of customers, the provision of such data would not be considered a “related service” under the proposed definition.

Finally, we note that proposed definition of “related service” describes those services performed on behalf of a Part D plan sponsor or prescription drug plan. Accordingly, provision of information to a PBM, Part D plan sponsor or prescription drug plan by or on behalf of a provider or pharmacy in connection with claims processing, drug utilization review, prior authorization requests or other PBM functions is not itself a PBM function under the proposed definition of “related service.” For instance, a pharmacy services administrative organization (PSAO) performing claims submission on behalf of its client pharmacies would not be performing a PBM function under the proposed definition of related service because the PSAO would be providing the service on behalf of client pharmacies, not the Part D plan sponsor or prescription drug plan.

We solicit comment on this proposal. Specifically, we solicit comment on whether any categories of activities should be explicitly excluded from the definition of “PBM function” or “related service.”

The definitions of “PBM function” and “related service” at proposed § 423.2802 are intended to ensure that the range of activities that could lead an entity or individual to become a PBM or affiliate for purposes of this rule is clear and comprehensive. We believe the direct-nexus standard in our proposed definition of related service is appropriate to avoid parties understating or circumventing reporting obligations related to bona fide PBM functions. As an alternative to the direct-nexus standard in our proposed definition of “related service,” we considered adopting a substantial-similarity standard under which the definition of “related service” would serve as a less prescriptive catch-all to include functions that are different in name but similar in character to the PBM functions provided by a Part D plan sponsor or prescription drug plan that are expressly listed in section 1860D-12(h)(7)(C) of the Act. Specifically, an alternative definition of “related service” could be “an activity, service or function that is substantially similar to a function listed in section 1860D-12(h)(7)(C) of the Act and any successor function to any listed function.” We believe this alternative definition could provide clarity by emphasizing that the scope of a “related service” is coextensive with the activities on behalf of a Part D plan sponsor or prescription drug plan that are acting as a price negotiator or group purchaser on behalf of such sponsor or plan or involve the management of the prescription drug benefits provided by such sponsor or plan. However, we have concern such definition may be underinclusive or insufficiently precise to be administrable. We solicit comment on this alternative definition and whether the direct-nexus standard in our proposal or this substantially similar alternative would define “related service” in a manner that better enables consistent and complete identification of PBM functions for purposes of the reporting obligations under this proposed rule.

(iii) Minimum Threshold for Performance of a PBM Function

As discussed earlier in this section, the PBM definition is functional in nature. An entity may qualify as a PBM based on the activities it performs, regardless of how it describes itself. To determine when PBM status applies based on the performance of a particular PBM function, we must establish whether a minimum level of performance is required—in other ( printed page 66438) words, whether a single instance of performing a PBM function renders an entity a PBM.

We considered a de minimis or safe harbor approach under which CMS would establish numeric thresholds—such as minimum claims volume or dollar value of transactions—below which an entity's performance of a listed function would not trigger PBM status. However, calibrating appropriate thresholds across the full range of PBM functions would be analytically complex and potentially subject to gaming. Moreover, the statute does not specify any minimum frequency, volume, or materiality threshold for PBM function performance. An explicit threshold-based de minimis standard would therefore be in tension with the statutory language, which does not contemplate such a carve out.

We also considered a contractual standard, under which PBM status would be determined based on the terms of a written agreement to perform services on behalf of a Part D plan sponsor or prescription drug plan. Under this approach, an entity that has contracted to perform certain functions would be presumed to perform those functions during the contract term. However, actual performance cannot always be derived from contractual terms. A contractual standard therefore risks being simultaneously overinclusive—capturing entities that contracted to perform certain functions but do not actually do so—and underinclusive—failing to capture entities that do perform certain functions not expressly required under a contract.

Instead, we propose to adopt an “any performance standard,” under which PBM status attaches the moment an entity performs even a single instance of any listed PBM function, regardless of frequency, volume, or materiality. We believe this approach is most consistent with the statutory structure, which does not explicitly contemplate limitations on the minimum level of performance required to confer PBM status.

Accordingly, at 42 CFR 423.2804(b), we propose to clarify that an entity satisfies the performance element of the PBM definition upon performing one or more PBM functions during a calendar year, regardless of the frequency, volume, regularity, or materiality of such performance.

We recognize that application of an “any performance standard” could, in some circumstances, be overinclusive. However, we believe that the additional statutory constraints that a PBM function be an act as a price negotiator or group purchaser on behalf of a Part D plan sponsor or to manage the benefits provided by such sponsor or plan substantially limit the potential for over-inclusiveness. Certain functions that are included in the statutory definition of PBM are routinely performed by entities for purposes unrelated to pharmacy benefit management. For example, pharmacies process prescription drug claims as part of their own operational workflows (for example, when submitting claims to Part D plan sponsors seeking payment), which are independent of any functions they may also carry out on behalf of the Part D plan sponsor. Likewise, pharmacies and pharmacists regularly provide certain clinical services to their patients, such as drug utilization review and medication adherence monitoring, in accordance with applicable state pharmacy practice or professional conduct requirements, respectively, without regard to whether the drug is dispensed to an enrollee of a Part D plan for which the Part D plan sponsor has engaged any person or entity to act as a price negotiator or group purchaser on its behalf or to manage its prescription drug benefit. Accordingly, we believe that the statutory text establishing that an entity performs a PBM function when it acts as a price negotiator or group purchaser on behalf of a Part D plan sponsor or prescription drug plan or to manage the benefits of such sponsor or plan should substantially limit the potential for over-inclusiveness in understanding which pharmacy and wholesaler activities are PBM functions. Nevertheless, we request comment on whether circumstances exist in which this standard could still be overinclusive, and whether CMS should consider additional limitations.

We request comment on this proposal.

(iv) Intermediaries

The statute includes within the definition of PBM entities that act “through an intermediary” but does not define the term “intermediary,” raising two questions: what constitutes an intermediary, and when does an entity that performs PBM functions through an intermediary qualify as a PBM?

Part D regulations already employ a conceptually similar framework through the “first tier, downstream, and related entity” categories. Under 42 CFR 423.501:

• A first tier entity is “any party that enters into a written arrangement, acceptable to CMS, with a Part D plan sponsor or applicant to provide administrative services or health care services for a Medicare eligible individual under Part D.”
• A downstream entity is a “party that enters into a written arrangement, acceptable to CMS, below the level of the arrangement between a Part D plan sponsor (or applicant) and a first-tier entity,” continuing down to the level of the ultimate provider of health and administrative services.
• A related entity is an entity that is “related to the PDP sponsor by common ownership or control and (1) performs some of the Part D plan sponsor's management functions under contract or delegation; (2) furnishes services to Medicare enrollees under an oral or written agreement; or (3) leases real property or sells materials to the Part D plan sponsor at a cost of more than $2,500 during a contract period.”

Under 42 CFR 423.505(i), Part D plan sponsors may delegate functions to these entities. Contracts with such entities must preserve audit and record-access rights for HHS, the Comptroller General, and their designees.^[22] These entity types are further incorporated into compliance program, prescription drug event (PDE) submission, claims-data certification, and Medicare Transaction Facilitator Data Module requirements.^[23]

There are meaningful similarities between first tier, downstream, and related entities and intermediaries. Both concepts are function-based: first tier, downstream, and related entities are identified, in part, by their performance of administrative or health care services under Part D, while the PBM and intermediary concepts under section 1860D-12(h) of the Act similarly depend on an entity's performance of PBM functions. Both are chain-of-delegation concepts that reach below a direct contractor to downstream entities, and both preserve accountability for compliance obligations notwithstanding outsourcing. The first tier, downstream, and related entity framework preserves sponsor responsibility despite delegation to another entity, which is similar to how the Act imposes PBM status, and associated accountability for compliance with certain requirements as specified in section 1860D-12(h) of the Act, on an entity regardless of whether it uses intermediaries to perform PBM functions.

However, the two concepts are not exact analogs. First tier, downstream, and related entity status is triggered by a written arrangement to provide administrative or health care services under Part D and applies broadly to Part D contractors regardless of whether they ( printed page 66439) perform PBM functions. By contrast, intermediary status is not expressly dependent on a written agreement, applies more narrowly within the context of PBM functions, and does not extend to entities performing exclusively non-PBM functions. Therefore, we believe it is appropriate to establish a definition of “intermediary” for purposes of section 1860D-12(h) of the Act that accounts for differences from the standard used to determine first tier, downstream and related entity status.

Given the complexity of modern pharmacy benefit arrangements, which commonly involve multi-layered contractual chains, we believe the definition of “intermediary” and the statutory phrase “through an intermediary” should be interpreted broadly to give appropriate effect to the statute.^[24] Accordingly, at proposed § 423.2802, we propose to define “intermediary” to mean any person or entity in a chain of contractual or delegated relationships, of any length, through which one or more PBM functions are performed on behalf of a Part D plan sponsor or prescription drug plan during a calendar year. At proposed § 423.2804(c), we would specify that any entity that causes, arranges, procures, or relies on an intermediary to perform a PBM function must be deemed to have performed that function for all purposes of section 1860D-12(h) of the Act.

Under this approach, an entity would qualify as a PBM acting through an intermediary if—

• The entity holds a written contract with the Part D plan sponsor, either directly or through a parent organization of such Part D plan sponsor, to provide or arrange PBM functions;
• The entity causes, arranges, procures, or relies on another entity to perform one or more listed PBM functions on behalf of the Part D plan sponsor or prescription drug plan as described in such written contract; and
• That intermediary performs such function on behalf of such Part D plan sponsor or prescription drug plan.

We considered limiting intermediary status to entities within a set number of links in a contractual chain. However, that approach would allow entities to shield PBM activities from section 1860D-12(h) of the Act by positioning the function-performing entity far enough from the Part D plan sponsor to fall outside the intermediary definition.

We also considered a control-based approach, under which a PBM acting through an intermediary would be required to direct or control how the function-performing entity performs the PBM function. For example, a PBM could be said to direct or control a function-performing entity when the PBM contracts with a rebate aggregator to negotiate manufacturer rebates on behalf of a Part D plan sponsor, and the PBM sets the negotiation parameters, approves or rejects rebate offers, specifies which manufacturers or drugs the aggregator must prioritize, or requires the aggregator to follow PBM-established formulary or contracting terms. However, that approach would be highly fact-specific and could create significant uncertainty about when PBM status attaches to an entity acting through an intermediary.

We request comment on this proposal and on potential alternative approaches.

(v) Performance of PBM Functions by Part D Plan Sponsors

Section 1860D-12(h)(7)(C) of the Act defines a PBM in part as “any person or entity that . . . acts as a price negotiator or group purchaser on behalf of a prescription drug plan sponsor or prescription drug plan, or manages the prescription drug benefits provided by such sponsor or plan.” Additionally, section 1860D-12(h)(1)(A)(iii) of the Act addresses the application of requirements for agreements with PBMs “in cases where a PDP sponsor is acting as a pharmacy benefit manager on behalf of a prescription drug plan offered by such PDP sponsor.”

Taken together, these provisions could be read to suggest that the requirements of section 1860D-12(h) of the Act apply to all Part D plan sponsors that engage in any activity which we propose to include within the definition of PBM functions under proposed § 423.2802. However, most of the statutory requirements in section 1860D-12(h) of the Act contemplate a two-party relationship between a Part D plan sponsor and a PBM. This raises the question of whether—and under what circumstances—a Part D plan sponsor that performs the activities described in the proposed definition of PBM functions is subject to the requirements of section 1860D-12(h) of the Act.

Under existing Part D statutory and regulatory requirements, a Part D plan sponsor's contract with CMS must require the sponsor to, among other things: provide qualified prescription drug coverage; comply with quality assurance and cost and utilization management requirements; support e-prescribing; comply with coverage determination, grievance, appeal, and formulary exception requirements; submit claims and other information to CMS; provide information CMS determines necessary to carry out the applicable payment provisions; and operate systems that adjudicate drug claims at the point of sale.^[25] The activities described in these requirements for Part D plan sponsors overlap significantly with the activities that are characterized as PBM functions under proposed § 423.2802.

Nevertheless, the overall structure of section 1860D-12(h) of the Act largely assumes that a Part D plan sponsor and a PBM are separate entities and seeks to hold the PBM accountable to the Part D plan sponsor for the PBM's activities on behalf of the sponsor. For example, section 1860D-12(h)(1)(C)(i) of the Act requires the PBM to submit an annual report to both the Part D plan sponsor and the Secretary. Section 1860D-12(h)(1)(D) of the Act provides a Part D plan sponsor with audit rights over the PBM to ensure the PBM's compliance with the written agreement and the accuracy of information reported under section 1860D-12(h)(1)(C) of the Act. Likewise, section 1860D-12(h)(2)(A)(ii) of the Act requires that, in order to enforce the requirements related to PBMs, each Part D plan sponsor is required to have a written agreement with any PBM—or an affiliate of such PBM—acting on behalf of such sponsor that requires the PBM or affiliate to reimburse the sponsor for any civil money penalty imposed on the sponsor as a result of the PBM's or affiliate's failure to meet applicable requirements. This consistent structural distinction between a PBM and a Part D plan sponsor suggests that a Part D plan sponsor is not a PBM for purposes of section 1860D-12(h) of the Act solely by virtue of its functions as a Part D plan sponsor—even though Part D plan sponsors engage in activities that overlap with the activities in the PBM definition. At the same time, the statute does not categorically exclude Part D plan sponsors from ever qualifying for PBM status. Rather, the overall structure of section 1860D-12(h) of the Act affirms that a Part D plan sponsor is a PBM when it is performing PBM functions on behalf of a distinct entity (that is, when such activities performed ( printed page 66440) by the Part D plan sponsor are not performed under the sponsor's own contract for the operation of the Part D plan sponsor's own prescription drug plan).

Therefore, we propose to clarify a limitation on how the performance standard to have PBM status as described in proposed § 423.2804(a) applies to the activities of a Part D plan sponsor. Specifically, we propose to establish in proposed § 423.2804(d) that a Part D plan sponsor would not meet the performance standard in paragraph (a)(2) based solely on the sponsor performing activities under such sponsor's contract for the operation of its own prescription drug plan.

We considered supplementing this proposal with regulatory text to identify criteria under which a Part D plan sponsor would meet the performance standard for PBM status as described in proposed § 423.2804. For example, we considered whether to affirm in regulatory text that a Part D sponsor would meet the standard for PBM status in proposed § 423.2804 if the sponsor performs one or more functions described at proposed paragraph § 423.2802 with respect to a prescription drug plan for which it does not have a contract with CMS or if the sponsor or any affiliate of such Part D plan sponsor derives any remuneration from any entity in connection with the sponsor's performance of PBM functions on behalf of a separate Part D plan sponsor. We also considered whether to introduce regulatory text to clarify how the performance standards would apply to a Part D plan sponsor in the context of a vertically integrated entity. However, we concluded that regulatory text to this effect would be superfluous and could inadvertently understate the standards for PBM status as applied to Part D plan sponsors.

Under proposed § 423.2804(d), a Part D plan sponsor would not meet the standards for PBM status based solely on the sponsor performing activities under such sponsor's contract for the operation of its own prescription drug plan; however, this proposal does not limit the circumstances in which a Part D plan sponsor may meet the standards for PBM status based on the sponsor performing activities on behalf of other prescription drug plans. As noted previously, section 1860D-12(h)(1)(A)(iii) of the Act permits manufacturer price concessions, including concessions that are calculated as a percentage of a drug's price, provided they are fully passed through to the Part D plan sponsor and comply with all regulatory and subregulatory requirements related to DIR, for manufacturer rebates, discounts, and other price concessions. This exception to the otherwise applicable remuneration restrictions on PBMs and their affiliates in section 1860D-12(h)(1)(A) of the Act explicitly encompasses scenarios where a Part D plan sponsor acts as a PBM on behalf of a prescription drug plan it offers. Accordingly, we propose to clarify how this exception applies in the context of a Part D plan sponsor that does not fall within the specific limitation on PBM status described at proposed § 423.2804(d). Specifically, we propose that when assessing whether a price concession complies with the requirements in section 1860D-12(h)(1)(A)(iii) of the Act as described in proposed § 423.2810(d), in cases where the Part D plan sponsor meets the standards for PBM status described at proposed § 423.2804(a)(2) and acts as a PBM on behalf of its own prescription drug plan, a price concession to such sponsor for such plan would be deemed to satisfy the passed through condition in paragraph (d)(2)(i) of this section, provided that such Part D plan sponsor receives 100 percent of the gross economic value of the price concession. This clarification ensures a price concession can meet the requirement that it be fully passed through to the Part D sponsor even in those cases where the price concession is paid to a sponsor acting as a PBM on behalf of its own prescription drug plan. We believe this interpretation best resolves the statutory tensions discussed above by preserving the structural distinction between a PBM and a Part D plan sponsor inherent across the various requirements of section 1860D-12(h) of the Act, while also giving full force to the statute's express directive that rebates, discounts, and other price concessions from manufacturers be fully passed through to the Part D plan sponsor including in cases where the sponsor is acting as a PBM on behalf of its own prescription drug plan.

We request comment on these proposals, including whether this proposed approach to applying PBM status to Part D plan sponsors achieves the appropriate application of transparency and remuneration requirements.

4. Affiliate

Section 1860D-12(h)(7)(A) of the Act defines an affiliate, “with respect to any pharmacy benefit manager or PDP sponsor,” as “any entity that, directly or indirectly—(i) owns or is owned by, controls or is controlled by, or is otherwise related in any ownership structure to such pharmacy benefit manager or PDP sponsor; or (ii) acts as a contractor, principal, or agent to such pharmacy benefit manager or PDP sponsor, insofar as such contractor, principal, or agent performs any of the functions described under subparagraph (C).”

This definition has two independent prongs: an ownership or control prong, set out in clause (i), and a functional and contractual prong, set out in clause (ii). As the statute sets these prongs out as alternatives, an entity that satisfies either prong qualifies as an affiliate, regardless of whether it satisfies the other.

Determining whether a particular entity is an affiliate is necessary to establish the entity's obligations under section 1860D-12(h) of the Act. As discussed in section II.C.1. of this proposed rule, the PBM industry is characterized by complex affiliate structures and substantial vertical and horizontal integration. In addition, PBMs have demonstrated an ability to adapt to changing legislative and regulatory dynamics. Together, these factors underscore the importance of determining affiliate status for the effective administration of section 1860D-12(h) of the Act.

Although affiliates have fewer obligations under the Act than PBMs, they remain subject to significant requirements. Specifically, affiliates are subject to the same bona fide service fee restrictions as PBMs under section 1860D-12(h)(1)(A) of the Act. Affiliates must also identify and disgorge impermissible remuneration to the PBM under the required PBM-affiliate agreement described in section 1860D-12(h)(1)(A)(vi)(I) of the Act.

In addition, information concerning affiliates is required to be included in the PBM's annual report. This includes information regarding an affiliate's retained revenue, pharmacy activity, acquisition costs, 340B arrangements, compensation paid to consultants or brokers, and identity as an affiliate under sections 1860D-12(h)(1)(C)(i)(I)(kk), (II), (VI), (VIII), (IX), and (X) of the Act.

Information owned or held by an affiliate may also be subject to audit. Under section 1860D-12(h)(1)(D)(v) of the Act, such information must be produced by the PBM if it is required for reporting or audit verification.

Furthermore, manufacturer contracts entered into by affiliates may trigger disclosure obligations. A manufacturer agreement entered into by an affiliate can trigger the written-explanation requirement under section 1860D-12(h)(1)(C)(ii)(I) of the Act if the agreement involves rebates, discounts, ( printed page 66441) payments, or other financial incentives contingent on coverage, formulary placement, or utilization-management conditions. Under section 1860D-12(h)(1)(C)(ii)(II)(bb) of the Act, an affiliate's Chief Executive Officer, Chief Financial Officer, or General Counsel or individual delegated the authority to sign on behalf of one of these officers may also be required to certify the explanation when the affiliate is the relevant contracting entity.

Affiliates may also be required to reimburse Part D plan sponsors for certain penalties. Under section 1860D-12(h)(2)(A)(ii) of the Act, a Part D plan sponsor must require an affiliate to reimburse the sponsor for civil money penalties imposed on the sponsor as a result of the affiliate's failure to meet applicable requirements.

Additionally, affiliates must be subject to punitive contractual remedies. Under section 1860D-12(h)(2)(A)(iii) of the Act, a Part D plan sponsor must require an affiliate to be subject to punitive remedies for breach of contract if the affiliate fails to comply with applicable requirements under the Act.

The affiliate designation is also central to the implementation of the essential retail pharmacies requirements at section 1860D-42(e) of the Act, as added by section 6223(b) of the CAA. Among other requirements, section 1860D-42(e) of the Act directs CMS to publish an annual list of essential retail pharmacies and requires Part D plan sponsors to submit to CMS a list of retail pharmacies that are affiliates of such sponsor or are affiliates of a PBM acting on behalf of such sponsor. Section 1860D-42(e)(4) of the Act provides that the definitions for PBM and affiliate in the provisions implementing section 6224 of the CAA apply to implementation of the essential retail pharmacies requirements under section 1860D-42(e) of the Act. Accordingly, Part D plan sponsors will be using the regulatory standard finalized through this rulemaking when making their annual report of affiliated retail pharmacies, as required by section 1860D-42(e)(3)(B) of the Act. Moreover, because the definition of essential retail pharmacy at section 1860D-42(e)(2)(A) of the Act excludes affiliates, every pharmacy that is an affiliate under proposed § 423.2802 must be excluded from the list of essential retail pharmacies published under 1860D-42(e)(3)(A) of the Act. Acknowledging that this rulemaking does not otherwise address the essential retail pharmacies provisions, we solicit comment on how the affiliate standard being proposed here, if finalized, would impact the implementation of these essential retail pharmacies provisions, including how sponsors would implement this standard for purposes of their reporting obligations under section 1860D-42(e)(3)(B) of the Act.

Section 1860D-12(h)(7)(A)(i) of the Act defines “affiliate” through three independent clauses: “owns or is owned by,” “controls or is controlled by,” and “otherwise related in any ownership structure.” Each clause is independently sufficient to establish affiliate status, and CMS intends to propose regulations giving effect to each. Given the breadth of this prong, CMS also intends to build on existing concepts of ownership, control, attribution, and aggregation to specify a workable framework to the greatest extent possible.

Several Part D regulatory provisions already establish ownership and control concepts with respect to Part D plan sponsors. We discuss several different Part D regulatory provisions including first tier, downstream and related entities; parent organizations; and Part D party in interest rules. We also discuss ownership and control concepts from other Federal provisions and agencies, including definitions used in the Internal Revenue Code (IRC) controlled group rules, Employee Retirement Income Security Act of 1974 (ERISA) party in interest rules, and Security and Exchange Commission (SEC) beneficial ownership rules.

First tier, downstream, and related entities. As discussed in section II.C.2.a. of this proposed rule, Part D regulations regularly refer to “first tier, downstream, or related entities” together. Under 42 CFR 423.4:

• A first tier entity is “any party that enters into a written arrangement, acceptable to CMS, with a Part D plan sponsor or applicant to provide administrative services or health care services for a Medicare eligible individual under Part D.”
• A downstream entity is “any party that enters into a written arrangement, acceptable to CMS, with persons or entities involved with the Part D benefit, below the level of the arrangement between a Part D plan sponsor (or applicant) and a first tier entity,” continuing down to the ultimate provider of health and administrative services.
• A related entity includes an entity “related to the Part D sponsor by common ownership or control” that either (1) performs some of the Part D plan sponsor's management functions under contract or delegation, (2) furnishes services to Medicare enrollees under an oral or written agreement, or (3) leases real property or sells materials to the Part D plan sponsor at a cost of more than $2,500 during a contract period.

