423.504—General provisions.

(a) General rule. Subject to the provisions at § 423.265 of this part concerning submission of bids, to enroll beneficiaries in any Part D drug plan it offers and be paid on behalf of Part D eligible individuals enrolled in those plans, a Part D plan sponsor must enter into a contract with CMS. The contract may cover more than one Part D plan.

(b) Conditions necessary to contract as a Part D plan sponsor. Any entity seeking to contract as a Part D plan sponsor must—

(1) Complete an application as described in § 423.502 demonstrating that the entity has the capability to meet the requirements of this Part, including those listed in § 423.505.

(2) Be organized and licensed under State law as a risk bearing entity eligible to offer health insurance or health benefits coverage in each State in which it offers a Part D plan, or have secured a Federal waiver, as described in subpart I of this part. (Fallback entity applicants need not be licensed as risk-bearing entities, nor are they required to obtain State licensure demonstrating that the applicant is eligible to offer health insurance or health benefits coverage in each State in which it applies to operate.)

(3) Meet the minimum enrollment requirements of § 423.512(a) unless waived under § 423.512(b).

(4) Have administrative and management arrangements satisfactory to CMS, as demonstrated by at least the following:

(i) A policy making body that exercises oversight and control over the Part D plan sponsor's policies and personnel to ensure that management actions are in the best interest of the organization and its enrollees.

(ii) Personnel and systems sufficient for the Part D plan sponsor to organize, implement, control, and evaluate financial and marketing activities, the furnishing of prescription drug services, the quality assurance, medical therapy management, and drug and or utilization management programs, and the administrative and management aspects of the organization.

(iii) At a minimum, an executive manager whose appointment and removal are under the control of the policy making body.

(iv) A fidelity bond or bonds, procured and maintained by the Part D sponsor, in an amount fixed by its policymaking body but not less than $100,000 per individual, covering each officer and employee entrusted with the handling of its funds. The bond may have reasonable deductibles, based upon the financial strength of the Part D plan sponsor.

(v) Insurance policies or other arrangements, secured and maintained by the Part D plan sponsor and approved by CMS to insure the Part D plan sponsor against losses arising from professional liability claims, fire, theft, fraud, embezzlement, and other casualty risks.

(vi) Adopt and implement an effective compliance program, which must include measures that prevent, detect, and correct noncompliance with CMS' program requirements as well as measures that prevent, detect, and correct fraud, waste, and abuse. The compliance program must, at a minimum, include the following core requirements:

(A) Written policies, procedures, and standards of conduct that—

(1) Articulate the Part D plan sponsor's commitment to comply with all applicable Federal and State standards;

(2) Describe compliance expectations as embodied in the standards of conduct;

(3) Implement the operation of the compliance program;

(4) Provide guidance to employees and others on dealing with potential compliance issues;

(5) Identify how to communicate compliance issues to appropriate compliance personnel;

(6) Describe how potential compliance issues are investigated and resolved by the Part D plan sponsor; and

(7) Include a policy of non-intimidation and non-retaliation for good faith participation in the compliance program, including but not limited to reporting potential issues, investigating issues, conducting self-evaluations, audits and remedial actions, and reporting to appropriate officials.

(B) The designation of a compliance officer and a compliance committee who report directly and are accountable to the Part D plan sponsor's chief executive or other senior management.

(1) The compliance officer, vested with the day-to-day operations of the compliance program, must be an employee of the Part D plan sponsor, parent organization or corporate affiliate. The compliance officer may not be an employee of the Part D plan sponsor's first tier, downstream or related entity.

(2) The compliance officer and the compliance committee must periodically report directly to the governing body of the Part D plan sponsor on the activities and status of the compliance program, including issues identified, investigated, and resolved by the compliance program.

(3) The governing body of the Part D plan sponsor must be knowledgeable about the content and operation of the compliance program and must exercise reasonable oversight with respect to the implementation and effectiveness of the compliance programs.

(C) (1) Each Part D plan sponsor must establish, implement and provide effective training and education for its employees including, the chief executive and senior administrators or managers; governing body members; and first tier, downstream, and related entities.

(2) The training and education must occur at a least annually and be a part of the orientation for new employees including, the chief executive and senior administrators or managers; governing body members; and first tier, downstream, and related entities.

(3) First tier, downstream, and related entities who have met the fraud, waste, and abuse certification requirements through enrollment into the Medicare program or accreditation as a Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) are deemed to have met the training and educational requirements for fraud, waste, and abuse.

(D) Establishment and implementation of effective lines of communication, ensuring confidentiality, between the compliance officer, members of the compliance committee, the Part D plan sponsor's employees, managers and governing body, and the Part D plan sponsor's first tier, downstream, and related entities. Such lines of communication must be accessible to all and allow compliance issues to be reported including a method for anonymous and confidential good faith reporting of potential compliance issues as they are identified.

(E) Well-publicized disciplinary standards through the implementation of procedures which encourage good faith participation in the compliance program by all affected individuals. These standards must include policies that—

(1) Articulate expectations for reporting compliance issues and assist in their resolution;

(