There are meaningful similarities between the requirements applicable to affiliates under section 1860D-12(h) of the Act and those applicable to first tier, downstream, and related entities under Part D regulations. Under 42 CFR 423.505(i), Part D plan sponsors may delegate functions to such entities. Under 42 CFR 423.505(i)(2) through (4), contracts with those entities must preserve audit and record-access rights for HHS, the Comptroller General, and their designees. First tier, downstream, and related entities are also incorporated into compliance program, PDE submission, claims-data certification, and Medicare Transaction Facilitator Data Module requirements.^[26]

However, these existing concepts are not perfect analogs for affiliates under the ownership and control prong. A first-tier entity must have a direct written arrangement with a Part D plan sponsor; downstream entities sit below that relationship; and related entities are linked to the Part D plan sponsor through common ownership or control and certain service, property, or management relationships. The ownership and control prong of section 1860D-12(h)(7)(A)(i) of the Act, by contrast, captures entities that own or are owned by the PBM or Part D plan sponsor without regard to the entity's position in the Part D contract chain. The existing `related entity' definition does capture entities connected to a Part D plan sponsor by common ownership or control. However, it also imposes additional functional requirements—namely that the entity perform management functions or furnish services to enrollees—that are not present in the affiliate definition's ownership and control prong.

Parent organizations. Under 42 CFR 423.4, a “parent organization” is the legal entity that exercises a controlling interest through share ownership, the power to appoint voting board members, or other means, directly or through subsidiaries. “Parent organization” is used in various contexts to determine when legally separate entities or contracts should be treated as related for Part D regulatory purposes. For example, the term is used to determine when contracts or plans are sufficiently related to permit consolidation, crosswalks between plan benefit packages (PBPs), or transfers between wholly owned subsidiaries of the same parent organization. Section 423.182(a) ( printed page 66442) defines consolidation by reference to contracts under the same parent organization. Sections 423.530(a)(2)(i) and 423.530(c)(2)(i) address crosswalks involving contracts or plans under the same parent organization. Section 423.551(g)(1) recognizes certain transfers between wholly owned subsidiaries of the same parent organization.

The definition shares important features with the ownership and control prong—both contemplate multi-tier ownership chains and non-ownership-based arrangements that confer control. However, under the existing parent organization definition, ownership and control are intertwined, whereas the affiliate definition treats ownership and control as distinct and independently sufficient bases for affiliate status. Under the parent organization definition, shared ownership may establish a “controlling interest.” In that context, ownership can be the mechanism by which control is established. By contrast, the affiliate definition treats ownership and control as distinct, alternative bases for affiliate status. An entity may qualify as an affiliate if it “owns or is owned by” another entity, “controls or is controlled by” another entity, or is otherwise related through an ownership structure.

Part D Party in Interest Rules. Under 42 CFR 423.501, a “party in interest” includes, among other categories, any person who is directly or indirectly the beneficial owner of more than 5 percent of the organization's equity, or the beneficial owner of a mortgage, deed of trust, note, or other interest secured by and valuing more than 5 percent of the organization. The definition therefore includes a clear ownership-based threshold, but it is not limited to ownership interests. It also includes certain management or administrative personnel, nonprofit incorporators or members, related entities, persons or entities under common control with the Part D plan sponsor, and certain family members.

The Part D requirements applicable to parties in interest are more limited than the requirements applicable to affiliates. Under 42 CFR 423.514(b)(1), a Part D plan sponsor must annually report to CMS significant business transactions with parties in interest and must either indicate that the transaction costs do not exceed the costs that would have been incurred in comparable transactions with persons who are not parties in interest or justify any higher costs as consistent with prudent management and fiscal soundness requirements. Under 42 CFR 423.514(b)(2), a Part D plan sponsor must submit a combined financial statement for itself and a party in interest if either 35 percent or more of the Part D plan sponsor's operating costs go to a party in interest, or 35 percent or more of the revenue of a party in interest is from the Part D plan sponsor. Under 42 CFR 423.514(c), the combined financial statements must separately present the financial information for the sponsor and each party in interest, eliminate inter-entity transactions in the consolidated column, and be examined by an independent auditor in accordance with generally accepted accounting principles, with appropriate opinions and notes.

Affiliates, on the other hand, are subject to broad remuneration restrictions and reporting requirements. Accordingly, we believe the 5-percent beneficial ownership threshold used to identify certain parties in interest is not appropriate for identifying affiliates, as it would impose significant compliance obligations on a broad swath of entities which may have limited relationships with Part D plan sponsors and PBMs.

Beyond CMS's own precedents, several other federal regulatory and statutory frameworks address concepts of ownership and control.

IRC controlled group rules. The IRC's controlled group rules represent a well-developed framework for determining when separate entities are treated as a single economic unit. Section 1563 of the IRC defines “controlled group of corporations” and identifies three types:

• A parent-subsidiary group, consisting of one or more chains of corporations connected through stock ownership of a common parent. That is, to have a parent-subsidiary group, a common parent must own at least 80 percent of the voting power or value of at least one subsidiary member, and 80 percent of the voting power or value of every other subsidiary member is owned by another subsidiary member of the group (§ 1563(a)(1));
• A brother-sister group, consisting of two or more corporations in which five or fewer individuals, estates, or trusts own at least 80 percent of each corporation and share more than 50 percent identical ownership of each corporation (§ 1563(a)(2) and (f)(5)); and
• A combined group consisting of three or more corporations that, together, form a hybrid of the parent-subsidiary and brother-sister structures, with one of the corporations being both the common parent of a parent-subsidiary group and a member of a brother-sister group (§ 1563(a)(3) of the IRC).

Section 1563 of the IRC also provides detailed constructive ownership rules—including family and entity attribution under section 1563(d) through (e) of the IRC—ensuring that control is measured based on both direct and indirect interests, as well as through options.

The IRC also contains related aggregation provisions that identify controlled groups or commonly controlled trades or businesses for different regulatory purposes. Section 414(b) and (c) of the IRC treat employees of controlled groups of corporations and trades or businesses under common control as employed by a single employer for specified employee benefit plan provisions of the Code, using the section 1563(a) of the IRC definitions and 80-percent controlled group standard with modifications for corporate controlled groups and parallel regulatory rules for trades or businesses under common control. ERISA Title IV separately uses section 414 of the IRC concepts in Pension Benefit Guaranty Corporation regulations.^[27] Section 52 of the IRC likewise aggregates employees of controlled groups of corporations and trades or businesses under common control for purposes of the work opportunity credit and expressly substitutes “more than 50 percent” for “at least 80 percent” in section 1563(a)(1). As a result, § 52 may aggregate a broader set of entities than the baseline section 1563(a) of the IRC 80-percent controlled group standard used in Section 414(b) through (c) of the IRC. Section 52 of the IRC is also incorporated into Medicare Part D through section 1860D-14C(g)(4) of the Act, which treats all persons treated as a single employer under section 52(a) or (b) of the IRC as one manufacturer for purposes of the “specified manufacturer” and “specified small manufacturer” phase-in rules.

The IRC controlled group frameworks align with the affiliate definition in several respects. They directly address direct ownership, indirect ownership through attribution, and control via equity interests—all concepts that map closely to the statutory language “directly or indirectly owns or is owned by, controls or is controlled by.” They incorporate constructive ownership, including family attribution and ownership through entities which supports the statutory requirement to capture indirect ownership relationships.^[28] And they explicitly define parent-subsidiary chains and brother-sister common ownership structures.

However, the IRC aggregation frameworks have limitations in this ( printed page 66443) context. For corporate controlled groups, the rules define control by reference to stock ownership and the relative voting power and value of the owned stock.^[29] They therefore may not capture all forms of practical control relevant to 1860D-12(h) of the Act, for example, whether and to what extent economic dependence standing alone affects the determination of stock ownership or voting power. Of the IRC controlled group provisions, overall, subsections (a) and (b) of section 52 of the IRC are best aligned with the objectives of section 1860D-12(h) of the Act. Section 52 is designed to prevent businesses under common economic control from multiplying tax benefits by operating through separate entities—a concern similar to section 1860D-12(h)'s of the Act aim of extending remuneration restrictions to affiliates in common ownership or control arrangements.

ERISA party in interest rules. Section 3(14) of ERISA defines a “party in interest” with respect to an employee benefit plan, and absent an exemption, Section 406 of ERISA prohibits employee benefit plans from entering into certain transactions with parties in interest because they may be positioned to exercise improper influence over the employee benefit plan.^[30] A party in interest includes, among other categories, direct or indirect owners of 50 percent or more of the combined voting power or total value of a corporation, the capital or profits interest of a partnership, or the beneficial interest of a trust or unincorporated enterprise that is an employer or employee organization whose employees or members are covered under the employee benefit plan. . .^[31] The definition also includes entities in which 50 percent or more of those interests are owned or held by certain other parties in interest.^[32] Like the IRC controlled group frameworks discussed previously, these ERISA provisions ground certain affiliation rules in voting power, share value, capital or profits interests, and beneficial interests.^[33] However, section 3(14)(I) of ERISA also captures a 10-percent-or-more partner or joint venturer, measured directly or indirectly by capital or profits, of a person described in certain other party-in-interest categories, offering a potential analogue for addressing joint-venture interests in the PBM context.

Security and Exchange Commission (SEC) beneficial ownership rules. The SEC's beneficial ownership framework under Exchange Act Regulation 13D-G provides a governance-focused analog for identifying ownership arrangements that may convey voting or investment control without majority equity ownership.^[34] Under 17 CFR 240.13d-3(a), a person is the beneficial owner of a security if that person, directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise, has or shares voting power, including the power to vote or direct the voting of the security, or investment power, including the power to dispose or direct the disposition of the security.^[35] Beneficial ownership is therefore not limited to formal record ownership and may arise through contractual, relational, or other indirect mechanisms.^[36] Under 17 CFR 240.13d-3(b), a person may not avoid beneficial ownership by using a trust, proxy, power of attorney, pooling arrangement, or other contract, arrangement, or device as part of a plan or scheme to evade the reporting requirements of sections 13(d) or 13(g) of the Securities Exchange Act of 1934.^[37] In addition, persons that beneficially own more than 5 percent of a covered class of equity securities generally must report that ownership, and the “purpose or effect” of changing or influencing the control of the issuer is one key condition bearing on whether certain filers may report on Schedule 13G rather than Schedule 13D.^[38]

We recognize that this analysis is not an exhaustive survey of existing frameworks and welcome comment on other frameworks or principles that CMS should consider.

Principles Derived from Existing Frameworks. Several common principles emerge from the foregoing analysis and inform the proposed regulatory framework:

• Entity-form neutrality. The regulatory framework should account for corporations, partnerships, limited liability companies, trusts, and other organizational forms so that ownership and control are evaluated consistently across entity types.
• Attribution rules. Ownership and control should be attributed to entities that exercise ownership or control through intermediary entities, consistent with frameworks that recognize indirect ownership, constructive ownership, and beneficial ownership.
• Governance-based control independent of equity. Governance rights, including board appointment rights, management rights, consent rights, or veto rights over material decisions, may confer control even without majority equity. Exclusive dealing arrangements or economic dependence may also be relevant where they give one entity practical authority over another entity's material business decisions.
• Purpose-or-effect analysis. For arrangements below any bright-line ownership threshold, CMS could consider whether the arrangement has the purpose or effect of giving one entity the ability to influence material business decisions of another entity.

Accordingly, at 42 CFR 423.2806(a)(1) we propose to establish a general rule that an entity is an affiliate if it satisfies one or more of the following paragraphs.

At proposed paragraph (2), we propose to define an ownership relationship for purposes of section 1860D-12(h) of the Act as one where an entity has an ownership relationship with a PBM or Part D plan sponsor if the entity and the PBM or Part D plan sponsor would be treated as members of a parent-subsidiary controlled group under section 1563(a)(1) of the IRC, as modified by section 52(a), of the IRC, as applicable, including the modifications and attribution rules incorporated or applied under those provisions. We believe these parent-subsidiary controlled group rules provide an appropriate basis for determining majority ownership. Section 52 of the IRC is already incorporated into Part D to aggregate entities when determining manufacturer status, and it captures both direct majority ownership and indirect ownership through chains of entities.

At proposed paragraph (3), we propose to define a control relationship between an entity and a PBM or Part D plan sponsor as one where either the entity or the PBM or Part D plan sponsor has the power to materially determine or direct the material actions, policies, or decisions of the other entity, regardless of ownership percentage, through any of the following: (i) the power to appoint, elect, or remove a majority of the other's governing body; (ii) contractual veto, consent, or supermajority rights over material business decisions of the other; (iii) contractual rights to appoint, direct, or remove senior officers or to direct day-to-day operations through a ( printed page 66444) management or administrative services agreement; or (iv) exclusive dealing, requirements contracts, or similar arrangements that, alone or together with other contractual or economic arrangements, give one entity practical authority to direct or materially constrain the other entity's material business decisions related to the Part D program. We also propose that control include indirect control exercised through one or more intermediary entities, assessed link by link through the chain of relationships.

We believe this proposed definition is consistent with existing Part D precedent. Under 42 CFR 423.4, “parent organization” is already defined to mean the legal entity that exercises “a controlling interest, through . . . the power to appoint voting board members, or other means,” expressly recognizing governance-based control, independent of equity ownership, as sufficient to establish a control relationship. It is also consistent with the SEC's beneficial ownership framework at 17 CFR 240.13d-3(a), which grounds ownership and control in the practical ability to vote, direct the voting of, or dispose of securities.

At proposed paragraph (a)(4), we propose to define an entity as being otherwise related in an ownership structure to a PBM or Part D plan sponsor if it does not meet the requirements of paragraphs (2) or (3), but the relationship between the entity and a PBM or Part D plan sponsor meets any of the requirements (i) through (iii) described later in this section and the relationship confers meaningful influence either to the entity or to the PBM or Part D plan sponsor: (i) the entities are in a brother-sister controlled group under section 1563(a)(2) of the IRC, as modified by section 52(a) of the IRC; (ii) one entity holds a 10 percent or greater capital or profits interest in a joint venture, limited partnership, limited liability company, or comparable arrangement in which the other participates; or (iii) the totality of the structural features of the relationship confers meaningful influence by one entity over the other, notwithstanding the failure to satisfy the thresholds in paragraphs (a)(4)(i) through (ii). In determining whether the relationship between the entity and the PBM or Part D plan sponsor confers meaningful influence by one entity over the other under paragraph (a)(4), consideration should be given to the purpose or effect of the relationship; financial interdependence; common personnel exercising authority over business decisions; and structural features indicating evasion of applicable thresholds.

We believe this approach is consistent with existing frameworks for identifying non-majority ownership relationships. For example, section 3(14)(I) of ERISA expressly designates as a “party in interest” any 10 percent or more partner or joint venturer of a person described in other party-in-interest categories, providing precedent for addressing joint venture relationships. In addition, the SEC's Regulation 13D-G distinguishes passive investment from control-seeking investment based on whether the holding was acquired or is held “with the purpose or effect of changing or influencing the control of the issuer,” providing precedent for a facts-and- circumstances residual test. Finally, at proposed paragraph (a)(5), we propose that the following principles apply to paragraphs (a)(2) through (4): (i) Entity-form neutrality. “Interest” would be measured by voting power or equity value for corporations; capital or profits interest for partnerships and LLCs; and beneficial interest for trusts and unincorporated enterprises. (ii) Right-to-acquire rules. The right to acquire an ownership interest exercisable within 60 days—through option, warrant, conversion, or revocable proxy—would be treated as a present holding of that interest.

We intend that in the context of vertically integrated structures, the potential affiliation of an entity under this proposal would be assessed based on that particular entity's relationship to the PBM or Part D plan sponsor. If an entity is part of the same vertically integrated structure as a PBM or Part D plan sponsor, then we intend for that entity to be an affiliate of that PBM or Part D plan sponsor as described at § 423.2806(a)(2). If an entity is not part of the same vertically integrated structure as a PBM or Part D plan sponsor, then we intend that the entity would not be an affiliate of the PBM or Part D plan sponsor in the vertically integrated structure unless that entity has a direct relationship with that PBM or Part D plan sponsor and meets the affiliate criteria as described at § 423.2806(a)(3) and (4). We do not intend that affiliation with an entity that is in a vertically integrated structure with a PBM or Part D plan sponsor would confer affiliation with such PBM or Part D plan sponsor, absent a direct relationship with that PBM or Part D plan sponsor that meets the affiliation criteria described at § 423.2806.

We solicit comment on these proposals.

(ii) Functional and Contractual Prong

The functional and contractual prong, set out in the second clause of the affiliate definition, encompasses any entity that acts as a contractor, principal, or agent to a PBM or Part D plan sponsor, “insofar as” that contractor, principal, or agent performs any PBM function.

Unlike the ownership or control prong, which applies categorically to any entity meeting certain relational requirements, the functional and contractual prong conditions affiliate status on an entity's actual performance of PBM functions. The PBM definition is similarly functional, conditioning PBM status on the performance of PBM functions. However, affiliate status under the functional and contractual prong attaches when an entity “acts as a contractor, principal, or agent to such PBM or PDP sponsor, insofar as such contractor, principal, or agent performs any of the functions described under subparagraph (C)” (emphasis added).

To determine when affiliate status attaches under the functional and contractual prong, we propose to clarify the effect of the “insofar as” language. We considered several interpretive approaches.

First, we considered a purposive approach under which affiliate status would attach only when performing one or more PBM functions constitutes the primary role under the relevant contract. However, this approach, risks excluding entities retained for multiple purposes where PBM functions represent a substantial—though not primary—component of the contractual relationship. Therefore, we believe this approach would be underinclusive.

Second, we considered establishing quantitative thresholds—such as minimum claims volume or dollar value of transactions—below which an entity's performance of a listed function would not trigger affiliate status. However, calibrating appropriate thresholds across the full range of PBM functions would be analytically complex, and this approach would be susceptible to manipulation through contractual arrangements deliberately structured to fall below any imposed threshold.

Third, we considered applying the same “any performance standard” we are proposing for PBM status. However, this approach, would fail to give effect to the “insofar as” language in the functional and contractual prong, which has no equivalent in the PBM definition. We also believe this approach could be overinclusive, categorizing entities as ( printed page 66445) affiliates even when they perform PBM functions solely on an incidental basis.

Finally, we considered and elected to propose to codify at proposed § 423.2806(b) that affiliate status attaches under the functional and contractual prong where a contractor, principal, or agent performs one or more PBM functions as a material part of its contractual services. We believe this standard appropriately captures entities for which PBM functions constitute a significant portion of their contractual obligations, without sweeping in entities that perform such functions only incidentally or excluding entities for which such functions are a major—but not primary—part of their contractual obligations.

We solicit comment on this proposal.

5. Part D Plan Sponsor Contracts

Section 1860D-12(h)(1) of the Act requires that, for plan years beginning on or after January 1, 2028, each contract entered into with a Part D plan sponsor under Part D with respect to a prescription drug plan offered by such sponsor must provide that any PBM acting on behalf of such sponsor has a written agreement, acceptable to CMS, with the Part D plan sponsor under which the PBM, and any affiliates of such PBM, as applicable, agree to meet the requirements described in 1860D-12(h)(1)(A) through (D) of the Act. We propose to codify this requirement at §§ 423.2808 and 423.505(b)(28).

Consistent with our authority under sections 1860D-12(b)(3)(D) and (h)(1) of the Act, we propose and further describe the requirements that must be included in the written agreement between the Part D plan sponsor and the PBM acting on behalf of such sponsor in sections II.C.6 through 10. of this proposed rule, and sections II.C.11.b. and c. of this proposed rule, as well as in §§ 423.2810, 423.2812, 423.2814, 423.2816, 423.2818, and 423.2820(b) and (c).

6. Remuneration Requirements

a. Bona Fide Service Fees

Section 1860D-12(h)(1)(A)(i) of the Act, as added by the CAA, requires that PBMs and any affiliates of such PBMs shall not derive any remuneration with respect to any services provided on behalf of any entity or individual, in connection with the utilization of covered Part D drugs, from any such entity or individual other than bona fide service fees, defined in added section 1860D-12(h)(7)(B) of the Act, subject to clauses in section 1860D-12(h)(1)(A)(ii) and(iii) of the Act. This requirement to limit remuneration to bona fide service fees addresses concerns that PBM practices such as spread pricing or rebate retention may contribute to higher drug costs ^[39] by prohibiting income other than flat dollar amounts for specific, itemized services. Additionally, this requirement addresses concerns that even administrative fee structures (as opposed to spread pricing or rebate retention) create incentives for PBMs to favor higher cost drugs when the administrative fees are based on a percent of the cost of the drug ^[40] by prohibiting bona fide service fees from being directly or indirectly based on, or contingent on, drug price.

We are proposing to codify at § 423.2810(b) the statutory requirement that a bona fide service fee be defined as a fee that is reflective of the fair market value (defined at § 423.2802(c)) for a bona fide, itemized service actually performed on behalf of an entity, that the entity would otherwise perform (or contract for) in the absence of the service arrangement and that is not passed on in whole or in part to a client or customer, whether or not the entity takes title to the drug. Such fee must be a flat dollar amount and shall not be directly or indirectly based on or contingent upon—drug price (such as wholesale acquisition cost) or drug benchmark price (such as average wholesale price); the amount of discounts, rebates, fees, or other direct or indirect remuneration with respect to covered Part D drugs dispensed to enrollees in a prescription drug plan, except as permitted under the definition of incentive payments at proposed § 423.2802; coverage or formulary placement decisions or the volume or value of any referrals or business generated between the parties to the arrangement; or the amounts or methodologies prohibited at proposed § 423.2810(b)(3).

(1) Remuneration

Section 1860D-12(h)(1)(A)(i) of the Act sets out a general rule that a PBM and any affiliate of a PBM “shall not derive any remuneration with respect to any services provided on behalf of any entity or individual, in connection with the utilization of covered Part D drugs, from any such entity or individual other than bona fide service fees. . . .”

This statutory provision has two operative components. First, “remuneration” determines which payment streams are subject to the prohibition. Second, “in connection with covered Part D drug utilization” determines when the restriction applies. Together, these components define the universe of PBM and affiliate remuneration subject to the bona fide service fee restrictions under 1860D-12(h) of the Act.

To determine which payment streams are subject to the general prohibition, we must first understand the meaning of “remuneration” in the context of section 1860D-12(h) of the Act. The statutory structure provides several contextual clues.

First, section 1860D-12(h)(1)(A)(i) of the Act uses the phrase “any remuneration” rather than a narrower term such as “fees,” “payments,” or “compensation.”

Second, section 1860D-12(h)(1)(A)(iii) of the Act creates a specific exception to the prohibition for manufacturer rebates, discounts, and other price concessions under certain conditions. That exception would be unnecessary if such payments were not otherwise encompassed within the general category of remuneration.

Third, section 1860D-12(h)(4) of the Act sets out a rule of construction providing that nothing in section 1860D-12(h) of the Act shall be construed as: (A) prohibiting flat dispensing fees or reimbursement or payment for ingredient costs—including customary, industry-standard discounts directly related to drug acquisition that are retained by pharmacies or wholesalers—to entities that acquire or dispense prescription drugs; or (B) modifying regulatory requirements or subregulatory program instructions or guidance related to pharmacy payment, reimbursement, or dispensing fees. This rule of construction would similarly be unnecessary if such payments did not otherwise fall within the general category of remuneration.

Given this statutory structure, we believe “remuneration” must be understood broadly for purposes of section 1860D-12(h) of the Act. Several Part D regulatory provisions, as well as related statutory and regulatory frameworks, already establish concepts of remuneration with respect to services provided in connection with the utilization of Part D drugs, and these provide valuable precedent for specifying the scope of remuneration in this context.

The new statutory provisions cite some of these concepts. For example, the exception for manufacturer rebates, ( printed page 66446) discounts, and other price concessions at section 1860D-12(h)(1)(A)(iii) of the Act imposes two conditions: (1) the rebates, discounts, and other price concessions must be fully passed through to the Part D plan sponsor, and (2) they must comply with all regulatory and subregulatory requirements related to DIR for manufacturer rebates, discounts, and other price concessions.

CMS has defined several concepts related to remuneration in the context of DIR that are relevant here; the exception for price concessions depends in part on compliance with these existing DIR-related regulatory requirements.

Under 42 CFR 423.308, costs are “actually paid” only if they are actually incurred by the Part D plan sponsor and are net of any DIR—including “discounts, chargebacks or rebates, cash discounts, free goods contingent on a purchase agreement, up-front payments, coupons, goods in kind, free or reduced-price services, grants, or other price concessions or similar benefits”—from manufacturers, pharmacies, enrollees, or any other person that would serve to decrease costs incurred under the Part D plan. Under this provision, remuneration may be direct or indirect, encompass both cash and non-cash value, and include rebates, discounts, price concessions, chargebacks, coupons, grants, and similar benefits.

The definition of “price concession” at 42 CFR 423.100 further supports a broad interpretation of the concept of remuneration. That provision defines a price concession as any form of discount, direct or indirect subsidy, or rebate received by the Part D plan sponsor or its intermediary contracting organization from any source that serves to decrease costs incurred under the Part D plan. It includes discounts, chargebacks, rebates, cash discounts, free goods contingent on purchase agreements, coupons, free or reduced-price services, goods in kind, and other similar benefits—as well as credits, offsets, non-cash benefits, in-kind benefits, and similar direct or indirect financial advantages. Under the statutory structure of section 1860D-12(h) of the Act, such payments would constitute remuneration if the requirements of section 1860D-12(h)(1)(A)(iii) of the Act are not satisfied.

While the provisions discussed previously illustrate the breadth of payments encompassed by “remuneration” for purposes of section 1860D-12(h) of the Act, other statutory frameworks governing remuneration in connection with Part D drug utilization offer precedent for the outer limits of the term.

Specifically, under section 1128B(b) of the Act, the Anti-Kickback Statute (AKS) prohibits knowingly and willfully soliciting, receiving, offering, or paying “any remuneration”—including any kickback, bribe, or rebate—directly or indirectly, overtly or covertly, in cash or in kind, in return for or to induce referrals, purchases, leases, orders, or recommendations involving items or services payable by a Federal health care program. The OIG has consistently interpreted “any remuneration” in the AKS context to mean “anything of value.”

Although the regulatory contexts of the AKS and section 1860D-12(h) of the Act differ, both statutes use the same phrase—“any remuneration”—to describe the payments subject to their respective restrictions. Accordingly, we believe it is reasonable to define the outer boundaries of “remuneration” for purposes of section 1860D-12(h) of the Act consistently with the AKS.

Therefore, we propose to define “remuneration” at 42 CFR 423.2802 to mean anything of value, whether provided directly or indirectly, overtly or covertly, in cash or in kind, including, but not limited to, monetary payments, non-cash consideration, administrative fees, data fees, service fees, spread pricing, retained margins, rebates, discounts, chargebacks, price concessions, credits, offsets, up-front payments, coupons, free or reduced-price goods or services, goods in kind, grants, in-kind benefits, guarantee reconciliation amounts, interest payments, financing benefits, and any other direct or indirect financial advantage.

(2) A Service That the Entity “Would Otherwise Perform, or Contract For”

Section 1860D-12(h)(7)(B) of the Act states that a bona fide service fee must be “for a bona fide, itemized service actually performed on behalf of an entity, that the entity would otherwise perform (or contract for) in the absence of the service arrangement.” As discussed in section II.C.6.a. of this proposed rule, we are proposing to define a bona fide service fee as a fee for a bona fide, itemized service actually performed on behalf of an entity, that the entity would otherwise perform, or contract for, in the absence of the service arrangement.

This proposed definition would establish that a fee paid to a PBM will not qualify as a bona fide service fee unless certain conditions are met. To qualify as a bona fide service fee, the underlying service must be one that the entity on whose behalf the service is performed would itself perform, or procure through a third-party contract, absent the service arrangement. The “would otherwise perform, or contract for” requirement helps to distinguish legitimate service fees from fees that have no meaningful connection to the purchaser's actual operational needs (such as a data portal fee). To ensure that bona fide service fees reflect genuine value exchanged for real services tied to the entity's operational needs, we are proposing to establish a regulatory standard for determining when a service qualifies as a “service that the entity would otherwise perform, or contract for.” Absent such a standard, the bona fide service fee framework could potentially be circumvented through arrangements in which fees are nominally labeled as service fees but are for activities that the entity would not otherwise perform.

To define what constitutes a service that an entity would otherwise perform or contract for, and to establish how we would evaluate whether a particular service meets that standard, we considered definitions previously contemplated in rulemaking, including the Medicare Program; Revisions to Payment Policies, Five-Year Review of Work Relative Value Units, Changes to the Practice Expense Methodology Under the Physician Fee Schedule, and Other Changes to Payment Under Part B; Revisions to the Payment Policies of Ambulance Services Under the Fee Schedule for Ambulance Services; and Ambulance Inflation Factor Update for CY 2007 (“CY 2007 PFS”). The CY 2007 PFS final rule established that, beginning with average sales price (ASP) reporting for sales during the first quarter of CY 2007, bona fide service fees that are paid by a manufacturer to an entity, whether or not the entity takes title to the drug, are not considered price concessions under § 414.804(a)(2) insofar as, and to the extent that, they satisfy the definition of a bona fide service fee described at § 414.802: “fees paid by a manufacturer to an entity, that represent fair market value for a bona fide, itemized service actually performed on behalf of the manufacturer that the manufacturer would otherwise perform (or contract for) in the absence of the service arrangement [. . .].”

The CY 2007 PFS explained that these elements of the definition of bona fide service fees established at § 414.802 “encompass any reasonably necessary or useful services of value to the manufacturer that are associated with the efficient distribution of drugs.” While this existing definition addresses the concept from the manufacturer's perspective, the concept that a qualifying service must reflect a ( printed page 66447) reasonably necessary or useful service of value associated with the efficient distribution of drugs to the entity on whose behalf it is performed is equally appropriate in the context of services performed by a PBM (or other entity) on behalf of Part D plan sponsors. Therefore, we are proposing a definition of “a service that the entity would otherwise perform, or contract for” that largely aligns with the definition and interpretation of this concept in the CY 2007 PFS final rule, with some additional specifications.

Importantly, there is a distinction between the PBM function performance standard proposed at section 423.2804(b) and the “would otherwise perform, or contract for” requirement. As discussed in section II.C.3. of this proposed rule, under the Act, a PBM is any person or entity that (1) acts as a price negotiator or group purchaser on behalf of a Part D plan sponsor or prescription drug plan; or (2) manages the prescription drug benefits provided by such a sponsor or plan. The Act states that management of prescription drug benefits includes the processing and payment of prescription drug claims, drug utilization review, processing of prior authorization requests, adjudication of appeals or grievances related to the prescription drug benefit, contracting with network pharmacies, controlling the cost of covered Part D drugs, and the provision of related services, but does not limit prescription drug benefit management to these activities.

This illustrative list of PBM functions enumerated in the statute is relevant to, but not determinative of, whether a particular service for which the entity is paying remuneration to the PBM is one that an entity would otherwise perform or contract for in the absence of a service arrangement with a PBM. Although there will often be substantial overlap between PBM functions and services that an entity would otherwise perform or contract for, the two concepts are distinct, and satisfying one does not necessarily satisfy the other. The fact that a service may be one an entity would otherwise perform or contract for does not itself determine PBM status, which is dependent on the performance of specific PBM functions, as proposed at § 423.2804(b).

To further clarify this distinction between the PBM function performance standard proposed at section 423.2804(b) and the “would otherwise perform, or contract for” requirement of the proposed bona fide service fees definition proposed here, the PBM function performance standard is a threshold that identifies when a person or entity is performing a PBM function, as defined at proposed § 423.2802 and as discussed in section II.C.3. of this proposed rule. By contrast, the “would otherwise perform, or contract for” requirement proposed here is a separate payment-eligibility standard within the proposed bona fide service fee definition. Relevant to this standard is whether the service for which the fee is paid is a service of operational, administrative, clinical, financial, compliance, or programmatic value to the entity on whose behalf the service is performed, such that the entity would reasonably perform the service itself or procure it from another party in the absence of the service arrangement.

We propose to establish at § 423.2810(b)(2) that a service qualifies as “a service that the entity would otherwise perform, or contract for” if the service is a necessary or useful service of operational, administrative, clinical, financial, compliance, or programmatic value to the entity on whose behalf the service is performed, such that the entity would perform the service itself or procure it from another party in the absence of the service arrangement. We seek comment on this proposed definition and whether additional guidance or examples would be useful to illustrate the application of this payment-eligibility standard within the bona-fide service fee definition to specific types of services commonly encountered in the Part D marketplace.

(3) Definition of “In Connection With the Utilization of Part D Drugs”

Section 1860D-12(h)(1)(A)(i) of the Act prohibits PBMs and their affiliates from deriving any remuneration other than bona fide service fees for any services in connection with the utilization of covered Part D drugs, from any entity or individual. Determining whether a payment arrangement is “in connection with the utilization of covered Part D drugs” establishes whether the prohibition in section 1860D-12(h)(1)(A)(i) of the Act applies. If a payment to a PBM is unrelated to the utilization of Part D drugs (as defined at § 423.100), the payment is not covered by this prohibition. Clarity in this prong of the prohibition is therefore important to ensure an appropriate scope that neither allows entities to circumvent the statutory prohibition by labeling payments as unrelated to Part D drugs even when such a connection exists, nor applies to payments that truly have no connection to Part D drug utilization.

For this reason, we are proposing to define what it means for remuneration to be in connection with the utilization of Part D drugs. We also propose to clarify the treatment of remuneration arrangements that involve both Part D drugs and non-Part D drugs, because the prohibition applies specifically to remuneration received in connection with the utilization of Part D drugs, and not to remuneration received in connection with drugs dispensed under other benefit programs, such as Medicaid or commercial insurance.

We propose that remuneration is “in connection with the utilization of Part D drugs” if the remuneration relates to the prescribing, dispensing, furnishing, coverage, reimbursement, or management of Part D drugs, including activities that directly or indirectly influence or determine such utilization. For services supporting multiple lines of business, only the portion of remuneration allocable to the utilization of Part D drugs under a Part D plan would be considered to be in connection with such utilization.

This definition reflects two important principles. First, “in connection with utilization” is construed broadly to encompass the full range of activities that contribute to a Part D drug being prescribed, dispensed, furnished, covered, reimbursed, or managed on behalf of Part D enrollees. This includes not only the direct act of dispensing a drug but also upstream (for example, formulary placement, contracting with network pharmacies) and downstream (for example, processing and payment of prescription drug claims, adjudication of appeals or grievances related to the prescription drug benefit) activities that directly or indirectly influence or determine whether and how Part D drugs are utilized.

Second, we recognize that PBMs frequently administer benefits that span multiple lines of business, including Part D, Medicaid, and commercial insurance, and that a single service (and the remuneration associated with it) may not always be solely attributable to a single line of business. We propose a definition of “in connection with the utilization of Part D drugs” that is designed to reflect this reality by clarifying that “only the portion of remuneration allocable to the utilization of Part D drugs under a Part D plan is considered.” Therefire, we propose that, where a service performed by a PBM or its affiliate encompasses Part D drug utilization—even if it also encompasses non-Part D activity—only the portion of remuneration allocable to the utilization of Part D drugs under a Part D plan is subject to the bona fide service fee requirement.

This allocability standard would operate as follows. Where a PBM ( printed page 66448) performs a service that covers both Part D and non-Part D drug utilization, the total remuneration received for that service is not excluded from the prohibition simply because the service also encompasses activity that does not involve a Part D drug. Rather, the PBM must allocate the total remuneration between the portion that is in connection with the utilization of Part D drugs and portion that is not connection with the utilization of Part D drugs when reporting on remuneration to a Part D plan sponsor, following the standards at proposed § 423.2810(e)(1)(ii)(B). That portion allocated to the utilization of Part D drugs is the amount subject to the bona fide service fee requirement.

We propose to codify this definition at 423.2810(h). We seek comment on the proposal and whether the allocability standard described previously provides sufficient clarity and flexibility for PBMs and Part D plan sponsors to identify and allocate remuneration under mixed arrangements. We also seek comment on whether additional guidance or specific examples would be useful to address particular types of services or remuneration structures commonly encountered in the Part D marketplace.

(4) Fair Market Value for Bona Fide Service Fees

In accordance with section 1860D-12(h)(7)(B) of the Act, bona fide service fees must be “reflective of the fair market value (as specified by the Secretary, through notice and comment rulemaking)”. In specifying the meaning of fair market value for bona fide service fees, we considered definitions previously contemplated in federal rulemaking, including the Medicare Program; Revisions to Payment Policies, Five-Year Review of Work Relative Value Units, Changes to the Practice Expense Methodology Under the Physician Fee Schedule, and Other Changes to Payment Under Part B; Revisions to the Payment Policies of Ambulance Services Under the Fee Schedule for Ambulance Services; and Ambulance Inflation Factor Update for CY 2007 (“CY 2007 PFS”) and the Medicare and Medicaid Programs; CY 2026 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Shared Savings Program Requirements; and Medicare Prescription Drug Inflation Rebate Program (“CY 2026 PFS”).

The CY 2007 PFS final rule established that, beginning with average sales price (ASP) reporting for sales during the first quarter of CY 2007, bona fide service fees that are paid by a manufacturer to an entity, whether or not the entity takes title to the drug, are not considered price concessions under § 414.804(a)(2) insofar as, and to the extent that, they satisfy the definition of a bona fide service fee described at § 414.802: “fees paid by a manufacturer to an entity, that represent fair market value for a bona fide, itemized service actually performed on behalf of the manufacturer that the manufacturer would otherwise perform (or contract for) in the absence of the service arrangement, and that are not passed on in whole or in part to a client or customer of an entity, whether or not the entity takes title to the drug.” The CY 2007 PFS final rule did not provide guidance on specific methodologies that manufacturers must use to determine fair market value.

The CY 2026 PFS proposed rule elaborated on the approach to fair market value, as applied to the definition of bona fide service fees that are not considered price concessions under § 414.804(a)(2). CMS proposed additional requirements for the standards and methodology that should be used to determine fair market value, specifically: for fees paid by a manufacturer to an entity that do not vary directly with the amount of drug sold or price of a manufacturer's drug, the fair market value must be determined either based on comparable market transactions that generally reflect current market conditions or the cost of the service plus a reasonable markup to the total cost, and for fees paid by a manufacturer to an entity that vary directly with the amount of drug sold or price of a manufacturer's drug, the fair market value must be determined by using the cost of the service and adding a reasonable markup to the total cost. CMS further proposed that for fees paid by a manufacturer to an entity that vary directly with the amount of drug sold or price of a manufacturer's drug, if any material portion of cost data is not available, manufacturers should follow a market-based approach based on verifiable market data until such time as sufficient cost data becomes available. CMS additionally proposed that under such circumstances, the fair market value assessment must be conducted by an independent, third-party valuator that does not have any financial relationship (other than the arrangement to conduct fair market value analyses) with either party to the arrangement and no stake in the outcome of the valuation, and the assessment must be documented with a clear explanation, including a description of the methodology used. Finally, CMS proposed to require that manufacturers update fair market analyses no less frequently than the renewal period of the agreement for the service arrangement between the manufacturer and the other entity and that they include documentation of the update in the reasonable assumptions documentation corresponding with the quarter when the update was made. CMS did not finalize these proposals, which were regulatory actions and not statutorily required, in the CY 2026 PFS final rule.

We believe that, of the previously approaches to fair market value previously contemplated by CMS, the approach proposed in the CY 2026 PFS proposed rule for purposes of average sales price reporting provides the most appropriate foundation for specifying the meaning of fair market value under Section 1860-D(h)(7)(B) of the Act, since it includes the most detail and was informed by market dynamics that CMS had observed since the earlier CY 2007 PFS rule. We are proposing a definition of fair market value that largely aligns with the approach in the CY 2026 PFS proposed rule, with some changes due to the differences between the programs and the introduction of additional requirements by the CAA. For example, because section 1860-D(h)(7)(B) of the Act specifies that bona fide service fees “shall not be directly or indirectly based on, or contingent upon” drug price, we are not proposing a separate fair market value standard for fees that vary with the manufacturer's price of a drug. Additionally, our proposed definition would apply to a broader set of fees than those paid by a pharmaceutical manufacturer, since it would apply to any remuneration received by a PBM or any affiliates of such PBM from any individual or entity in connection with the utilization of Part D drugs. Finally, whereas the purpose of the CY 2026 proposed rule was to define bona fide service fees to inform average sales price reporting, the purpose of this rule is to define bona fide service fees in the broader context of the statutory requirement that generally prohibits PBMs and their affiliates from receiving remuneration other than bona fide service fees with respect to services provided on behalf of any entity or individual in connection with the utilization of Part D drugs.

We are proposing at § 423.2810(e)(1) that fair market value be defined as the cost of the itemized service plus a reasonable markup to the total cost, for all bona fide service fees. This single definition of fair market value for bona fide service fees differs from the ( printed page 66449) definition in the CY 2026 PFS proposed rule—which contemplated different standards for fees that do and do not vary directly with the amount of drug sold or price of a manufacturer's drug—because section 1860D-12(7)(B) provides that bona fide service fees may not be directly or indirectly based on or contingent upon drug price. Commenters did raise concerns with the cost-based definition of fair market value in response to the CY 2026 PFS proposed rule. Specifically, commenters argued that CMS should allow multiple valuation approaches (cost-, market-, income-based, or hybrid) to reflect market realities, that the existing average sales price framework for fair market value (which does not specify a particular valuation methodology) is adequate, and that fees based on a percentage of drug cost are not inherently improper. However, we believe those comments and concerns are not relevant to this proposal for several reasons. First, the context in which we are undertaking this rulemaking is different than the context in which the CY 2026 PFS was developed due to the unique requirements of section 1860D-12(h) of the Act, as added by the CAA. The CAA enumerated requirements for bona fide service fees and expressly instructed the Secretary to specify the meaning of fair market value, delegating authority to the Secretary to consider definitions of fair market value beyond the PFS framework, as well as imparting a statutory imperative to address fair market value (whereas the proposed definition of fair market value in the CY 2026 PFS rule was a regulatory action). Second, the CAA explicitly prohibits bona fide service fees from being tied to the price of a drug, so comments in response to the CY 2026 PFS proposed rule defending fees that are a percentage of drug cost are not relevant in the context of the CAA. Third, the comments in response to the CY 2026 PFS proposed rule contemplated the definition of fair market value specifically in the context of bona fide service fees that may be retained in the determination of average sales price reported to CMS by the manufacturer, rather than in the context of bona fide service fees received by any PBM or affiliate of such PBM in connection with the utilization of Part D drugs. We do not assume that the public comments submitted in response to the CY 2026 PFS proposed rule provide a comprehensive picture of sentiment regarding a cost-based definition of fair market value outside of the context of average sales price reporting, and we are soliciting public comment on our proposed definition of fair market value for application in the context of regulations implementing section 1860D-12(h) of the Act.

If observed data on any material portion of the cost of the service are not available—for example, if the PBM or affiliate of such PBM begins providing a new service for the first time—we propose at § 423.2810(e)(1)(i) that the fair market value for the bona fide service fee be defined as an estimate of the expected cost of the itemized service plus a reasonable markup to the total cost, until such time as sufficient observed cost data are available. Sufficient observed cost data would be considered available no later than 1 year after the bona fide service fee based on estimated costs is in effect. In addition, we propose that the estimated cost be consistent with, if available, the cost to the PBM or affiliate of such PBM of providing other itemized services, with reasonable adjustments as necessary to account for bona fide differences between the resources needed to perform each itemized service. For example, a PBM or affiliate would use the actual labor costs associated with employees with similar credentials and job requirements who perform other itemized services on behalf of the PBM or affiliate when estimating the labor costs of providing a new itemized service for which any material portion of cost data is not available to the PBM or affiliate. We propose using an estimate of expected costs—rather than a market-based approach based on verifiable market data until such time as sufficient cost data becomes available as proposed in the CY 2026 PFS proposed rule—for several reasons. CMS received many comments in response to the CY 2026 proposed rule arguing that the proposed requirement for use of an independent, third-party valuator that does not have any financial relationship (other than the arrangement to conduct fair market value analyses) with either party to the arrangement and no stake in the outcome of the valuation would disrupt the market and add significant burden since there are few valuators that currently meet that requirement. We also believe that PBMs and their affiliates typically have either sufficient data on their own internal costs or a sufficient ability to estimate their own expected costs, such that a cost-based approach to fair market value is appropriate for any services provided by PBMs or their affiliates in connection with the utilization of Part D drugs.

To clarify what expenses should be considered costs, we examined existing federal regulations that address cost-based compensation structures. Federal Acquisition Regulation (FAR) 31.201-1 describes the composition of total costs for federal acquisition as: “The total cost, including standard costs properly adjusted for applicable variances, of a contract is the sum of the direct and indirect costs allocable to the contract, incurred or to be incurred, plus any allocable cost of money pursuant to 31.205-10, less any allocable credits. In ascertaining what constitutes a cost, any generally accepted method of determining or estimating costs that is equitable and is consistently applied may be used.” FAR 31.201-2 describes requirements for the allowability of costs, including compliance with requirements of reasonableness, allocability, standards promulgated by the Cost Accounting Standards Board (an independent, statutorily established board that creates and maintains cost accounting standards for federal contracts), and the terms of the contract under which the costs are incurred. The FAR further defines reasonableness and allocability at FAR 31.201-3 and FAR 31.201-4 and discusses the treatment of credits in FAR 31.201-5.

The Office of Management and Budget (OMB) guidance on federal awards is similar to the regulations in the FAR in its instructions on identifying costs. OMB's guidance at 2 CFR 200.402 defines composition of costs as: “The total cost of a Federal award is the sum of the allowable direct and allocable indirect costs minus any applicable credits”. OMB's guidance at 2 CFR 200.403 describes factors affecting the allowability of costs. For example, allowable costs must be determined in accordance with generally accepted accounting principles (GAAP) with limited exceptions, must be adequately documented, and must be accorded consistent treatment (for example, a cost must not be treated as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated as an indirect cost). OMB's guidance at 2 CFR 200.404 and 200.405 further defines reasonable costs and allocable costs, and OMB's guidance at 2 CFR 200.406 discusses treatment of applicable credits.

While bona fide service fees under section 1860D-12(h) of the Act are for itemized services provided by PBMs and their affiliates to any individual or entity—which is unlikely to include services furnished to the government through a federal award—we propose to adopt some of the principles described in the previously regulations in order to establish consistency, fairness, and transparency in the determination of costs. Accordingly, we propose at ( printed page 66450) § 423.2810(e)(1)(ii) to define the cost of an itemized service as “the sum of the allowable costs minus any applicable credits”. Furthermore, we propose that allowable costs must be reasonable, allocable, determined in accordance with generally accepted accounting principles (GAAP), supported by adequate documentation, and accorded consistent treatment.

We propose at § 423.2810(e)(1)(ii)(A) that a reasonable cost cannot exceed an amount that a prudent person would incur under the circumstances prevailing when the decision was made to incur the cost, in alignment with OMB's guidance at 2 CFR 200.404, and further propose that in determining reasonableness, consideration must be given to the following: (1) whether the cost is generally recognized as ordinary and necessary for the recipient's performance of the itemized service; (2) the restraints or requirements imposed by such factors as sound business practices; arm's-length bargaining; Federal, State, local, tribal, and other laws and regulations; (3) the cost of comparable market transactions; (4) whether the cost represents a deviation from the recipient's established written policies and procedures for incurring costs; (5) whether the cost is subject to any bias due to overlap between the individuals who negotiate the bona fide service fee and the individuals who negotiate remuneration or transactions other than bona fide service fees or incentive payments with the entity that pays the bona fide service fee; and (6) whether the cost is comparable to costs incurred for similar services in the general, non-health care market.

These requirements largely mirror the requirements for reasonableness at OMB's guidance at 2 CFR 200.404. The requirement at § 423.2810(e)(1)(ii)(A)(5) addresses a concern that the negotiation of bona fide service fees between PBMs or affiliates of such PBMs and other entities could bias or be biased by the negotiation of other remuneration or transactions—such as rebates negotiated with manufacturers or payment rates negotiated with pharmacies—if the same parties are responsible for negotiating both bona fide service fees and the other remuneration or transactions. The requirement at § 423.2810(e)(1)(ii)(A)(6) attempts to prevent costs from continuing to be artificially inflated simply because the health care market has historically borne high costs.

We propose at § 423.2810(e)(1)(ii)(B) that in order for a cost to be generally allocable to an itemized service, the cost must be assignable to that itemized service in accordance with the relative benefits received. This standard can be met if the cost satisfies any of the following criteria: (a) is incurred specifically for that itemized service; (b) benefits both the itemized service and other work of the recipient and can be distributed in proportions that may be approximated using reasonable methods; or (c) is necessary to the overall operation of the recipient and is assignable in part to the itemized service in accordance with these cost principles. We are also proposing the following:

• Section 423.2810(e)(1)(ii)(B)(2)( i): All itemized services which benefit from the recipient's indirect cost will receive an appropriate allocation of indirect costs.
• Section 423.2810(e)(1)(ii)(B)(2)( ii): A cost allocable to a particular itemized service may not be allocated to other itemized services.
• Section 423.2810(e)(1)(ii)(B)(2)( iii): If a cost benefits two or more itemized services in proportions that can be determined without undue effort or cost, the cost must be allocated to the itemized services based on the proportional benefit.

However, when those proportions cannot be determined because of the interrelationship of the work involved, then, notwithstanding paragraph (e)(1)(ii)(B)( 2)( ii), the costs may be allocated or transferred to itemized service on any reasonable documented basis.

Finally, with respect to allocability, we propose at § 423.2810(e)(1)(ii)(B)( 3) that the data and assumptions used to allocate costs must be updated not less than annually. This requirement would ensure that bona fide services fees are tied to actual costs regardless of the level of service at which the bona fide service fee is determined. In a simplified example, assume that the primary cost underlying the service of claims adjudication for a given PBM is the development and maintenance of software, such that the cost to the PBM to process 1,000,000 claims in a year is the same as the cost to process 10,000,000 claims in a year. If the PBM defines the itemized service at the per-claim level and allocates the annual cost of providing the service using a projected number of claims processed, the aggregate bona fide service fees received by the PBM for the claims adjudication service in a plan year could fail to reflect cost if the actual number of claims processed under the agreement is significantly more or less than the projected number of claims. Annual updates to the data and assumptions used in the allocation of costs will ensure that bona fide service fees remain reflective of underlying cost. To the extent that the PBM or affiliate of such PBM experiences economies of scale that cause the marginal cost per service to decrease as the amount of the service provided increases, the allocation of costs should reflect such information.

We propose at § 423.2810(e)(1)(ii)(B)( 2)( iv) that applicable credits refer to transactions that offset or reduce direct or indirect costs allocable to an itemized service. Examples of such transactions are purchase discounts, rebates or allowances, recoveries or indemnities on losses, insurance refunds or rebates, and adjustments of overpayments or erroneous charges. To the extent that such credits accruing to or received by the recipient relate to allowable costs, they must be credited to the itemized service either as a cost reduction or cash refund, as appropriate.

We solicit comment on these proposals for defining allowable costs, including whether they provide sufficient safeguards to ensure that costs are not inappropriately inflated and unrepresentative of fair market value.

In addition to the previously proposals to apply certain requirements to allowable costs, we believe it is also appropriate to apply certain requirements to the definition of “reasonable” as it applies to reasonable markup of total costs in the determination of fair market value for bona fide service fees. As noted previously, both the FAR and OMB guidance apply a reasonableness requirement to costs for cost-based awards. We believe that it is appropriate to generally align the standard of reasonable markup with the reasonableness standards used in these regulations for consistency. However, because several elements of the definition of reasonable costs are specific to the core cost and would translate imperfectly to the concept of markup, we believe certain modifications are necessary. Therefore, we propose at § 423.2810(e)(1)(iii) that reasonable markup cannot exceed an amount that a prudent person would apply under the circumstances prevailing when the decision regarding the amount of the markup was made and further propose that in determining reasonableness, consideration must be given to the following: (1) the restraints or requirements imposed by such factors as sound business practices; arm's-length bargaining; Federal, State, local, tribal, and other laws and regulations; (2) comparable market transactions; (3) whether the markup represents a deviation from the recipient's ( printed page 66451) established written policies and procedures for determining markup; (4) whether the markup is subject to any bias due to overlap between the individuals who negotiate the bona fide service fee and the individuals who negotiate remuneration or transactions other than bona fide service fees or incentive payments with the entity that pays the bona fide service fee; and (5) whether the markup is comparable to markup applied for similar services in the general, non-health care market. We considered a single quantitative percent ceiling on reasonable markup but did not propose this option due to the diversity of entities that may fit the definition of PBM or affiliate of such PBM and the wide variation in the types of services they provide. We also considered not defining “reasonable” with respect to markup and instead requiring that the PBM or affiliate of such PBM disclose the percent of the markup to the entity paying the bona fide service fee. We solicit comment on our proposed requirements for reasonable markup, including whether there are additional requirements we should include.

We solicit comment on the previous proposals, including whether there are circumstances for which we should allow an alternative definition of fair market value for bona fide service fees, including but not limited to circumstances in which fair market value could be determined based on comparable market transactions. We also solicit comment on whether there are any requirements that should be placed on alternative mechanisms for defining fair market value, such as requiring use of an independent, third-party valuator without any financial relationship (other than the arrangement to conduct fair market value analyses) with either party to the arrangement and no stake in the outcome of the valuation.

Section 1860D-12(h)(7)(B) of the Act provides that bona fide service fees shall not be directly or indirectly based on, or contingent upon—(i) drug price, such as wholesale acquisition cost or drug benchmark price (such as average wholesale price); (ii) the amount of discounts, rebates, fees, or other direct or indirect remuneration with respect to Part D drugs dispensed to enrollees in a prescription drug plan, except as permitted pursuant to paragraph (1)(A)(ii); (iii) coverage or formulary placement decisions or the volume or value of any referrals or business generated between the parties to the arrangement; or (iv) any other amounts or methodologies prohibited by the Secretary. We are proposing to prohibit two specific additional types of methodologies for calculating bona fide service fees at § 423.2810(b)(3).

First, we are proposing at § 423.2810(b)(3)(i) to prohibit a methodology that requires the entity paying the bona fide service fee to the PBM or affiliate of such PBM for an itemized service to pay any additional fee, including any additional fee that otherwise would meet the requirements of a bona fide service fee, in order to access the primary benefit of such itemized service or have access to sufficient information to provide oversight of such itemized service. For example, if a Part D plan sponsor contracts with a PBM to negotiate rebates with a pharmaceutical manufacturer and pays a bona fide service fee for that itemized service, the PBM or its affiliate may not require that the Part D plan sponsor pay a separate data access fee in order to obtain basic information about the negotiated rebate (because such information is necessary to provide oversight of the itemized service of rebate negotiation). We solicit comment on the proposal to prohibit this methodology, including whether any modifications are warranted to account for differences in services offered by different types of PBM affiliates.

Second, we are proposing at § 423.2810(b)(3)(ii) that a PBM or its affiliate may not make the availability of an itemized service contingent on an agreement that the entity or individual with which the PBM or its affiliate is contracting for such itemized service provide remuneration to the PBM or affiliate of such PBM for a separate service. We are proposing to define a separate service as an itemized service that is not necessary for the PBM or affiliate of such PBM to perform in order for the PBM or affiliate of such PBM to provide the itemized service under contract. Reasons a separate service may not be necessary include that the contracting entity does not require that service or that the contracting entity is able to fulfill the service without use of the PBM or its affiliate, either independently or through a different contract. For example, if a Part D plan sponsor establishes a remuneration agreement with a PBM to adjudicate claims on the Part D plan sponsor's behalf, the PBM may not require that the agreement include the additional service of formulary development, because it is possible for the Part D plan sponsor to develop the formulary itself or contract with another entity to develop the formulary. This proposal would not prohibit the Part D plan sponsor in this scenario from voluntarily choosing to contract with the PBM for the additional service of formulary development. We solicit comment on the proposal to prohibit this methodology, including on whether any modifications are warranted to account for differences in services offered by different types of PBM affiliates.

These proposed prohibitions anticipate and attempt to prevent a potential adverse effect of requiring a remuneration structure that is entirely fee-based: the proliferation of individual fees which may not deliver benefit to the paying individual or entity. There is some evidence of the market moving in this direction already, such as the consolidation of rebate negotiation with PBM GPOs that retain revenue by charging multiple flat fees.^[41]

We solicit comment on additional or alternative methodologies that CMS should consider prohibiting.

b. Incentive Payments

In addition to bona fide service fees, the CAA also provides for certain limited incentive payments to PBMs. Section 1860D-12(h)(1)(A)(2) of the Act, as added by the CAA, states that an incentive payment (as determined by the Secretary) paid by a Part D plan sponsor to a PBM or an affiliate of a PBM that is performing services on behalf of such sponsor shall be deemed a `bona fide service fee' (even if such payment does not otherwise meet the definition of such term under paragraph (7)(B)) if such payment is a flat dollar amount, is consistent with fair market value (as specified by the Secretary), is related to services actually performed by the PBM or affiliate of such PBM, on behalf of the Part D plan sponsor making such payment, in connection with the utilization of Part D drugs, and meets additional requirements, if any, as determined appropriate by the Secretary. We propose to codify these requirements at § 423.2810(c). An incentive payment would be a reasonable form of remuneration in targeted circumstances under which the Part D plan sponsor is incentivizing or rewarding measurable performance by a PBM or an affiliate of such PBM. It should not be treated as an alternative payment structure to bona fide service fees that serves to enhance overall compensation rather than rewarding higher levels of performance.

We believe that fair market value should be defined differently for incentive payments than for bona fide service fees. While a cost-based ( printed page 66452) definition is appropriate for determining the fair market value for bona fide service fees (proposed at § 423.2810(e)(1)), it may not necessarily be appropriate for incentive payments given that the cost to provide an itemized service may not differ meaningfully based on the quality of performance. Therefore, we believe it is appropriate to define fair market value for incentive payments on the basis of something other than cost. The definition of fair market value proposed in the CY 2026 PFS proposed rule included the concept of comparable market transactions, which we believe to be an appropriate basis for incentive payments since such an approach would allow Part D plan sponsors to offer meaningful incentives based on performance (rather than cost) while preventing remuneration structures that are untethered from actual market conditions. We propose at § 423.2810(e)(2) that fair market value for incentive payments be defined as an amount reflective of comparable market transactions that generally reflect current market conditions.

We solicit comment on this proposal, including whether it allows Part D plan sponsors to provide meaningful performance incentives to PBMs and affiliates of PBMs without creating an alternative remuneration structure that serves to enhance overall compensation rather than rewarding higher levels of performance. We specifically solicit comment on whether the proposals provide sufficient clarity regarding the circumstances under which incentive payments are a reasonable alternative to bona fide service fees.

c. Exception for Manufacturer Rebates, Discounts, and Price Concessions.

Section 1860D-12(h)(1)(A)(i) of the Act establishes a general rule prohibiting a PBM and its affiliates from deriving “any remuneration with respect to any services provided on behalf of any entity or individual, in connection with the utilization of covered Part D drugs” other than bona fide service fees. Section 1860D-12(h)(1)(A)(iii) of the Act creates an exception to that general rule for certain manufacturer rebates, discounts, and other price concessions.

That exception provides: “Rebates, discounts, and other price concessions received by a PBM or an affiliate of a PBM from manufacturers, even if such price concessions are calculated as a percentage of a drug's price, shall not be considered a violation of the requirements of clause (i) if they are fully passed through to a PDP sponsor and are compliant with all regulatory and subregulatory requirements related to direct and indirect remuneration for manufacturer rebates, discounts, and other price concessions under this part, including in cases where a PDP sponsor is acting as a pharmacy benefit manager on behalf of a prescription drug plan offered by such PDP sponsor.”

For a rebate, discount, or other price concession to qualify for this exception, two conditions must be satisfied: (1) the price concession must be fully passed through to the Part D plan sponsor; and (2) the price concession must comply with all regulatory and subregulatory requirements related to DIR under Part D.

The statute also expressly permits price concessions calculated as a percentage of a drug's price, extends the exception to both PBMs and their affiliates, and explicitly covers scenarios in which a Part D plan sponsor acts as its own PBM.

To establish the parameters of this exception, CMS proposes to specify: (1) when a price concession has been fully passed through to the Part D plan sponsor; (2) what process must be followed for price concessions received by affiliates; and (3) how compliance with DIR requirements will be determined.

As a threshold matter, the standard Part D benefit and Part D payment framework require plan costs to be determined based on costs actually incurred.^[42] CMS has long implemented that requirement through regulations providing that Part D costs be reported net of applicable DIR. Notably, consistent with that statutory foundation, 42 CFR 423.308 defines amounts “actually paid” to mean costs that are actually incurred by the Part D plan sponsor and are net of any DIR. DIR is further defined to include all “price concessions or similar benefits from manufacturers, pharmacies, or similar entities obtained by an intermediary contracting organization with which the Part D plan sponsor has contracted, regardless of whether the intermediary contracting organization retains all or a portion of the DIR or passes the entire DIR to the Part D plan sponsor.” 42 CFR 423.100 in turn defines “price concession” to mean “any form of discount, direct or indirect subsidy, or rebate received by the Part D sponsor or its intermediary contracting organization from any source that serves to decrease the costs incurred under the Part D plan by the Part D sponsor.”

Although section 1860D-12(h)(1)(A)(iii) of the Act refers to “rebates, discounts, and other price concessions,” we believe it is reasonable to interpret those terms by reference to the existing Part D definitions of “price concession” at 42 CFR 423.100 and DIR within “actually paid” at 42 CFR 423.308.

Therefore, we propose, at 42 CFR 423.2810(d)(1), to interpret “rebates, discounts, and other price concessions” for purposes of section 1860D-12(h)(1)(A)(iii) of the Act by reference to those existing definitions. Under that interpretation, the exception applies only to the subset of price concessions and DIR that are: (1) received by a PBM or PBM affiliate from a manufacturer; (2) attributable to covered Part D drug utilization; (3) fully passed through to the Part D plan sponsor; and (4) compliant with applicable regulatory and subregulatory DIR requirements under Part D. Remuneration from non-manufacturer entities would not qualify for this exception as proposed.

In determining when a payment is “fully passed through,” an important principle can be derived from the existing Part D framework. Under 42 CFR 423.308, costs must be net of any DIR from any source that would decrease costs incurred under the Part D plan. That framework focuses on the economic value of the concession and requires that any remuneration decreasing plan costs be reflected in Part D cost calculations.

We believe a consistent approach should govern the definition of “fully passed through” in order to ensure alignment with the existing DIR framework. Therefore, we propose, at 42 CFR 423.2802, to define “fully passed through” to mean that the Part D plan sponsor receives 100 percent of the gross economic value of each manufacturer rebate, discount, or other price concession attributable to covered Part D drug utilization. We also propose to specify that the standard for “fully passed through” would not be met if a PBM or PBM affiliate reduces, offsets, nets, holds back, retains, reclassifies, or otherwise diminishes the value passed through to the Part D plan sponsor, including through administrative fees, data fees, aggregation fees, reconciliation charges, or other deductions.

We propose at § 423.2810(d)(2)(iii) that a manufacturer rebate, discount, or other price concession cannot satisfy the DIR compliance condition unless the price concession is: accurately classified; allocated to the appropriate plan, drug, NDC, utilization period, and plan year; reported in the Summary and ( printed page 66453) Detailed DIR Data Reports or successor reporting mechanism as required by CMS; reflected in applicable Part D reconciliation and payment processes; and supported by records sufficient for audit. A price concession that is retained by a PBM or PBM affiliate, misclassified as a service fee, omitted from DIR reporting, or otherwise not reflected in Part D reconciliation would not qualify for the exception; however, a noncompliant price concession may be corrected in accordance with CMS's applicable correction, reopening, reconciliation, or audit processes, including completion of any required pass-through, disgorgement, and corrected reporting.

Finally, we propose at 42 CFR 423.2810(d)(3) that manufacturer rebates, discounts, and other price concessions received by an affiliate of a PBM would be treated the same as concessions received directly by the PBM.

We request comment on this proposal.

d. Rule of Construction

As discussed earlier in section 6 of this proposed rule, section 1860D-12(h)(1)(A)(i) of the Act establishes the general remuneration restriction for PBMs and PBM affiliates. Under that provision, a PBM or PBM affiliate may not derive remuneration in connection with services provided on behalf of an entity or individual and related to the utilization of Part D drugs, unless the remuneration is a bona fide service fee, subject to section 1860D-12(h)(1)(A)(ii) or (iii) of the Act.

Section 1860D-12(h)(4) of the Act includes a rule of construction addressing certain pharmacy and wholesaler payment arrangements. Specifically, section 1860D-12(h)(4)(A) of the Act provides that nothing in subsection (h) of the Act shall be construed as prohibiting flat dispensing fees or reimbursement or payment for ingredient costs, including customary, industry-standard discounts directly related to drug acquisition that are retained by pharmacies or wholesalers, to entities that acquire or dispense prescription drugs. Section 1860D-12(h)(4)(B) of the Act further provides that nothing in subsection (h) of the Act shall be construed as modifying regulatory requirements or subregulatory program instruction or guidance related to pharmacy payment, reimbursement, or dispensing fees.

We propose to codify the statute's rule of construction at proposed § 423.2810(i). Specifically, we propose to codify at proposed § 423.2810(i)(1) that the requirements for remuneration to PBMs and their affiliates to be codified at proposed § 423.2810 would not prohibit flat dispensing fees, or reimbursement or payment for ingredient costs, including customary, industry-standard discounts directly related to drug acquisition that are retained by pharmacies or wholesalers, to entities that acquire or dispense prescription drugs. Additionally, we propose to codify at proposed § 423.2810(i)(2) that the requirements for PBM remuneration codified at proposed § 423.2810 do not modify regulatory requirements or sub-regulatory program instructions or guidance related to pharmacy payment, reimbursement, or dispensing fees.

As discussed previously, PBMs may operate as part of vertically integrated entities or other ownership and control relationships with retail pharmacies, mail order pharmacies, specialty pharmacies, long-term care pharmacies, or wholesalers as described in proposed § 423.2806(a). PBMs may also have functional relationships under which a pharmacy or wholesaler may be an affiliate of the PBM as described in proposed § 423.2806(b). While the rule of construction excludes specific pharmacy and wholesaler payments from the requirements of subsection (h) of the Act, the rule of construction does not create a blanket exemption whereby all payments to pharmacies or wholesalers that are affiliated with a PBM are automatically exempted from the PBM and affiliate remuneration requirements of section 1860D-12(h) of the Act. Rather, the rule of construction is a constraint on the application of the requirements of section 1860D-12(h) of the Act in the specific circumstances identified by statute.

Accordingly, the rule of construction being codified at proposed § 423.2810(i)(1) would limit the application of the remuneration restrictions at section 1860D-12(h)(1)(A) of the Act to a wholesaler or pharmacy that is an affiliate of a PBM in those particular circumstances in which the application of the remuneration restrictions would prohibit dispensing fees, reimbursement, or payments directly protected by statute. Likewise, the rule of construction being codified at proposed § 423.2810(i)(2) would limit the application of the remuneration restrictions at section 1860D-12(h)(1)(A) of the Act in those particular circumstances in which the application of the remuneration restrictions would not be consistent with an applicable regulation, program instruction or guidance that establishes requirements for pharmacy payment, reimbursement or dispensing fees without modification to such regulation, program instruction or guidance. We believe this approach will appropriately restrict remuneration to PBMs and their affiliates, while continuing to allow pharmacies, including pharmacies affiliated with a PBM, to receive and retain without modification those particular payments, reimbursement and dispensing fees where such remuneration is expressly permitted under applicable regulation, program instruction or guidance. We offer two examples of specific circumstances where the rule of construction is implicated.

First, a pharmacy, including a pharmacy affiliated with a PBM, may receive and retain reimbursement from a Part D plan sponsor for dispensing a covered Part D drug when the reimbursement reflects a negotiated price equal to a pricing standard such as average wholesale price, plus a flat dispensing fee. Reimbursement for dispensing a covered Part D drug is a payment that would fall within the rule of construction in section 1860D-12(h)(4)(A) of the Act to be codified at proposed § 423.2810(i)(1) and would not be constrained under the proposed restrictions on remuneration described in proposed § 423.2810(a) through (d) even if the remuneration is paid to a pharmacy that is affiliated with a PBM.

Second, the CMS program instructions to implement the Medicare Drug Price Negotiation Program establish specific parameters under which a Primary Manufacturer may make a retrospective MFP refund to a pharmacy or other dispensing entity to provide access to the MFP for a selected drug.^[43] The MFP refunds to pharmacies and other dispensing entities described in this program instruction constitute payments for ingredient costs, including an acquisition-related discount, that would fall within the rule of construction in section 1860D-12(h)(4)(A) of the Act to be codified at proposed § 423.2810(i)(1) and would not be constrained under the proposed restrictions on remuneration described in proposed § 423.2810(a) through (d) even if the remuneration is paid to a pharmacy that is affiliated with a PBM. Moreover, these CMS program instructions establish that the Primary manufacturer's MFP refunds are to be paid to the dispensing entity to provide the dispensing entity with access to the MFP. In contrast, section 1860D-12(h)(1)(A)(iii) of the Act as described in ( printed page 66454) proposed § 423.2810(d) establishes that, for a price concession to a PBM or its affiliate to avoid the remuneration restrictions as described in proposed § 423.2810(b), such price concession must be fully passed through to the Part D plan sponsor. If CMS were to construe section 1860D-12(h)(1)(A) of the Act as described in proposed § 423.2810 as requiring an affiliate pharmacy to pass through its MFP refunds to the Part D plan sponsor in order for the MFP refund to be permissible remuneration, this application of the remuneration restrictions in section 1860D-12(h)(1)(A) of the Act would be inconsistent with the applicable Medicare Drug Price Negotiation Program program instructions, which establish that MFP refunds are to provide access to the MFP to the dispensing entity. Because the application of the remuneration restrictions in proposed § 423.2810(a)-(d) to MFP refunds would not be consistent with allowing affiliate pharmacies to receive and retain MFP refunds that are expressly permitted under the Medicare Drug Price Negotiation Program's program instruction, the rule of construction in section 1860D-12(h)(4)(B) of the Act to be codified at proposed § 423.2810(i)(2) applies and such MFP refunds would not be constrained under the proposed restrictions on remuneration described in proposed § 423.2810(a) through (d) even if such remuneration is paid to a pharmacy that is affiliated with a PBM. We anticipate the same result in connection with future regulations codifying the Medicare Drug Price Negotiation Program's program instruction.

We solicit comments on this proposal. In particular, we solicit comment on whether there are other types of payments, reimbursements, fees, or acquisition-related discounts received by pharmacies or wholesalers, or particular regulatory requirements, program instruction, or guidance related to pharmacy payment, reimbursement, or dispensing fees other than those discussed here for which additional clarification as to their status under section 1860D-12(h)(4) of the Act and this proposal would be useful. We also solicit comments on the implications that this rule of construction and the limitations on payment to affiliated pharmacies may have on the codification and enforcement of the standards for reasonable and relevant terms and conditions for pharmacy contracts described in section 1860D-4(B)(1)(A)(ii) of the Act. In particular, we are interested in the implications this proposal would have on any requirements that might be promulgated with respect to pricing transparency and reimbursement in pharmacy contracts.

e. Disgorgement of Remuneration to the Part D Plan Sponsor

Section 1860D-12(h)(1)(A)(v) of the Act, as added by the CAA, provides that the written agreement between the Part D plan sponsor and PBM require that the PBM shall disgorge to the Part D plan sponsor any remuneration paid to such PBM or an affiliate of such PBM in violation of the requirements described at section 1860D-12(h)(1)(A) of the Act. We interpret this requirement to mean that if remuneration received by a PBM or affiliate of such PBM is in violation of the requirements described at section 1860D-12(h)(1)(A) of the Act, the total amount of such remuneration should be disgorged to the PDP sponsor. For example, if a PBM were to receive a manufacturer rebate in connection with a covered Part D drug and did not fully pass through the rebate to the Part D plan sponsor in accordance with section 1860D-12(h)(1)(A)(iii), the rebate, inclusive of both the portion already passed through to the Part D plan sponsor and the portion that was retained by the PBM, would be considered remuneration in violation of such requirements and must be disgorged by the PBM to the Part D plan sponsor, which in turn must disgorge the same amount to CMS as discussed at proposed § 423.2920(a). As another example, if an audit by a Part D plan sponsor were to identify that remuneration paid by an entity to a PBM was not in compliance with bona fide service fee requirements because it was not reflective of fair market value, all such remuneration must be disgorged to the Part D plan sponsor. We propose to codify this requirement at § 423.2810(g).

We considered an alternative interpretation through which only the amount of remuneration in excess of what the remuneration would have been had it been compliant with the requirements described at section 1860D-12(h)(1)(A) of the Act would be required to be disgorged to the Part D plan sponsor. Under this alternative, the PBM or affiliate of such PBM would have identified the counterfactual remuneration that would have been compliant with the requirements described at section 1860D-12(h)(1)(A) of the Act, and CMS could request documentation of the assumptions and methodology used to determine the amount of remuneration that was in violation and require modifications as determined necessary by CMS. For example, under this alternative, if remuneration received by a PBM did not meet the bona fide service fee requirements because it was not reflective of fair market value, the PBM would determine what amount the remuneration would have been had it been reflective of fair market value and would disgorge the difference between that counterfactual amount and the actual amount of remuneration to the PDP sponsor. We did not propose this interpretation for several reasons. First, section 1860D-12(h)(1)(A)(v) of the Act applies the disgorgement requirement to “any remuneration paid to such pharmacy benefit manager or an affiliate of such pharmacy benefit manager in violation of this subparagraph”, not the difference between the violative amount and a counterfactually non-violative amount. Additionally, determining a methodology to calculate the counterfactually non-violative amount could be complex, for example if the remuneration violated the requirements at section 1860D-12(h)(1)(A) of the Act in multiple ways. Finally, remuneration is typically negotiated between parties to a contract, and it may be difficult to determine a counterfactual amount outside of that negotiation process.

We solicit comment on our interpretation of this requirement at section 1860D-12(h)(1)(A)(v) of the Act.

Section 1860D-12(h)(1)(A)(vi) of the Act requires that the PBM enter into an agreement with any affiliate of such PBM, under which the affiliate must identify and disgorge any remuneration paid to the affiliate in violation of the requirements described at section 1860D-12(h)(1)(A) of the Act to the PBM. We propose to codify this requirement at § 423.2810(g)(3). The same section also requires that the PBM attest, subject to any requirements determined appropriate by the Secretary, that the PBM has entered into such a written agreement with any affiliate of such PBM. We propose to require that the written agreement between the Part D plan sponsor and the PBM include this attestation at § 423.2810(g)(3)(i).

We also propose at § 423.2810(g)(1) and § 423.2810(g)(2) that for plan years beginning on or after January 1, 2028, the written agreement between a Part D plan sponsor and any PBM acting on behalf of such sponsor include the following requirements: (1) the PBM or any affiliate of such PBM must disgorge any remuneration paid to such PBM or affiliate if such PBM in violation of the requirements described at § 423.2810(a) no later than the earlier of: (i) 30 days following the conclusion of an audit by the Part D plan sponsor, as allowed at ( printed page 66455) § 423.2814, that found remuneration paid to the PBM or affiliate of such PBM in violation of the requirements described at § 423.2810(a); or (ii) 30 days following the end of the month in which the PBM or affiliate of such PBM identified remuneration paid to the PBM or affiliate of such PBM in violation of the requirements described at § 423.2810(a); and (2) the PBM or affiliate of such PBM must provide the following information to the Part D plan sponsor: the amount of the remuneration in violation of the requirements described at § 423.2810(a), the entity from which such remuneration derived, the entity that received such remuneration, and the nature of the violation. With regards to the first requirement, we clarify that, under our proposal, if the PBM or affiliate of such PBM identifies remuneration paid to the PBM or an affiliate of such PBM in violation of the requirements at § 423.2810(a) during an audit by the Part D plan sponsor as allowed at § 423.2818 and prior to the conclusion of such audit, thirty days following the end of the month in which the PBM or affiliate of such PBM identified remuneration paid to the PBM or affiliate of such PBM in violation of the requirements described at § 423.2810(a) would be considered the earlier of the dates described previously.

We seek comment on our proposal at § 423.2810(f) for disgorgement of funds from the PBM to the Part D plan sponsor, specifically the requirements for timing of disgorgement.

f. Evaluation of Remuneration Agreements

Section 1860D-12(h)(1)(A)(iv) of the Act, as added by section 6224 of the CAA, provides that components of subsets of remuneration arrangements, such as fees or other forms of compensation paid to or retained by the PBM or affiliate of the PBM, between PBMs or PBM affiliates and other entities involved in the dispensing or utilization of covered Part D drugs shall be subject to review by the Secretary, in consultation with the Office of Inspector General of the Department of Health and Human Services (OIG), as determined appropriate by the Secretary. Section 1860D-12(h)(1)(A)(iv) of the Act further provides that the Secretary, in consultation with OIG, shall review whether remuneration under such arrangements is consistent with fair market value, as specified by the Secretary.

As discussed in section II.C.3. of this proposed rule, we propose at § 423.2810(e)(1) to define fair market value for bona fide service fees based on the cost of the itemized service plus a reasonable markup to total cost. We also propose that, if observed cost data are not available, the fair market value for bona fide service fees may be based on expected cost plus a reasonable markup until sufficient observed cost data become available.

We propose to establish a two-part process for CMS to collect the information necessary to review whether remuneration arrangements involving PBMs and PBM affiliates are consistent with fair market value, as described at proposed § 423.2810(e), and otherwise comply with section 1860D-12(h) of the Act. This process would take place following the submission of the annual PBM reports, as proposed at § 423.2814.

In the first part of the process, CMS would identify a subset of PBMs for which components of a subset of their remuneration arrangements will be reviewed using a two-pronged sampling approach. First, CMS would review the annual PBM report, as proposed at § 423.2814, and any other available information to identify PBMs whose reported data warrant additional review. Second, to promote review of a broad range of PBM remuneration arrangements over time, CMS would also select a random sample of PBMs. For each PBM selected under either prong, CMS would select a sample of Part D plan sponsors with which the selected PBM has a written agreement to act on behalf of the Part D plan sponsor. All remuneration agreements held by the selected PBM, as well as those held by a sample of any affiliates of such PBM (selected by CMS from the list of affiliates reported by the PBM under the annual report described at § 423.2814), with any individual or entity, under which the PBM or affiliate of such PBM receives remuneration for services in connection with Part D drug benefits of the plan of that Part D plan sponsor would be subject to review. We propose at § 423.2810(f)(8) and § 423.2810(f)(9) this process for selecting PBMs and subsets of the remuneration arrangements of such PBMs and their affiliates for submission and review.

CMS would notify each selected PBM and, as described in proposed § 423.2810(f)(4), each selected PBM would be required to include in the summary of components of subsets of remuneration arrangements required to be submitted in the form and manner, and by the deadline, specified by CMS, all components of remuneration arrangements described in proposed § 423.2810(f)(9), that is, all remuneration arrangements between itself or any of its selected affiliates and any other individual or entity under which the PBM or affiliate of such PBM receives remuneration for services in connection with the utilization of Part D drugs by enrollees in a prescription drug plan offered by such Part D plan sponsor. As described in proposed § 423.2810(f)(4)(ii), the summary of components of subsets of remuneration arrangements must identify each remuneration arrangement at the level needed to identify and classify each distinct remuneration structure and classify amounts received or retained by the selected PBM or its selected affiliates. Proposed § 423.2810(f)(4)(iii) would establish specific information that the PBM must include in its summary, for each remuneration arrangement and payment stream. We propose the PBM's summary must include the following information: the payer of the remuneration; the recipient of the remuneration; the affiliate status of the payer and recipient in relation to the PBM; the applicable Part D plan sponsor, contract, and plan; the service or payment category for the remuneration; a brief description of the remuneration arrangement or payment stream; the total amount of remuneration paid, received, and retained by the recipient; the amount of remuneration attributable to the utilization of covered Part D drugs; and the unit of payment or fee methodology used by the payer to determine the amount of remuneration. We propose the PBM's summary must also address: whether the arrangement or payment stream covers multiple services, entities, functions, or both Part D and non-Part D lines of business and whether the arrangement or payment stream is bundled, and, if applicable, must provide information regarding these aspects of the arrangement or payment. We propose the PBM's summary must classify remuneration under each arrangement or payment as a bona fide service fee, incentive payment, fully passed-through rebate, discount or other price concession, protected amount as described in the rule of construction at § 423.2810(i), or other remuneration. In addition, as described at proposed § 423.2810(f)(4)(iv), the PBM's summary would also be required to provide a crosswalk sufficient for CMS to identify the location in the remuneration agreement where each of those elements may be found.

In the second part of the process, as described at proposed § 423.2810(f)(5), CMS could request additional substantiation from the selected PBMs and their affiliates when CMS ( printed page 66456) determines that it is necessary to assess whether the remuneration is consistent with fair market value and otherwise complies with section 1860D-12(h) of the Act. For example, CMS could determine the need for additional substantiation based on the annual PBM report as proposed in § 423.2814, the Part D plan sponsor certification as proposed in § 423.2820(e), or the summary of components of subsets of remuneration arrangement as proposed in § 423.2810(f). CMS could also determine the need for additional substantiation based on allegations of misconduct received through the confidential reporting as proposed in § 423.2820(d) or otherwise. For arrangements for which CMS requests additional substantiation, the selected PBM would be required to submit information as specified by CMS sufficient to support the PBM's classification of the remuneration and CMS's evaluation of compliance with section 1860D-12(h) of the Act. Such information may include, but is not limited to, cost support showing the resources used to perform the service, such as direct labor, labor rates, personnel or time allocation, technology or vendor costs, overhead allocation, indirect administrative costs, and profit margin or markup; and fair market value support, including the valuation methodology, key assumptions, valuation date, preparer, comparable market data if used, cost-plus analysis if used, and any third-party valuation materials. The PBM may also be required to submit allocation support for arrangements involving multiple services, multiple entities, PBM and non-PBM functions, or both Part D and non-Part D lines of business. We propose at § 423.2810(f)(5) to provide that CMS may request additional substantiation for selected remuneration arrangements to be submitted in a form and manner specified by CMS.

We propose that PBMs, rather than Part D plan sponsors, submit the summary as described in proposed § 423.2810(f)(4) and any additional substantiation as described in proposed § 423.2810(f)(5) directly to CMS. Consistent with our contracting authority under sections 1860D-12(b)(3)(D) and (h)(1) of the Act, we propose the Part D plan sponsor would remain responsible for ensuring, through the written agreement with the PBM, that the PBM submits this information to CMS and provides information necessary for the Part D plan sponsor's annual certification as proposed in § 423.2820(e). We believe direct PBM submission of information under this proposed § 423.2810(f) is appropriate because PBMs and their affiliates generally possess the relevant cost data, fair market value analyses, and contract support that would be required to file and substantiate the required reports. Direct submission to CMS also addresses concerns that some information may include trade secrets or other confidential business information that should not be disclosed more broadly than necessary. While information submitted under the process described in proposed § 423.2810(f) would be subject to the confidentiality protections in section 1860D-12(h)(6) of the Act, as applicable, we believe that allowing PBMs to submit such information to CMS directly rather than through the Part D plan sponsor will further protect proprietary information of the PBMs and their affiliates.

We propose at § 423.2810(f)(4) to require selected PBMs to each submit its summary of components of subsets of remuneration arrangements at a later date than the annual PBM report required under § 423.2814. We propose at § 423.2810(f)(6) to provide that information submitted under this proposed § 423.2810(f) would be subject to the confidentiality protections in section 1860D-12(h)(6) of the Act as described at proposed § 423.2822, as applicable.

We propose at § 423.2810(f)(7) that a PBM is responsible for obtaining from its affiliates and submitting to CMS information required under this section that is owned, held, or controlled by an affiliate of the PBM.

We solicit comments on this proposal, including the proposed sampling approach, the appropriate approach for random selection, the factors CMS should use to identify remuneration arrangements between PBMs and Part D plan sponsors for additional review, the number of PBMs CMS should annually select, the amount of time necessary for selected PBMs to prepare reporting after being notified of their selection, and whether alternative sampling methods would better balance program integrity with reporting burden.

7. Transparency Regarding Guarantees and Cost Performance Evaluations

Section 1860D-12(h)(1)(B) of the Act, as added by the CAA, requires that for plan years beginning on or after January 1, 2028, each contract entered into with a Part D plan sponsor under section 1860D-12 with respect to a prescription drug plan offered by such sponsor shall provide that any PBM acting on behalf of such sponsor has a written agreement with the Part D plan sponsor under which the PBM agrees to define, interpret, and apply terms in a fully transparent and consistent manner, for purposes of calculating or otherwise evaluating PBM performance against pricing guarantees or similar cost performance measurements.

Pricing guarantees are a common feature of agreements between Part D plan sponsors and PBMs in which PBMs guarantee an effective rate, often expressed in terms of a percent off a reported price, paid by the Part D plan sponsor across a category of drugs, such as generic, brand, or specialty drugs.^[44] For example, PBMs may guarantee to Part D plan sponsors an effective rate of 25percent off average wholesale price for all brand drugs; the PBM would reconcile actual payments for ingredient cost of such drugs against the guaranteed price across the entire category of drugs by reimbursing the Part D plan sponsor for any excess payment or retaining the difference between the guarantee and the lower amount paid to the PBM. However, imprecise or non-standardized definitions of terms such as “brand”, “generic”, or “specialty” may allow PBMs to categorize drug products in ways that maximize their ability to retain revenue via effective rate guarantees.^[45] For example, if a PBM were to guarantee 60 percent off average wholesale price for generic drugs but only 20 percent off average wholesale price for specialty drugs, assuming that the PBM paid pharmacies less than the guaranteed rate for a given drug, the PBM could retain more of the difference between the guaranteed rate and the amount paid to the pharmacy if it were to categorize the drug as a specialty drug rather than a generic drug.

PBM revenue retained via pricing guarantees as described previously would not meet the requirements of bona fide service fees introduced by section 1860D-12(h)(1)(A) of the Act, since such revenue would be contingent upon both the price of the drug and DIR. However, section 1860D-12(h)(1)(A)(ii) of the Act provides that an incentive payment paid by a Part D plan sponsor to a PBM or an affiliate of such PBM that is performing services on behalf of such sponsor may be deemed a `bona fide service fee' if it meets certain ( printed page 66457) requirements. Therefore, Part D plan sponsors may offer incentive payments to PBMs for achieving pricing guarantees, provided those incentive payments meet all requirements described at proposed § 423.2810(c).

Section 1860D-12(h)(1)(B)(i) of the Act requires that PBMs define, interpret, and apply, in a fully transparent and consistent manner for purposes of calculating or otherwise evaluating PBM performance against pricing guarantees or similar cost performance measurements related to rebates, discounts, price concessions, or net costs, terms such as the following:

• `Generic drug', in a manner consistent with the definition of the term under section 423.4 oftitle 42, Code of Federal Regulations, or a successor regulation.
• `Brand name drug', in a manner consistent with the definition of the term under section 423.4 oftitle 42, Code of Federal Regulations, or a successor regulation.
• `Specialty drug'.
• `Rebate'.
• `Discount'.

We propose to adopt this requirement at § 423.2812(a)(1). We are also proposing at § 423.2812(b) that definitions of such terms be included in the written agreement between Part D plan sponsors and PBMs and that PBMs provide a list of drugs, including the NDC-11 or NDC-12 identifier of each drug, included in each category including “generic drug”, “brand name drug”, “specialty drug”, or any other categories of drugs for which PBM performance against pricing guarantees or similar cost performance metrics is measured to Part D plan sponsors, upon request of the Part D plan sponsor, not less than annually.

Section 1860D-12(h)(1)(B)(ii) of the Act requires that PBMs identify any drugs, claims, or price concessions excluded from any pricing guarantee or other cost performance measure in a clear and consistent manner. We propose at § 423.2812(c) to require that the PBM provide such a list of drugs, claims, or price concessions to Part D plan sponsors with sufficient information for the Part D plan sponsor to clearly identify such drugs, claims, or price concessions—including NDC-11 or NDC-12 identifiers for such drugs, identifying information about such claims such as date of service and beneficiary identifier, and information about such price concessions such as the amount of the price concession and the drug(s) to which it applies—upon request of the Part D plan sponsor, not less than annually.

Section 1860D-12(h)(1)(B)(iii) of the Act requires that where a pricing guarantee or other cost performance measure is based on a pricing benchmark other than the wholesale acquisition cost (as defined in section 1847A(c)(6)(B) of the Act) of a drug, the PBM calculate and provide a wholesale acquisition cost-based equivalent to the pricing guarantee or other cost performance measure. We propose to adopt this requirement at § 423.2812(a)(2). We are also proposing at § 423.2812(d) that PBMs disclose the source of the wholesale acquisition cost used in this equivalent pricing guarantee (for example, the name of the third-party pricing compendium from which the PBM derived the wholesale acquisition cost).

CMS considered whether the requirements discussed in this section of the proposed rule should apply to effective rate guarantees between PBMs and pharmacies. We are not including specific proposals regarding such guarantees in this rule but may address this topic in future rulemaking.

We solicit comment on these proposals related to transparency regarding guarantees and cost performance evaluations, including whether additional guardrails or definitions are necessary to achieve the objective of providing Part D plan sponsors with clear and transparent information about the performance of PBMs or their affiliates against cost performance metrics.

8. Annual PBM Reporting Requirements

Section 6224 of the CAA added section 1860D-12(h)(1)(C) of the Act, requiring that not later than July 1 of each year, beginning in 2028, the PBM shall submit a report, in a format specified by the Secretary, to the Part D plan sponsor and the Secretary with certain information with respect to the previous plan year. We propose to adopt this requirement at § 423.2814(a). Section 1860D-12(h)(1)(C) of the Act requires Part D plan sponsors to incorporate the requirement for PBMs to submit the described data into the written agreements between the Part D plan sponsor and the PBM. Consistent with our authority under sections 1860D-12(b)(3)(D) and (h)(1) of the Act, we propose the following requirements regarding the collection of these data and detailed definitions of such data for the purposes of carrying out section 1860D-12(h)(1)(C) of the Act.

CMS intends to use the CMS Health Plan Management System (HPMS) to collect this information. While there are no existing reporting requirements for PBMs to submit information to HPMS prior to this statute, many PBMs have user accounts and submit information such as detailed DIR to CMS on behalf of Part D plan sponsors. Therefore, we believe that the system has both the functionality to collect the required information as well as familiarity among PBMs that will be submitting such information. In accordance with section 1860D-12(h)(5)(A) of the Act, as added by the CAA, we will specify standard, machine-readable formats for PBMs to submit annual reports no later than June 1, 2027. Section 6224(a)(3) of the CAA specifies that the implementation of this subsection is not subject to the Paperwork Reduction Act. In accordance with section 1860D-12(h)(5)(B) of the Act, we intend to release this machine-readable format via program instruction.

Section 1860D-12(h)(1)(C)(i)(XI) of the Act describes a summary document submitted in a standardized template developed by the Secretary that includes such information described in section 1860D-12(h)(1)(C)(i)(I) through section 1860D-12(h)(1)(C)(i)(X). We propose at § 423.2814(e) that this document be the annual report in the machine-readable format referenced in the previous paragraph. We propose at § 423.2814(f) that the annual report be certified by the Chief Executive Officer, Chief Financial Officer, or General Counsel of such PBM, or an individual delegated the authority to sign on behalf of these officers, who reports directly to the officer.

For the purposes of describing the data at section 1860D-12(h)(1)(C) of the Act, CMS proposes to adopt the following definitions at § 423.2814(c).

a. General

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i) of the Act, CMS proposes the following definitions:

• 30-day supply means the amount of such drug equal to the average 30-day equivalent supply, as described at § 423.104(d)(2)(iv)(A)( 2), across all PDE records for such drug for enrollees in such plan in such plan year. If the PBM does not have access to PDE records for such plan for such plan year, an estimated amount per 30-day supply based on dosage information on the most recent label approved by the Food and Drug Administration (FDA) or other reasonable assumptions may be used.
• Affiliate has the meaning proposed at § 423.2802.
• Dosage unit means the amount of such drug represented by its National Council for Prescription Drug Programs (NCPDP) unit type. ( printed page 66458)
• Drug means a drug or biological product associated with a unique NDC-11 or NDC-12 identifier.
• Generic or non-proprietary name means the name that matches the nonproprietary name data element in the NDC Directory product file.
• National Drug Code means the unique, eleven-digit or twelve-digit identifier of the NDC submitted by the Food and Drug Administration to the Drug Registration and Listing System for a drug product, also known as an NDC-11 or NDC-12 code.
• Pharmacy benefit manager has the meaning described at § 423.2802.

b. List of Drugs

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i)(I) of the Act, CMS proposes the following definitions:

• Average National Average Drug Acquisition Cost (NADAC): the sum of the products of each NADAC in effect for such drug during such plan year and the quotient of the number of days in which such NADAC was in effect divided by the number of days any NADAC was in effect during such year.
• Average pharmacy reimbursement amount paid by the plan for the drug means the average of the amount paid by the plan per 30-day supply of the drug, across all fills of the drug during such plan year.
• Average wholesale acquisition cost means the sum of the products of each wholesale acquisition cost (WAC) in effect for such drug during such plan year and the quotient of the number of days in which such WAC was in effect divided by the number of days any WAC was in effect during such year.
• Average wholesale price means the sum of the products of each average wholesale price (AWP) in effect for such drug during such plan year and the quotient of the number of days in which such AWP was in effect divided by the number of days any AWP was in effect during such year.
• Day's supply means the amount of such drug represented by the average day's supply across all fills in PDE data for such drug for such Part D plan sponsor and PBM in such plan year. If the PBM does not have access to PDE data, an estimated amount per day's supply based on dosage information on the most recent label approved by the Food and Drug Administration (FDA) or other reasonable assumptions may be used.
• Dispensing channel means the dispensing channel as represented by the NCPDP pharmacy dispenser type code. If there are multiple NCPDP pharmacy dispenser type codes, the beneficiary's residence type should be used to determine the appropriate dispensing channel.
• Total manufacturer-derived revenue, inclusive of bona fide service fees, attributable to the drug and retained by the pharmacy benefit manager and any affiliate of such pharmacy benefit manager means revenue that is either (a) paid directly from a manufacturer to the PBM or affiliate or (b) paid directly from a manufacturer to any entity and passed through in whole or in part from that entity, as well as from any other additional entities, and is received by the PBM or affiliate. Only the amount of revenue received by the PBM and any affiliate of such PBM should be included in this amount; revenue retained by other entities and not passed through should not be included.
• Typical course of treatment means the amount of such drug estimated by the PBM to be associated with a typical course of treatment based on dosage information on the most recent label approved by the Food and Drug Administration (FDA), using reasonable assumptions for variable factors such as patient weight or other factors affecting dosing, which must be reported by PBMs as part of the data submission. For drugs or biological products used to treat chronic conditions for which the typical course of treatment is indefinite, the typical amount of such drug associated with 1 year of treatment may be used, and PBMs must indicate this methodology in the reasonable assumptions.

c. Pharmacy Information

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i)(II) of the Act, CMS proposes the following definitions:

• 90-day supply means three times the 30-day supply of the drug, as defined under § 423.2814(c).
• Affiliate, such as a pharmacy or other entity that acquires prescription drugs, that initially acquires the drug means an affiliate that, during any point in the plan year, acquired any amount of the drug that had not previously been acquired by an affiliate of the same PBM (or, in the event that the manufacturer of the drug is an affiliate of the PBM and sold the drug to another affiliate of the same PBM, such affiliate that acquired the drug from such manufacturer). If multiple affiliates meet such criteria, all such affiliates must be treated as the affiliate that initially acquires the drug, and the acquisition cost must be averaged across all such affiliates. If an entity was an affiliate of the PBM for only a portion of the plan year, that entity shall be considered the affiliate that initially acquires the drug if, after the day on which it becomes an affiliate during the plan year, it acquires the drug earlier than any other affiliate or acquires the drug from an affiliate manufacturer.
• Average acquisition cost means the average cost, per dosage unit, to the entity to acquire the drug, from all sources from which such entity acquired the drug during such plan year, both in aggregate and by dispensing channel.
• Course of treatment has the meaning of “typical course of treatment” defined at § 423.2814(c).
• Percentage of total prescriptions that were dispensed by pharmacies that are an affiliate of the pharmacy benefit manager for each drug means the quotient of the number of 30-day supplies of such drug (as defined at § 423.2814(c)) dispensed by pharmacies that are an affiliate of the PBM to an enrollee of such Part D plan sponsor in such plan year divided by the number of 30-day supplies of such drug dispensed by any pharmacy to an enrollee of such Part D plan sponsor in such plan year.
• Pharmacy network means the pharmacy network inclusive of both preferred and non-preferred pharmacies.

d. Reference Listed Drugs and Generics

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i)(III) of the Act, CMS proposes the following definitions:

• Currently marketed generic drug means a generic drug approved under section 505(j) of the Federal Food, Drug, and Cosmetic Act that meets either of the following criteria: is listed in the Orange Book and is not discontinued, or is listed in the product file of the National Drug Code Directory with either a blank end marketing date or an end marketing date in the future.

Additionally, we recognize that this segment of data elements elicits information about the degree to which formulary tier placement decisions and utilization management tools treat brand name drugs more favorably than generics. However, additional information beyond the data elements explicitly enumerated in section 1860D-12(h)(1)(C)(i)(III) of the Act would provide a more meaningful understanding of these plan design features and better enable compliance efforts by Part D plan sponsors and CMS. For example, while section 1860D-12(h)(1)(C)(i)(III) of the Act requires PBMs to estimate and report what beneficiary cost-sharing for a 30-day supply of generic drugs that are ( printed page 66459) placed on a formulary tier typically associated with higher cost-sharing than their listed drug would have been had they been placed on the same formulary tier as the listed drug, the statute did not require PBMs to report what actual beneficiary cost-sharing was for such generic drugs. The estimates of beneficiary cost-sharing if the generic drug had been on a different formulary tier would have significantly more meaning if Part D plan sponsors and CMS were able to compare them to actual cost-sharing for that same generic drug. Similarly, while section 1860D-12(h)(1)(C)(i)(III) of the Act requires that PBMs report on whether generic drugs are “covered on the same formulary tier or a formulary tier typically associated with higher cost-sharing than the listed drug, or are subject to utilization management that the listed drug is not subject to”, it only solicits additional information on the formulary tier portion of that phrase—via information about the effects on beneficiary cost-sharing—but not additional information on the effects of other utilization management tools. We believe that greater insight into the outcomes of utilization management tools—rather than information merely about their existence—would better allow Part D plan sponsors and CMS to understand the degree to which the listed drug is or is not being treated more favorably than its generics in practice. Finally, due to potential differences in treatment of generic drugs or biosimilars that are private label vs. non-private label, we propose to collect information separately for private label vs. non-private label generic drugs and biosimilars.

Consistent with our authority under sections 1860D-12(b)(3)(D) and (h)(1) of the Act, we are proposing to add the following data elements to the reporting requirements at § 423.2814(d)(3):

• Whether each generic drug described at § 423.2814(d)(3)(i) is private label or not.
• Where a currently marketed generic drug approved under section 505(j) of the Federal Food, Drug, and Cosmetic Act pursuant to an application that references such listed drug is on a formulary tier typically associated with higher cost-sharing than the listed drug, the average beneficiary cost-sharing under the plan for a 30-day supply of each such generic drug.
• Where the listed drug is subject to prior authorization under the plan, the average denial rate of prior authorizations submitted for the listed drug during the plan year.
• Where a currently marketed generic drug approved under section 505(j) of the Federal Food, Drug, and Cosmetic Act pursuant to an application that references such listed drug is subject to prior authorization under the plan, the average denial rate of prior authorizations submitted for each such generic drug during the plan year.
• Where the listed drug is subject to any utilization management tool other than prior authorization under the plan, a brief description of each such utilization management tool.
• Where the listed drug is subject to any utilization management tool other than prior authorization, the average denial rate of each such utilization management tool during the plan year.
• Where a currently marketed generic drug approved under section 505(j) of the Federal Food, Drug, and Cosmetic Act pursuant to an application that references such listed drug is subject to the same utilization management tool (other than prior authorization) as the listed drug, the average denial rate of each such utilization management tool during the plan year.

e. Reference Products and Biosimilars

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i)(IV) of the Act, CMS proposes the following definitions:

• Currently marketed biosimilar biological product means a biosimilar biological product licensed under section 351(k) of the Public Health Service Act that meets either of the following criteria: is listed in the Purple Book with a marketed status of “Rx”, or is listed in the product file of the National Drug Code Directory with either a blank end marketing date or an end marketing date in the future.

Additionally, we propose to add the following data elements to the reporting requirements at § 423.2814(d)(4), in alignment with similar elements proposed to be added to § 423.2814(d)(3):

• Whether each biosimilar biological product described at § 423.2814(d)(4)(i) is private label or not.
• Where a currently marketed biosimilar biological product licensed under section 351(k) of the Public Health Service Act pursuant to an application that refers to such reference product is on a formulary tier typically associated with higher cost-sharing than the reference product, the average beneficiary cost-sharing under the plan for a 30-day supply of each such biosimilar biological product.
• Where the reference product is subject to prior authorization under the plan, the average denial rate of prior authorizations submitted for the reference product during the plan year.
• Where a currently marketed biosimilar biological product licensed under section 351(k) of the Public Health Service Act pursuant to an application that refers to such reference product is subject to prior authorization under the plan, the average denial rate of prior authorizations submitted for each such biosimilar biological product during the plan year.
• Where the reference product is subject to any utilization management tool other than prior authorization under the plan, a brief description of each such utilization management tool.
• Where the reference product is subject to any utilization management tool other than prior authorization, the average denial rate of each such utilization management tool for the reference product during the plan year.
• Where a currently marketed biosimilar biological product licensed under section 351(k) of the Public Health Service Act pursuant to an application that refers to such reference product is subject to the same utilization management tool (other than prior authorization) as the listed drug, the average denial rate of each such utilization management tool for each such biosimilar biological product during the plan year.

f. Revenue Retained by the Pharmacy Benefit Manager

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i)(VI) of the Act, CMS proposes the following definitions:

• Remuneration related to utilization of Part D drugs means remuneration that meets the requirements at § 423.2810(h).

g. Broker, Consultant, Advisors, and Auditors

For purposes of collecting the data described at section 1860D-12(h)(1)(C)(i)(IX) of the Act, CMS proposes the following definitions:

• Pharmacy benefit management services has the meaning of “PBM function” described at § 423.2802.

We solicit comment on these proposed definitions, as well as whether there are other terms related to the annual reporting requirement that warrant further definition.

Note that section 1860D-12(h)(1) of the Act requires that Part D plan sponsors have a written agreement with the PBM under which the PBM, and any affiliates of such PBM as applicable, agree to meet requirements including the data reporting requirements at section 1860D-12(h)(1)(C) of the Act; as such, failure to comply with this requirement in the written agreement between the Part D plan sponsor and the ( printed page 66460) PBM may result in the Part D plan sponsor being subject to a CMP as authorized under section 1860D-12 of the Act and 42 CFR 423.752. Compliance with the data reporting requirements includes providing complete and accurate information and responding to inquiries to clarify, correct, or supplement the submission, including as necessary to allow CMS to confirm the full accuracy and completeness of the required information.

9. Written Explanation of Contracts or Agreements With Manufacturers

Section 1860D-12(h)(1)(C)(iii) of the Act, as added by the CAA, provides that not later than 30 days after the finalization of any contract or agreement between a PBM or an affiliate of such PBM and a manufacturer (or subsidiary, agent, or entity affiliated with such manufacturer) that makes rebates, discounts, payments, or other financial incentives related to one or more covered Part D drugs or other prescription drugs, as applicable, of the manufacturer directly or indirectly contingent upon coverage, formulary placement, or utilization management conditions on any other covered Part D drugs or other prescription drugs, as applicable, such PBM shall submit to the Part D plan sponsor a written explanation of such contract or agreement. It further specifies that such written explanation shall include the manufacturer subject to the contract or agreement, all covered Part D drugs and other prescription drugs, as applicable, subject to the contract or agreement and the manufacturers of such drugs, and a high-level description of the terms of such contract or agreement and how such terms apply to such drugs. We propose to adopt these requirements at § 423.2816(a).

Further, we propose at § 423.2816(c) that the high-level description of the terms of such contract or agreement describe the methodology by which the rebates, discounts, payments, or other financial incentives related to one or more Part D drugs or other prescription drugs is directly or indirectly contingent on coverage, formulary placement, or utilization management conditions on any other Part D drugs or other prescription drugs. We solicit comment on whether we should apply additional requirements to the written explanation, and in particular whether there are standardized fields or types of information that should be required.

Section 1860D-12(h)(1)(C)(iii)(II)(bb) of the Act also provides that such written explanation be certified by the Chief Executive Officer, Chief Financial Officer, or General Counsel of such PBM, or affiliate of such PBM, as applicable, or an individual delegated the authority to sign on behalf of one of these officers, who reports directly to the officer. We propose to adopt this requirement at § 423.2816(d).

Finally, 1860D-12(h)(1)(C)(iii)(III) of the Act defines the term “other prescription drugs” as “prescription drugs covered as supplemental benefits under this part or prescription drugs paid outside of this part”. We propose to adopt this definition at § 423.2816(b).

10. Audit Rights

Section 1860D-12(h)(1)(D) of the Act provides that not less than annually, at the request of the Part D plan sponsor, the PBM allow for an audit of the PBM to ensure compliance with all terms and conditions of the written agreement required by section 1860D-12(h)(1) of the Act and the accuracy of data reported under section 1860D-12(h)(1)(C) of the Act. It further provides that the Part D plan sponsor shall have the right to select an auditor and that the PBM shall not impose any limitations on the selection of such auditor. It additionally provides that the PBM shall make available to such auditor all records, data, contracts, and other information necessary to confirm the accuracy of information reported under section 1860D-12(h)(1)(C) of the Act, subject to reasonable restrictions on how such information must be reported to prevent redisclosure of such information. We propose to adopt these requirements at § 423.2818.

We note that while section 1860D-12(h)(1)(D)(i) of the Act describes the audit as encompassing both compliance with all terms and conditions of the written agreement required by section 1860D-12(h)(1) of the Act and the accuracy of data reported under section 1860D-12(h)(1)(C) of the Act, section 1860D-12(h)(1)(D)(iii) of the Act, which describes the information to be provided, only addresses records, data, contracts, and other information necessary to confirm the accuracy of information reported under section 1860D-12(h)(1)(C) of the Act. We do not interpret section 1860D-12(h)(1)(D)(iii) of the Act to mean that PBMs are not required to provide information related to compliance with all terms and conditions of the written agreement required by section 1860D-12(h)(1) of the Act as requested by the auditor. Rather, we interpret it to mean that a PBM may not refuse to provide records, data, contracts, and other information necessary to confirm the accuracy of information reported under section 1860D-12(h)(1)(C) of the Act under the logic that such PBM has already reported data to the Part D plan sponsor as required under section 1860D-12(h)(1)(C) of the Act. In other words, the reporting of data under section 1860D-12(h)(1)(C) of the Act is not equivalent to reporting sufficient information to support an audit. However, we do not believe that this clarification suggests that PBMs are not required to provide information related to compliance with all terms and conditions of the written agreement required by section 1860D-12(h)(1) of the Act as requested by the auditor.

Further, we propose at § 423.2818(c)(2) that such reasonable restrictions may address the types of records, data, contracts, and other information to be reported; the manner of reporting such information; and the use, disclosure, and dispensing of such information by the auditor and the Part D plan sponsor. They may not include requirements that wholly prevent the auditor from accessing records, data, contracts, and other information that are necessary to confirm the accuracy of information reported under section 1860D-12(h)(1)(C) of the Act.

Section 1860D-12(h)(1)(D)(iv) of the Act provides that the PBM must provide such information and other information, data, and records relevant to the audit to such auditor within 6 months of the initiation of the audit and respond to requests for additional information from such auditor within 30 days after the request for additional information. We propose to adopt this requirement at § 423.2818(d).

Finally, section 1860D-12(h)(1)(D)(v) of the Act provides that the PBM shall be responsible for providing to such auditor information required to be reported under proposed § 423.2814 or under § 423.2818(c) that is owned or held by an affiliate of such PBM. We propose to adopt this requirement at § 423.2818(e).

11. Compliance and Enforcement

a. Disgorgement of Fees to CMS

Section 1860D-12(h)(2) of the Act, as added by the CAA, introduces certain enforcement mechanisms. Section II.C.e.6. of this proposed rule describes our proposal at § 423.2810(g) to: (1) require PBMs or affiliates of such PBMs to disgorge to Part D plan sponsors any remuneration paid to such PBMs or an affiliate of such PBMs in violation of the requirements described at § 423.2810(a) no later than the earlier of the following dates: 30 days following the conclusion of an audit by the Part D plan sponsor, as allowed at § 423.2818, through which remuneration paid to the pharmacy ( printed page 66461) benefit manager or affiliate of such pharmacy benefit manager in violation of the requirements described at § 423.2810(a) was found; or 30 days following the end of the month in which the pharmacy benefit manager or affiliate of such pharmacy benefit manager identifies remuneration paid to the pharmacy benefit manager or affiliate of such pharmacy benefit manager in violation of the requirements at § 423.2810(a); and (2) require that the PBMs or affiliate of such PBMs must provide the following information to the Part D plan sponsor: the amount of the remuneration in violation of the requirements described at § 423.2810(a), the entity from which such remuneration derived, the entity that received such remuneration, and the nature of the violation.

Under section 1860D-12(h)(1)(A) of the Act, each Part D plan sponsor must disgorge to the Secretary any amounts disgorged to the Part D plan sponsor by a PBMs or affiliate of such PBMs under § 423.2810(g). In order to effectuate this requirement, CMS proposes at § 423.2820(a), to utilize the information reported pursuant to the requirements proposed at § 423.2814(d)(11) to recoup such funds from Part D plan sponsors for deposit in the Federal Supplementary Medical Insurance (SMI), or Part B and D, Trust Fund. CMS would utilize our regular payment processes we engage in with Part D plan sponsors to make a payment adjustment to relevant Part D plan sponsors, as applicable, within the quarter (three months) that starts on the July 1 data submission deadline at § 423.2814(a). We note that this proposed timeline may result in variable timeframes for disgorgement of funds to CMS, specifically in situations where an audit uncovers a violation or a PBM or affiliate of such PBM identifies remuneration paid to the pharmacy benefit manager or affiliate of such pharmacy benefit manager in violation of the requirements at § 423.2810(a) and disgorges the remuneration in violation to the Part D plan sponsor months prior to when the information must be reported to CMS (by July 1 of each year), and then disgorged to CMS. However, we believe this proposed timeframe is reasonable, given our proposed annual timeframe for reporting mechanisms for PBMs, and that we need to ensure appropriate oversight and transparency from PBMs with regard to disgorged funds prior to processing payment adjustments from the Part D plan sponsors for such funds. In addition, we will monitor the volume and frequency of funds disgorged (from PBMs or affiliates of such PBMs to Part D plan sponsors and then to CMS) and may consider alternative timelines for future reporting years if reasonable. We seek comment on our proposed timeline for disgorgement to CMS of remuneration in violation of the proposed requirements at § 423.2810, including whether we should consider a shorter timeframe for collecting monies from Part D plan sponsors. We propose to adopt this requirement at § 423.2820(a).

b. Civil Money Penalty Pass-Through

Section 1860D-12(h)(2)(A)(ii) of the Act provides that each Part D plan sponsor shall require, in a written agreement with any PBM acting on behalf of such sponsor or affiliate of such PBM, that such PBM or affiliate of such PBM reimburse the Part D plan sponsor for any civil money penalty (CMP) imposed on the Part D plan sponsor as a result of the failure of the PBM or affiliate to meet the requirements of section 1860D-12(h)(1) of the Act that are applicable to the PBM or affiliate under the agreement. We propose to adopt this requirement at § 423.2820(b).

The CAA did not introduce new authority for CMS to issue CMPs. Therefore, any such CMPs would be issued under CMS' existing authority at section 1857(g) of the Act, also referenced in section 1860D-12 of the Act, and the implementing regulations at 42 CFR 423 Subpart O.

c. Punitive Remedies for Breach of Contract Between Part D Plan Sponsor and PBM

Section 1860D-12(h)(2)(A)(iii) of the Act provides that each Part D plan sponsor shall require, in a written agreement with any PBM acting on behalf of such sponsor or affiliate of such PBM, that such PBM or affiliate be subject to punitive remedies for breach of contract for failure to comply with the requirements applicable under section 1860D-12(h)(1) of the Act. We propose to adopt this requirement at § 423.2820(c). We solicit comment on whether CMS should specify the types of punitive remedies that should be included in such written agreements.

d. Reporting of Alleged Violations, Anti-Retaliation, and Anti-Coercion

Section 1860D-12(h)(2)(B) of the Act provides that the Secretary shall make available and maintain a mechanism for manufacturers, Part D plan sponsors, pharmacies, and other entities that have contractual relationships with PBMs or affiliates of such PBMs to report, on a confidential basis, alleged violations of the requirements at section 1860D-12(h)(1)(A) and section 1860D-12(h)(1)(C) of the Act. We propose to adopt this requirement at § 423.2820(d). Reporting of such alleged violations will be made possible in a form and manner specified by CMS.

Section 1860D-12(h)(2)(B) of the Act further specifies that consistent with applicable Federal or State law, a Part D plan sponsor shall not retaliate against an individual or entity for reporting an alleged violation as described previously; or coerce, intimidate, threaten, or interfere with the ability of an individual or entity to report any such alleged violations. We propose to codify this requirement at § 423.2820(e).

e. Certificate of Compliance

Section 1860D-12(h)(3) of the Act provides that each Part D plan sponsor shall furnish to the Secretary (at a time and in a manner specified by the Secretary) an annual certification of compliance with section 1860D-12(h) of the Act, as well as such information as the Secretary determines necessary to carry out this subsection. We propose at § 423.2820(f) to collect this annual certification in a form and manner specified by CMS. We anticipate collecting this annual certification through the HPMS as part of the annual contract cycle that occurs prior to open enrollment for a subsequent plan year. Under this proposal, Part D plan sponsors would furnish the first certification of compliance in the third quarter of calendar year 2027 to attest to compliance in plan year 2028.

12. Confidentiality and Use of Information

Section 1860D-12(h)(6) of the Act requires that information disclosed by a PBM, an affiliate of a PBM, a Part D plan sponsor, or a pharmacy under section 1860D-12(h) of the Act that is not otherwise publicly available or available for purchase shall not be disclosed by the Secretary or a Part D plan sponsor receiving the information, except that the Secretary may disclose the information for the following purposes: as the Secretary determines necessary to carry out Part D of Title XVIII of the Act; to permit the Comptroller General to review the information provided; to permit the Director of the Congressional Budget Office to review the information provided; to permit the Executive Director of the Medicare Payment Advisory Commission to review the information provided; to the Attorney General for the purposes of conducting oversight and enforcement; or to the Inspector General of the Department of Health and Human Services in ( printed page 66462) accordance with its authorities under the Inspector General Act of 1978 (section 406 of title 5, United States Code), and other applicable statutes. We propose to adopt these requirements at § 423.2822(b).

We propose at § 423.2822(a) to define “available for purchase” as available: (1) in exchange for remuneration; and (2) through an agreement for which the purpose is the provision of such information. For example, WACs available through third party compendia such as First Databank, Medi-Span, or Red Book would meet these criteria since users must pay for access to these data, and the purpose of such payment is to access the data. Conversely, information on price concessions negotiated by a rebate aggregator would not meet these criteria because, while a PBM may gain access to such information via a contract with the rebate aggregator for the rebate aggregator's negotiation services, the purpose of such a contract would be for negotiation rather than the provision of such information. We intend for this policy to treat as confidential information that may be disclosed incidentally between contracting parties but which is not otherwise available for purchase.

Section 1860D-12(h)(6) of the Act requires that the Secretary, the Comptroller General, the Director of the Congressional Budget Office, and the Executive Director of the Medicare Payment Advisory Commission not report on or disclose the information described previously in this section (section II.C.12. of this proposed rule) to the public in a manner that would identify a specific PBM, affiliate, pharmacy, manufacturer, wholesaler, Part D plan sponsor, or plan; or contract prices, rebates, discounts, or other remuneration for specific drugs in a manner that may allow the identification of specific contracting parties or of such specific drugs. We propose to adopt these requirements at § 423.2822(c).

We solicit comment on these proposals.

13. Severability

The Modernizing and Ensuring Pharmacy Benefit Manager Accountability provisions proposed herein at § 423.2800 through § 423.2822 are separate and severable from one another. If any of these provisions, once finalized, is held to be invalid or unenforceable by its terms, or as applied to any person or circumstance, or stayed pending further agency action, it is our intention that such provision would be severable from this rule and not affect the remainder thereof, or the application of such provision to other persons not similarly stated or to other, dissimilar circumstances. For example, if finalized, should the requirements for the timing of the disgorgement of fees proposed herein be deemed invalid or unenforceable, the underlying obligation under current statute would continue.

III. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995 (PRA), 44 U.S.C. 3501-3520, we are required to provide notice in the Federal Register and solicit public comment before a “collection of information,” as defined under 5 CFR 1320.3(c) of the PRA's implementing regulations, is submitted to the Office of Management and Budget (OMB) for review and approval.

To fairly evaluate whether an information collection should be approved by OMB, 44 U.S.C. 3506(c)(2)(A) requires that we solicit comment on the following issues:

• The need for information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

We are soliciting public comment on each of these issues for the following sections of this document that contain confirmed or potential collection of information requirements. Comments, if received, will be addressed in the subsequent final rule (CMS-4214-F).

A. Wage Data

To derive average (mean) costs, we are using data from the most current U.S. Bureau of Labor Statistics' (BLS's) National Occupational Employment and Wage Estimates for all salary estimates ( data.bls.gov/​oes/​#/​area/​0000000/​2025), which, at the time of publication of this proposed rule, provides May 2025 wages. In this regard, Table III.1 presents BLS's mean hourly wage, our estimated cost of fringe benefits and other indirect costs (calculated at 100 percent of salary), and our adjusted hourly wage.

( printed page 66463)

Adjusting our employee hourly wage estimates by a factor of 100 percent is a rough adjustment that is being used since fringe benefits and other indirect costs vary significantly from employer to employer and because methods of estimating these costs vary widely from study to study. In this regard, we believe that doubling the hourly wage to estimate costs is a reasonably accurate estimation method.

B. Proposed Information Collection Requirements (ICRs)

The following ICRs are listed in the order of appearance within this proposed rule.

1. ICRs Regarding REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026) (§§ 422.2, 422.111, 422.123, and 422.124)

The following proposed changes will be submitted to OMB under control number 0938-10981 (CMS-TBD) At this time the OMB control number has not been determined, but it will be assigned by OMB upon their clearance of our proposed collection of information request. The control number's expiration date will be issued by OMB upon their approval of our final rule's collection of information request.

We are proposing several requirements related to the REAL Health Providers Act, which is part of section 6220 of the Consolidated Appropriations Act, 2026, effective for contract year 2028. Topics in this proposal include provider directory verification, updating, accuracy analysis, accuracy scoring, reporting, public transparency, enrollee cost sharing protections, and disclosure. Through these proposed codifications implementing the REAL Health Providers Act, CMS seeks to promote provider directory accuracy and accountability among MA organizations to ensure that beneficiaries are provided with clear, accurate information on the network of providers available to meet their health care needs.

a. ICRs Regarding Provider Directory Verification, Updating, and Disclosure (§§ 422.2, 422.123(b) Through (c) and 422.111(b)(12) and (k)(6))

CMS's proposed provider directory verification requirements (§ 422.123(b)) would require MA organizations to verify the provider directory information of each provider listed in a specified MA plan's provider directory at least every 90 days, or every 12 months for specified hospitals and facilities, using one or more CMS-specified verification methods. Provider directory information that cannot be verified would be identified in the provider directory as potentially out of date. Proposed § 422.123(b)(4) would also require MA organizations to include a new contract term obligating contracted providers to maintain current and accurate provider directory information. CMS's proposed provider directory updating requirements at § 422.123(c) would retain the existing 30-day update standard, require a quarterly addendum containing updates for all enrollees who requested physical hardcopy directories, require a disclaimer on physical hardcopy provider directories directing beneficiaries to the online provider directory or the MA organization for the latest updates, and require removal of non-contracted providers within 5 business days. Proposed disclosure requirements at §§ 422.111(b)(12) and (k)(6) would require provider directory disclosures regarding cost sharing protections and the accuracy score, as well as a cost sharing protection notice in the first EOB of each plan year.

For most of the proposed provider directory changes, CMS expects that MA organizations would build upon existing provider directory processes rather than develop entirely new processes. Existing § 422.111(b)(3)(i) requires MA organizations to disclose the number, mix, and distribution of providers from whom enrollees may reasonably be expected to obtain services and each provider's cultural and linguistic capabilities. Existing § 422.111(m), finalized in the September 2025 final rule (90 FR 45140), further requires MA organizations to make the information described in § 422.111(b)(3)(i) available to CMS/HHS for publication in MPF, update that information within 30 days after becoming aware of a change, and attest to its accuracy at least annually. The information collection for these MPF submission, formatting, and attestation requirements is approved under OMB control number 0938-1491 (CMS-10906).

As CMS explained in the September 2025 final rule, CMS's operational guide would specify how MA organizations must format and submit provider directory data, and the current Technical Implementation Guide identifies data points used for MPF, including provider or facility NPI and name, specialty or facility type, MA plan identifier, address, telephone number, practitioner languages, and whether a practitioner is accepting new patients. Existing provider directory content is also specified in the Medicare Advantage and Section 1876 Cost Plan Provider Directory Model and Instructions. For example, the model requires provider name, specialty, address, telephone number, cultural and linguistic capabilities, and information identifying whether providers are accepting new patients or directing beneficiaries to contact the provider. The model also addresses accessibility restrictions and telehealth capabilities. Therefore, the proposed definition of “provider directory information” at § 422.2 largely consolidates and standardizes information already addressed through existing provider directory requirements and guidance, including provider name, specialty, contact information, address, accepting new patients status, accommodations for people with disabilities, cultural and linguistic capabilities, and telehealth capabilities.

We are also proposing to add “common ownership or control disclosure” as a provider directory information element at § 422.2. Because this information is not part of the existing MPF provider directory data submission, CMS preliminarily estimates that it would take an MA organization 1.5 hours at $90.36/hr for a business operations specialist to identify applicable ownership or common-control relationships. With 708 contracts, CMS estimates an annual burden of 1,062 hours (708 MA organization contracts × 1.5 hr/response) at a cost of $95,962 (1,062 hr × $90.36/hr). CMS assumes MA organizations would use ownership and affiliation information they already maintain. If they need to confirm this information with a provider, that time would be included in the verification burden discussed later in this section. CMS seeks comments on these assumptions, including the time needed to identify, maintain, verify, and disclose ownership/affiliation information and whether MA organizations or providers would incur additional burden.

( printed page 66464)

CMS believes that some routine administrative activities associated with maintaining provider directory information may qualify as usual and customary business practices under 5 CFR 1320.3(b)(2) and, therefore, may be exempt from review by OMB under the authority of the PRA of 1995 (44 U.S.C. 3501 et seq.). However, CMS would assess any additional burden resulting from proposed requirements that go beyond existing practices. Although the data elements contained within the proposed definition of “provider directory information” at § 422.2 largely overlap with existing provider directory requirements and guidance, CMS would consider burden associated with any expansion in the information required and, in particular, changes to the frequency and manner of verification, updating, disclosure, or submission.

The proposed verification requirements may also impose burden on contracted providers. Proposed § 422.123(b)(4) would require MA organizations to include a new contract term obligating contracted providers to maintain current and accurate provider directory information. Because this is a new contractual requirement, CMS does not consider the burden associated with modifying existing provider contracts to be covered by the usual and customary business practice exemption. CMS estimates a one-time burden of 3 hours per MA organization contract to add the new proposed contract term. Across 708 contracts, this results in a one-time burden of 2,124 hours (708 contracts × 3 hr) at a cost of $191,925 (2,124 hr × $90.36/hr).

The proposed provider directory verification activities of MA organizations under § 422.123(b)(2) may also require providers to review, confirm, correct, or attest to provider directory information. To estimate the additional burden from recurring verification, CMS assumes each direct verification contact would take about 15 minutes for the provider and 15 minutes for the MA organization. This would result in up to 1 hour annually for providers verified every 90 days and 15 minutes annually for specified hospitals and facilities verified every 12 months. These estimates exclude verification using existing plan information or CMS-maintained data sources. We seek comments on these assumptions, including the frequency of direct provider contacts, time required, verification methods used, and the extent to which these activities exceed current practices.

Proposed § 422.123(c)(4)(i) would also require MA organizations to remove a provider from the provider directory no later than 5 business days after determining that the provider is no longer participating in the specified MA plan's network, rather than under the existing 30-day update standard. CMS estimates that meeting the shorter timeframe would add about 15 minutes of administrative work for each provider removal. CMS cannot estimate the total burden because it does not know how many providers are removed each year or how many MA organizations already meet the 5-business day timeframe. We seek comments on these assumptions, including the number of removals, current practices, and the time and cost needed to meet the proposed requirement.

b. ICRs Regarding Provider Directory Accuracy Analysis and Accuracy Score (§ 422.123(d)(1) Through (4))

At § 422.123(d)(1) through (4), CMS is proposing new requirements for MA organizations offering specified MA plans to conduct an annual provider directory accuracy analysis for each specified MA plan using a random sample of provider directory listings, including providers with provider specialty types with high provider directory inaccuracy rates, and to estimate an annual provider directory accuracy score based on such analysis. Although the proposed requirements would add some new burden for MA organizations, the requirements are designed to build upon the existing provider directory framework.

For each specified MA plan, MA organizations would use a random sample consisting of 65 percent of records in the provider directory, excluding records for providers with provider specialty types with high provider directory inaccuracy rates, and 35 percent of records for providers with provider specialty types with high provider directory inaccuracy rates, using the sampling methodology specified by CMS.

MA organizations would verify provider directory data elements for sampled providers using CMS's specified verification methods, subject to any applicable limitations on the methods that may be used to verify each provider directory element for purposes of calculating the accuracy score. Following verification, for each specified MA plan, MA organizations would calculate the accuracy percentage for each scored provider directory element, apply the applicable provider directory element weight, combine the weighted results to calculate the final composite score, and round the result to the nearest whole number to determine the final provider directory accuracy ( printed page 66465) score, in accordance with the scoring methodology specified by CMS.

CMS estimates the burden for the annual provider directory accuracy analysis and accuracy score based on the number of specified MA plans offered under an MA parent organization. CMS used available 2026 data to estimate the number of specified MA plans and the number of MA parent organizations in each grouping. For MA parent organizations with 10 or fewer specified MA plans, CMS estimates 13 hours per response at $90.36/hr for a business operations specialist. With 113 respondents, CMS estimates an annual burden of 1,469 hours (113 respondents × 13 hr/response) at a cost of $132,739 (1,469 hr × $90.36/hr).

For contracts with 11 to 50 specified MA plans, CMS estimates 20 hours per response. With 38 respondents, CMS estimates an annual burden of 760 hours (38 respondents × 20 hr/response) at a cost of $68,674 (760 hr × $90.36/hr).

For contracts with 51 or more specified MA plans, CMS estimates 30 hours per response. With 12 respondents, CMS estimates an annual burden of 360 hours (12 respondents × 30 hr/response) at a cost of $32,530 (360 hr × $90.36/hr).

The estimated hours reflect that MA parent organizations with more specified MA plans would have an increasing amount of effort, including developing plan-level samples, calculating plan-level scores, and performing quality assurance. CMS assumes that all MA parent organizations would consolidate samples across the organization and would not need to repeat verification when the same record appears in multiple plan samples, which would lower the burden for the MA parent organization as they would only need to verify the record once and could count that verification in the calculation of each of the plan accuracy scores where the record appears. As the number of specified MA plans that an MA parent organization has increases, CMS assumes that MA parent organizations would develop efficiencies related to developing plan-level samples and calculating plan-level accuracy scores, limiting the overall burden associated with these activities for each additional plan. We seek comments on these burden estimates and assumptions used, including the time required to develop the plan-level sample, conduct the accuracy analysis, and calculate plan-level accuracy scores. CMS also seeks comments on the groupings based on the number of plans an MA parent organization has and whether the cut points for the groupings represent reasonable burden estimates for each grouping.

Because certain sampling, verification, and scoring requirements remain subject to comment and finalization, the burden estimate may change. Final decisions on sample size and timing, verification requirements, and the scoring methodology could affect the amount and complexity of work required to complete the provider directory accuracy analysis. We may revise the burden estimate based on comments received and the finalized ( printed page 66466) requirements. The burden estimate may also need to account for finalized requirements concerning provider non-response, use of additional permitted verification methods, replacement records, minimum response rates, and sample size parameters.

c. ICRs Regarding Provider Directory Accuracy Report (§ 422.123(d)(5))

At § 422.123(d)(5), CMS is proposing that MA organizations offering specified MA plans must submit to CMS an annual provider directory accuracy report containing the results of the accuracy analysis and the provider directory accuracy score for each specified MA plan. CMS is proposing that the report must be submitted not later than the first Monday in April of the year following the contract year being measured, in a form and manner specified by CMS. As proposed, CMS would require that for each specified MA plan, MA organizations must compile the results of the provider directory accuracy analysis and accuracy score and submit the annual provider directory accuracy report to CMS in the required form and manner. These activities may include confirming the accuracy score calculation, reconciling or resolving identified data issues, performing necessary quality assurance, and preparing the information for submission. The scope of this burden may vary depending on the reporting elements ultimately required by CMS.

CMS estimates the burden for the annual provider directory accuracy report based on the number of specified MA plans offered under an MA parent organization. CMS used available 2026 data to estimate the number of specified MA plans and the number of MA parent organizations in each grouping. For MA parent organizations with 10 or fewer specified MA plans, we estimate 8 hours per response at $90.36/hr for a business operations specialist. With 113 respondents, we estimate an annual burden of 904 hours (113 respondents × 8 hr/response) at a cost of $81,685 (904 hr × $90.36/hr).

For MA parent organizations with 11 to 50 specified MA plans, CMS estimates 12 hours per response. With 38 respondents, we estimate an annual burden of 456 hours (38 respondents × 12 hr/response) at a cost of $41,204 (456 hr × $90.36/hr).

For MA parent organizations with 51 or more specified MA plans, CMS estimates 18 hours per response. With 12 respondents, we estimate an annual burden of 216 hours (12 respondents × 18 hr/response) at a cost of $19,518 (216 hr × $90.36/hr).

The estimated hours reflect that MA parent organizations with more specified MA plans will have an increasing amount of effort, including compiling plan-level analysis results and accuracy scores, reviewing the report for completeness and accuracy, performing necessary quality assurance, and preparing to submit the data to CMS. As discussed under section III.B.1.b. of this proposed rule, CMS assumes that MA parent organizations will develop efficiencies while compiling data for the provider directory accuracy report, limiting the overall burden associated with this activity for each additional plan. CMS seeks comments on these burden ( printed page 66467) estimates and assumptions used, including the time required to compile analysis results and accuracy scores, review the accuracy report, and submit the accuracy report to CMS. CMS also seeks comments on the groupings based on the number of plans an MA parent organization has and whether the cut points for the groupings represent reasonable burden estimates for each grouping.

We are soliciting comments on the reporting deadline and on elements included in the report that could affect the scope of information compiled and submitted. Therefore, the burden may need to be reconsidered following comment solicitation if the final requirements change the scope or preparation of the report.

In addition, we are considering whether the annual provider directory accuracy report should include additional elements, such as data on the use of cost sharing protections. We are also considering whether to require independent third-party review and certification of the annual provider directory accuracy analysis and resulting accuracy score before submission to CMS. Because these potential requirements are still under consideration, CMS has not separately calculated the associated burden. If finalized, the current estimate may need to be revised to account for compiling additional data and third-party certification activities.

d. ICRs Regarding Enrollee Cost Sharing Protections When Provider Directories Are Inaccurate (§ 422.124)

CMS is proposing to codify the new requirements at § 422.124 such that beginning with contract year 2028, MA organizations offering specified MA plans will be required to: (1) include a term in each provider contract obligating the provider to supply documentation of the earliest date on which the enrollee's appointment was made; (2) maintain a daily archive of provider directory data for not less than 10 years and make such records available to CMS upon request within 5 business days; (3) process enrollee requests for cost sharing protections as organization determinations or reconsideration requests; and (4) issue refunds to enrollees when cost sharing is collected in excess of the permitted amount.

Section 422.124(d) would require MA organizations offering specified MA plans to include a term in each provider contract for a specified MA plan obligating the provider to supply documentation of the earliest date on which the enrollee's appointment was scheduled, regardless of any rescheduling. MA organizations would then be required to obtain the scheduling documentation from the provider to determine whether the cost sharing protection applies. To comply with this requirement, each MA organization will need to review its existing provider contracts to incorporate the new contractual language. We estimate that adding the contract provision to each specified MA plan would require 3 hours at $90.36/hr for a business operations specialist. We estimate a one-time burden of 2,124 hours (708 MA organization contracts × 3 hr) at a cost of $191,925 (2,124 hr × $90.36/hr).

Section 422.124(e) would require MA organizations offering specified MA plans to confirm whether the enrollee is eligible for the provider directory cost sharing protection by maintaining and referencing a daily archive of the provider directory sufficient to identify whether a provider was listed in the directory at any time on a given date for not less than 10 years. Additionally, MA organizations would be required to make provider directory records available to CMS upon request within 5 business days. CMS estimates that establishing and maintaining a daily automated archive of provider directory data would require an initial one-time system build and an ongoing annual maintenance burden. MA organizations would need to develop or modify existing IT infrastructure to capture and store a daily snapshot of specified MA plan provider directories in a format sufficient to identify whether a provider was listed on any given date. CMS believes most MA organizations have existing data warehousing capabilities that could be adapted for this purpose, given other record retention obligations of MA organizations required by CMS.

The one-time system development burden is estimated to take approximately 40 hours at $142.40/hr for a software developer. CMS estimates a one-time burden of 28,320 hours (708 MA organization contracts × 40 hr) and $4,032,768 (28,320 hr × $142.40/hr).

Ongoing maintenance including storage management, quality checks, and responding to CMS records requests is estimated to take 10 hours at $142.40/hr for a software developer. CMS estimates an annual burden of 7,080 hours (708 MA organization contracts × 10 hr) at a cost of $1,008,192 (7,080 hr × $142.40/hr). CMS seeks comments on whether these estimates accurately reflect the operational burden of daily archiving, particularly for smaller MA organizations.

( printed page 66468)

Section 422.124 proposes requirements for MA organizations to implement cost sharing protections for items and services furnished based on reliance on incorrect provider directory information. CMS estimates that processing each enrollee request for the cost sharing protection, including verifying the date the appointment was made, referencing the archived provider directory to confirm whether the provider was listed on that date, making an organization determination, and issuing a notice, would require approximately 1.5 hours at $90.36/hr for a business operations specialist. We estimate an annual burden of 1,062 hours (708 MA organization contracts × 1.5 hr) at a cost of $95,962 (1,062 hr × $90.36/hr). We note that the volume of anticipated requests is highly uncertain and would depend on the prevalence of provider directory inaccuracies and enrollee awareness of the protections. We seek comments on expected request volumes and whether 1.5 hours is an accurate estimate of processing time.

CMS anticipates that contracted providers will incur a burden when the MA organization verifies the date the appointment was made. CMS estimates that each inquiry will require 0.5 hours at $46.80/hr for an Office and Administrative Support Worker to locate the date an appointment was scheduled and share the information with the MA organization. CMS acknowledges that, due to the absence of reliable data on the total number of contracted providers across all 708 MA organizations and uncertainty around the number of data requests associated with the cost sharing protection, it is not currently possible to provide a precise aggregate burden estimate. We therefore invite public comments on the estimated number of providers subject to this requirement, the cost, and associated time burden.

In § 422.124(g), we propose to require MA organizations to treat provider directory cost sharing protections as in-network cost sharing for purposes of the MOOP limit consistent with § 422.100(f)(4). We estimate it would take 0.5 hours at $90.36/hr for a business operations specialist to process a refund, including the time for calculating the excess amount, issuing payment, and updating MOOP tracking, would require. CMS estimates an annual burden of 354 hours (708 MA organization contracts × 0.5 hr/response) at a cost of $31,987 (354 hr × $90.36/hr). We seek comments on expected request volume and whether 0.5 hours is an accurate estimate to fully process a refund.

e. Total Burden: REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026)

Table III.10 summarizes our impacts.

( printed page 66469)

C. Summary of Proposed Information Collection Requirements and Associated Burden

D. Submission of PRA-Related Comments

We have submitted a copy of this proposed rule to OMB for its review of the rule's information collection requirements. The requirements are not effective until they have been approved by OMB.

To obtain copies of the supporting statement and any related forms for the proposed collections discussed previously, please visit CMS' PRA website at www.cms.gov/​medicare/​regulations-guidance/​legislation/​paperwork-reduction-act-1995/​pra-listing or call the Reports Clearance Office at 410-786-1326.

We invite public comments on these potential information collection requirements. If you comment on these information collection requirements, please submit your comments electronically as specified in the DATES and ADDRESSES sections of this proposed rule and identify the rule (CMS-4214-P), the ICR's CFR citation, and the OMB control number.

IV. Regulatory Impact Analysis

A. Statement of Need

This proposed rule addresses several critical needs in the Medicare Advantage (Part C) and Medicare Prescription Drug Benefit (Part D) ( printed page 66470) programs that require regulatory action to ensure program integrity, beneficiary protection, and statutory compliance. Specifically, this rule consists of proposals intended to codify and implement certain statutory requirements of the Consolidated Appropriations Act, 2026 (CAA).

• Proposed changes implementing section 6219 of the CAA (Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals) would reduce the generic drug copayment from for full-benefit dual eligible individuals. This rulemaking would reduce the generic drug copayment from $1 to $0 for full-benefit dual eligible individuals at or below 100 percent of the Federal Poverty Level, effective for plan years starting January 1, 2028.
• Proposed changes implementing section 6220 of the CAA (Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act) would establish new provider directory accuracy and accountability requirements for MA organizations beginning in contract year 2028. Without regulatory implementation of these statutory requirements, CMS cannot ensure that MA organizations meet their obligations under Federal law to maintain accurate provider directories, nor can CMS provide the beneficiary cost sharing protections and public transparency mechanisms Congress enacted into law. Specifically, the REAL Health Providers Act requires CMS to establish provider directory verification and updating standards, annual accuracy analyses and scoring, submission of accuracy reports to CMS for public posting, and beneficiary notification and cost sharing protections for enrollees who rely on inaccurate directory information.
• Proposed changes implementing section 6224 of the CAA (Modernizing and Ensuring Pharmacy Benefit Manager Accountability) would establish new and enhanced requirements governing PBM remuneration, data reporting, pricing transparency, and disclosure of manufacturer agreements within Medicare Part D, along with definitions of key terms and compliance and enforcement mechanisms, including disgorgement of funds to CMS for violations.

The absence of regulatory action would result in statutory non-compliance regarding CAA implementation, ongoing operational inefficiencies, and missed opportunities for program improvement and innovation. Therefore, this rulemaking is necessary to ensure the Medicare program operates effectively, efficiently, and in compliance with Federal law while serving the best interests of Medicare beneficiaries.

B. Overall Impact Analysis

We have examined the impacts of this proposed rule as required by Executive Order 12866, “Regulatory Planning and Review”; Executive Order 13132, “Federalism”; Executive Order 13563, “Improving Regulation and Regulatory Review”; Executive Order 14192, “Unleashing Prosperity Through Deregulation”; the Regulatory Flexibility Act (RFA) (Pub. L. 96-354); section 1102(b) of the Act; and section 202 of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4).

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts). Section 3(f) of Executive Order 12866 defines a “significant regulatory action” as any regulatory action that is likely to result in a rule that may: (1) have an annual effect on the economy of $100 million or more, or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or Tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impacts of entitlement grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, or the President's priorities.

A regulatory impact analysis (RIA) must be prepared for a regulatory action that is significant under section 3(f)(1) of E.O. 12866. Based on our estimates, OMB's Office of Information and Regulatory Affairs has determined this rulemaking is significant under section 3(f)(1) of E.O. 12866.

C. Detailed Economic Analysis

Many provisions of this proposed rule have negligible impact either because they are technical provisions or because they are clarifications. Throughout the preamble we have noted when we estimated that provisions have no impact. Additionally, this RIA discusses several provisions with either zero impact or impact that cannot be quantified. The remaining provisions' effects are estimated in section III. of this proposed rule, which estimates costs associated with paperwork burden resulting from this rule. Where appropriate, when a group of provisions have both paperwork and non-paperwork impact, this RIA cross-references impacts from section III. of this proposed rule in order to arrive at the total impact. Table IV.1 summarizes the estimated transfers and costs associated with the various provisions in this proposed rule over a 10-year period. Further details are provided later in this RIA.

( printed page 66471)

1. Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals (Section 6219 of the Consolidated Appropriations Act, 2026)

This section provides the impact associated with the proposed provision to eliminate the copayment on non-multi-source generic drugs for the $1/$3 low-income subsidy (LIS) beneficiary group. The affected entities include Medicare Part D beneficiaries (specifically full-benefit dual-eligible individuals with incomes at or below 100 percent of the Federal Poverty Level) and the Medicare program. Impacts are quantified using 2025 Prescription Drug Event (PDE) data. We seek public comment on the assumptions and methodologies described below, particularly where data limitations exist.

The potential benefits of this proposed provision include improved medication access and adherence for low-income Medicare Part D beneficiaries, reduced financial burden for vulnerable populations, and potential long-term health outcome improvements associated with increased use of clinically appropriate generic medications. To the extent that the proposal induces switching from brand-name drugs to lower-cost generics, this effect is a transfer—a redistribution of drug spending among the Medicare program and beneficiaries, rather than a net benefit or cost of the provision.^[46]

Table IV.2 summarizes the estimated benefit, premium, and net Federal cost impacts of the proposed provision over the 2028-2037 period (in millions of dollars).

The net Federal cost of the proposed provision is estimated at approximately $1.337 billion over the 2028-2037 period, reflecting the direct copay elimination cost net of premium offsets. The benefit impact of $1.461 billion reflects the total increase in Medicare program spending attributable to the three modeled effects. The premium impact of $124 million reflects the partial offset from increased Part D plan premiums resulting from higher program costs.

The elimination of the copayment on non-multi-source generic drugs is a transfer, not a cost of the proposed provision. Beneficiaries in the $1/$3 LIS group who previously paid the copay will no longer bear that cost; the Medicare program will absorb it instead. Consistent with OMB Circular A-4's treatment of subsidies as transfer payments, this direct copay elimination effect redirects existing resources from the Medicare program's financing base to the affected beneficiary population; it does not consume real resources.

To the extent that the proposal induces brand-to-generic switching, there may be a partial offsetting transfer in the form of reduced drug spending—from brand manufacturers to the Medicare program and beneficiaries—as lower-cost generics replace higher-cost brand drugs. This transfer represents a redistribution of drug spending rather than a change in the total resources consumed. This switching effect is assumed to be limited given the relatively modest actual copay differential between brand and generic drugs under the current $1/$3 LIS structure.

2. REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026)

The provision implementing the REAL Health Providers Act is expected to increase costs for 708 MA organizations by $6,025,071 in contract year 2028 and $1,608,453 annually in subsequent years consistent with the estimates outlined in the Collection of Information section of this proposed rule for provider directory verification, updating and disclosure, the provider directory accuracy analysis and accuracy score, the provider directory accuracy report, and enrollee cost sharing protections when provider directories are inaccurate. These estimates may change based on public comments and final implementation of requirements including: the final sampling requirements under proposed § 422.123(d)(2), verification methods used for purposes of the accuracy score under proposed § 422.123(d)(3), scoring methodology under proposed § 422.123(d)(4), and annual reporting requirements under proposed § 422.123(d)(5). The burden associated with quarterly hardcopy provider directory addenda under proposed § 422.123(c)(2) and new beneficiary disclosures under proposed § 422.111(b)(12) and (k)(6) may also need to be reconsidered based on public comments and the degree to which they can be incorporated into existing processes.

The provision would also impose burden on the Federal Government. CMS would be responsible for specifying the sampling criteria (§ 422.123(d)(2)), verification methods (§ 422.123(d)(3)), and the weighted accuracy scoring methodology (§ 422.123(d)(4)), as well as receiving ( printed page 66472) and overseeing annual provider directory accuracy reports (§ 422.123(d)(5)). In addition, under proposed § 422.123(e), beginning with contract years beginning on or after January 1, 2029, CMS will post provider directory accuracy scores in a machine-readable file on the CMS website. However, CMS notes that Federal implementation costs associated with this aspect of the provision would be supported by the $4,000,000 that Congress appropriated to CMS's Program Management Account for fiscal year 2026 to support implementation of the REAL Health Providers Act.

3. Modernizing and Ensuring Pharmacy Benefit Manager Accountability (Section 6224 of the Consolidated Appropriations Act, 2026)

Section 6224 of the CAA requires that, beginning in plan year 2028, remuneration to PBMs and affiliates of PBMs in connection with the utilization of Part D drugs be limited to bona fide service fees reflecting fair market value, as defined by the Secretary, subject to certain exceptions. The Congressional Budget Office has estimated that this provision would reduce federal direct spending by approximately $444 million over the 2026-2035 period. Contract arrangements between PBMs, Part D plan sponsors, pharmacies, and pharmaceutical manufacturers are complex. The contracts between PBMs and Part D plan sponsors vary widely by the size of the sponsor and vertical integration of some PBM functions has increased in recent years. While it is possible that the fair market value definition proposed in this rule will result in lower service fees, we do not have sufficient data on the difference between the proposed fair market value definition and current fee structures or the range of potential PBM responses to form a reasonable analysis of the overall impact to the Part D program. For PBMs and Part D plan sponsors with common corporate ownership, any changes to the PBM fee structure may be offset by changes to the Part D bid to achieve the same overall target revenue of the parent organization. For PBMs without such a related party arrangement, they may adjust other terms of their agreements with Part D plan sponsors or pharmacies to the extent allowable under current laws and regulations. Alternatively, PBMs could balance lower fees under Medicare with higher fees on other lines of business. Without a more comprehensive understanding of how the fair market value definition relates to current contracting levels and what flexibility the PBMs will have to adjust other contract terms, the impact of this proposed rule is uncertain. We welcome comments regarding the quantification of the impact of these provisions.

D. Alternatives Considered for REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026)

In this section, we include discussions of alternatives considered for the provisions to which they are applicable. CMS did not develop an alternatives considered section for several of the provisions in this proposed rule as they generally are direct implementations of Federal laws or codifications of existing policy for MA and Part D.

1. Alternatives Considered for Provider Directory Verification Requirements (§ 422.123(b))

Under proposed § 422.123(b), MA organizations would verify provider directory information using CMS-specified verification methods. CMS considered limiting which verification methods could be used for particular provider directory elements during the routine 90-day and 12-month verification cycles but did not propose these limitations because they could increase administrative burden. CMS proposes limitations for verification conducted for purposes of calculating the accuracy score and may revisit these approaches as provider data sources and the NPD develop. The proposed 12-month verification cycle for specified hospitals and facilities is intended to limit verification burden on both MA organizations and providers. CMS also recognizes that MA organizations may need to use more than one verification method to verify all required provider directory elements, and that direct provider verification may increase burden depending on the method and frequency of contact.

2. Alternatives Considered for Provider Directory Accuracy Analysis and Sampling Methodology (§ 422.123(d)(1) and (2))

Consistent with section 1857(e)(6)(A) of the Act, proposed § 422.123(d)(1) and (2) would require an annual plan-level accuracy analysis using a random sample of providers. CMS considered alternative approaches for identifying high-inaccuracy provider specialty types, geographic stratification, sample size parameters, consolidation of overlapping provider samples, and timing of sample selection. In evaluating these approaches, CMS considered data availability, administrative burden, operational flexibility, comparability across plans, duplicative verification, and potential for gaming. CMS seeks comments on several of these considerations before finalizing the sampling requirements. In particular, CMS recognizes that larger samples could increase burden on MA organizations and providers and intends to consolidate overlapping plan-level samples across an MA organization to reduce duplicative provider contacts. CMS is also considering minimum and maximum sample parameters that balance meaningful accuracy results with administrative burden.

3. Alternatives Considered for Provider Directory Accuracy Score and Scoring Methodology (§ 422.123(d)(3) and (4))

Consistent with section 1857(e)(6)(B) of the Act, proposed § 422.123(d)(3) and (4) would establish verification and weighted scoring requirements for calculating provider directory accuracy scores. CMS considered incorporating results from the routine 90-day and 12-month verification cycles into the accuracy score, alternative approaches for weighting those results relative to the annual sample, and giving greater weight to high-inaccuracy specialty types. CMS did not propose these approaches because they could increase the complexity and burden of the scoring methodology but seeks comments on whether they should be considered. CMS did not propose more complex scoring alternatives that could increase burden on MA organizations and providers.

4. Alternatives Considered for Provider Directory Accuracy Reporting (§ 422.123(d)(5))

Consistent with section 1857(e)(6)(A)(ii) of the Act, proposed § 422.123(d)(5) would require MA organizations to submit an annual provider directory accuracy report to CMS. CMS considered requiring additional reporting elements, including specialty-level response and sampling data and administrative cost information, and whether the accuracy analysis and score should be independently reviewed and certified by a qualified third party. CMS also seeks comments on whether the proposed reporting deadline provides sufficient time for MA organizations to complete the report. Requiring additional reporting elements or independent third-party review and certification could increase reporting and compliance burden beyond the proposed annual report. CMS seeks comments on these considerations, including administrative costs to MA organizations and contracted providers. ( printed page 66473)

5. Alternatives Considered for Exception for Specified MA Plans With Low Enrollment

Section 1857(e)(6)(C) of the Act permits the Secretary to waive the annual accuracy analysis and reporting requirements for specified MA plans with low enrollment. CMS considered using existing MA minimum enrollment thresholds or the Star Ratings threshold to define low enrollment. Although an exemption could reduce burden on smaller plans, CMS is inclined to apply the requirements to all specified MA plans and seeks comments on whether and how to implement the exception. If implemented, a low-enrollment exception would reduce the accuracy analysis and reporting burden for qualifying plans. However, those plans would remain subject to the verification and updating requirements under proposed § 422.123(b) and (c).

6. Alternatives Considered for Provider Directory Public Transparency (§ 422.123(e))

Consistent with section 1857(e)(6)(D) of the Act, proposed § 422.123(e) would require CMS to post provider directory accuracy scores in a machine-readable file beginning in contract year 2029. CMS is also considering making the scores available through CMS APIs and posting them on MPF. The required machine-readable posting would impose Federal implementation burden on CMS. Making scores available through additional CMS APIs or MPF would require additional Federal implementation beyond the statutory machine-readable posting.

7. Alternatives Considered for Enrollee Cost Sharing Protections (§ 422.124)

Consistent with section 1852(d)(7) of the Act, proposed § 422.124 would establish cost sharing protections for enrollees who rely on inaccurate provider directory information. CMS is considering whether the protections should also apply to reliance on hardcopy directories, whether MA organizations should publicly post daily provider directories rather than provide archived information to CMS upon request, and whether to establish specific formatting requirements for archived provider directory data. CMS seeks comments on these alternatives and the proposed data-retention period. The alternatives could affect burden on MA organizations by changing the information and systems needed to document enrollee reliance on provider directory information. Publicly posting daily directories or establishing specific archive formats could increase system and maintenance burden relative to the proposed approach, while extending the protections to hardcopy directories could require additional verification of the directory information relied upon.

8. Alternatives Considered for Provider Directory Disclosure Requirements (§ 422.111(b)(12) and (k)(6))

Consistent with sections 1852(d)(7)(B) and 1851 (d)(4)(F) of the Act, proposed § 422.111(b)(12) and (k)(6) would establish disclosures concerning provider directory accuracy scores and enrollee cost sharing protections. In addition to the required provider directory and EOB disclosures, CMS is considering including notice of the cost sharing protections in the SB and EOC to provide information before and after enrollment. Including the cost sharing protection notice in the SB and EOC would increase the number of beneficiary materials MA organizations would need to update and distribute and could result in additional administrative burden beyond the proposed provider directory and EOB disclosures.

E. Regulatory Review Cost Estimation

If regulations impose administrative costs on reviewers, such as the time needed to read and interpret the proposed rule, then we should estimate the cost associated with regulatory review. We have received approximately 20,000 comments specific to the provisions of our recent proposed rule, and we estimate that a similar number will review this rule upon publication in the Federal Register .

Using the BLS wage information for medical and health service managers (code 11-9111), we estimate that the cost of reviewing this proposed rule is $135.54 per hour, including fringe benefits, overhead, and other indirect costs ( www.bls.gov/​oes/​current/​oes_​nat.htm). Assuming an average reading speed, we estimate that it will take approximately 1 hour for each person to review this proposed rule. For each entity that reviews the rule, the estimated cost is therefore $135.54 (1 hour × $135.54). Therefore, we estimated that the maximum total cost of reviewing the proposed rule is $2.7 million ($135.54 × 20,000 reviewers). However, we expected that many reviewers, for example pharmaceutical companies and PBMs, will not review the entire rule but review just the sections that are relevant to them. We expect that on average (with fluctuations) 10 percent of the proposed rule will be reviewed by an individual reviewer; we, therefore, estimate the total cost of reviewing to be $271,080. We welcome any comments on the approach in estimating the number of entities which will review this proposed rule.

We noted that this analysis assumes one reader per contract. Some alternatives included assuming one reader per parent organization. Using parent organizations instead of contracts would reduce the number of reviewers. However, we believe it is likely that review will be performed by contract. The rationale for this is that a parent organization might have local reviewers assessing potential region-specific effects from the rule.

F. Accounting Statement and Table

Table IV.3 summarizes costs, savings, and transfers by provision. As required by OMB Circular A-4 (available at www.whitehouse.gov/​wp-content/​uploads/​2025/​08/​CircularA-4.pdf), we have prepared an accounting statement in Table IV.3 showing the transfers and costs associated with the provisions of this rule over a 10-year period or for contract years 2028 through 2037.

( printed page 66474)

G. Impact on Small Businesses—Regulatory Flexibility Act (RFA)

The RFA, as amended, requires agencies to analyze options for regulatory relief of small businesses if a rule has a significant impact on a substantial number of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions.

We believe this proposed rule will have a direct economic impact on beneficiaries and health insurance plans. Based on the size standards set by the Small Business Administration (SBA) effective March 17, 2023, (for details, see the Small Business Administration's website at www.sba.gov/​document/​support-table-size-standards ), Direct Health and Medical Insurance Carriers, classified using the NAICS code 524114, have a $47 million threshold for “small size.” Many Medicare Advantage organizations (about 30 to 40 percent) are not-for-profit,^[47] which allows them to qualify as “small entities” so long as they are independently owned and operated and nondominant in their field. We believe all of the not-for-profit organizations qualify as small under the aforementioned criteria. Of the 1,071 businesses using this NAICS code, we believe 799 (or 74.6 percent) are small businesses.

Using CMS's own payment records, we have been able to make estimates as to the minimum size of the smallest Medicare Advantage and Part D insurance contracts. The vast majority of Part D contracts and MA organizations must meet minimum size and financial thresholds that ensures their resilience. Based on payments made for the current year, we estimated that the three smallest MA parent organizations, excluding new entities that are not yet required to fulfill CMS enrollment thresholds, are expected to average over $5 million in total receipts by the end of 2026.

The RFA does not define the terms “significant economic impact” or “substantial number.” The SBA advises that this absence of statutory specificity allows what is “significant” or “substantial” to vary, depending on the problem that is to be addressed in the rulemaking, the rule's requirements, and the preliminary assessment of the rule's impact. Nevertheless, HHS typically considers a “significant economic impact” to be 3 to 5 percent or more of the affected entity's costs or revenues, and a “substantial number” to mean 5 percent or more of affected small entities within a given industry.^[48]

1. Operational Aspects of the Medicare Program

To explain our position, we will first note certain operational aspects of the Medicare program. Each year, MA organizations submit a bid for each plan for furnishing Parts A and B benefits and the entire bid amount is paid to the plan by the government through the Medicare Trust Funds, if the plan's bid is below an administratively set benchmark. If the plan's bid exceeds that benchmark, the beneficiary pays the difference in the form of a basic premium (note that, historically, only 2 percent of plans bid above the benchmark, and they contain roughly 1 percent of all plan enrollees). Part D sponsors also submit a bid for each plan, and the payments made to stand-alone Part D plans (PDPs) are covered by the Supplementary Medical Insurance Medicare Trust Fund.

MA plans can also offer enhanced benefits—that is, benefits not covered under Original Medicare. These enhanced benefits are paid for through enrollee premiums, rebates or a combination. Under the statutory payment formula, if the plan bid submitted by an MA organization for furnishing Part A and B benefits is lower than the administratively set benchmark, the government pays a portion of the difference to the plan in the form of a rebate. The rebate must be used to provide supplemental benefits (that is, benefits not covered under Original Medicare) and/or to lower beneficiary cost sharing, Part B or Part D premiums. Some examples of these supplemental benefits include vision, dental, and hearing, fitness and worldwide coverage of emergency and urgently needed services.

Part D sponsors submit bids and plans are paid through a combination of Medicare funds and beneficiary premiums. In addition, for enrolled low-income beneficiaries, Part D plans receive special government payments to cover most of premium and cost sharing amounts those beneficiaries would otherwise pay.

Thus, the cost of providing services by these insurers is funded by the government and, in some cases, by enrollee premiums. As a result, MA plans, Part D plans, Prescription Drug Plans, and PACE organizations are not expected to incur burden or losses since the private companies' costs are being supported by the government and enrolled beneficiaries. This lack of expected burden applies to both large and small health plans.

In addition to the direct costs discussed earlier, there are certain indirect consequences of these provisions which also create impact. We have already explained that 98 percent of MA plans (including MA-PD plans) bid below the benchmark. Thus, their estimated costs for the coming year are fully paid by the Federal Government, given that as previously noted, under the statutory payment formula, if a bid submitted by a MA plan for furnishing Part A and B benefits is lower than the administratively set benchmark, the government pays a portion of the difference to the plan in the form of a beneficiary rebate, which must be used to provide supplemental benefits or lower beneficiary cost sharing or both, Part B or Part D premiums. If the plan's ( printed page 66475) bid exceeds the administratively set benchmark, the beneficiary pays the difference in the form of a basic premium. However, as also noted previously, the number of MA plans bidding above the benchmark to whom this burden applies does not meet the RFA criteria of a significant number of firms.

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a metropolitan statistical area and has fewer than 100 beds. This analysis must conform to the provisions of section 603 of the RFA. Therefore, the Secretary has certified that this proposed rule would not have a significant impact on the operations of a substantial number of small rural hospitals.

If the provisions of the rule were to cause bids to increase and if the benchmark remains unchanged or increases by less than the bid does, the result could be a reduced rebate. Plans have different ways to address this in the short-term, such as reducing administrative costs, modifying benefit structures, or adjusting profit margins. These decisions may be driven by market forces. Part of the challenge in pinpointing the indirect effects is that there are many other factors combining with the effects of the rule, making it effectively impossible to determine whether a particular policy had a long-term effect on bids, administrative costs, margins, or supplemental benefits.

2. Anticipated Costs and Savings

As indicated in Table IV.1, the proposals described in this rule are expected to result in de minimis costs amounting to approximately $6 million in 2028, with costs of approximately $1.6 million expected in subsequent years. MA organizations and Part D sponsors will be the entities most economically impacted by this rule.

The costs incurred by MA and Part D contracts fall below the HHS significance threshold. For an MA organization that incurred all anticipated costs stemming from the REAL Health Providers Act provisions of this rule, they may be expected to see $17,105 in new costs in 2028 and $10,867 a year thereafter. Measured against the average revenue of the smallest MA parent organizations as identified earlier in this section ($5 million), these new costs resulting from the REAL Health Providers Act provision are expected to reflect less than 3 percent of the affected entity's costs or revenues.

In summation, this proposed rule will not have a significant economic impact on a substantial number of small entities. The vast majority of MA organizations and Part D sponsors are expected to see de minimis costs as a result of this rule.

H. Unfunded Mandates Reform Act (UMRA)

Section 202 of UMRA also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2026, that threshold is approximately $193 million. This proposed rule is not anticipated to have an unfunded effect on State, local, or Tribal governments, in the aggregate, or on the private sector of $193 million or more.

I. Federalism

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a rule that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has federalism implications. Since this proposed rule does not impose any substantial costs on State or local governments, preempt State law or have federalism implications, the requirements of Executive Order 13132 are not applicable.

J. E.O. 14192, “Unleashing Prosperity Through Deregulation”

E.O. 14192, titled “Unleashing Prosperity Through Deregulation” was issued on January 31, 2025, and requires that “any new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least 10 prior regulations”. We estimate that this rule generates $1.4 million in annualized costs at a 7 percent discount rate, discounted relative to year 2024, over a perpetual time horizon.

K. Conclusion

This proposed rule, if finalized, will result in net annualized costs ranging between $2.1 and $2.2 million for calendar years 2028 to 2037, at the 3 percent and 7 percent discount rates, respectively. The costs are attributable to the provision REAL Health Providers Act (Section 6220 of the Consolidated Appropriations Act, 2026). This proposed rule will also result in net annualized monetized transfers ranging between $121.3 million and $128.14 million for calendar years 2028 to 2037, at the 3 percent and 7 percent discount rates respectively. These transfers result from the provision Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals.

XII. Response to Comments

Because of the large number of public comments we normally receive on Federal Register documents, we are not able to acknowledge or respond to them individually. We will consider all comments we receive by the date and time specified in the DATES section of this preamble, and, when we proceed with a subsequent document, we will respond to the comments in the preamble to that document.

Mehmet Oz, Administrator of the Centers for Medicare & Medicaid Services, approved this document on October 14, 2026.

For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services proposes to amend 42 CFR Chapter IV as set forth below:

1. The authority for part 422 continues to read as follows:

Authority: 42 U.S.C. 1302, 1306, 1395w-21 through 1395w-28, and 1395hh.

2. Section 422.2 is amended by adding definitions for “Maximum fair price (MFP)”, “Provider directory,” “Provider directory accuracy score,” “Provider directory information,” “Selected drug”, “and “Specified MA plan” in alphabetical order.

The additions read as follows:

3. Section 422.111 is amended by—

a. Revising paragraph (b)(3)(i);

b. Adding paragraph (b)(12);

c. Revising paragraphs (h)(2) and (k) paragraph heading; and

d. Adding paragraph (k)(6).

The revisions and additions read as follows:

4. Section 422.120 is amended by revising paragraph (b)(1) to read as follows:

5. Subpart C is amended by adding § 422.123 to read as follows:

6. Subpart C is amended by adding § 422.124 to read as follows:

7. Section 422.202 is amended by adding paragraphs (e) and (f) to read as follows:

8. Section 422.504 is amended by adding paragraph (a)(22) to read as follows:

9. Section 422.2265 is amended by—

a Revising paragraph (b)(3); and

b. Adding paragraph (b)(15).

The revision and addition read as follows:

10. Section 422.2267 is amended by revising paragraphs (e)(11) introductory text and (e)(11)(iv); to read as follows:

11. The authority for part 423 continues to read as follows:

Authority: 42 U.S.C. 1302, 1306, 1395w-101 through 1395w-152, and 1395hh.

12. Section 423.505 is amended by adding paragraph (b)(28) to read as follows:

13. Section 423.782 is amended by revising paragraph (a)(2)(iii) to read as follows:

14. Part 423 is amended by adding subpart BB to read as follows:

91 FR 66408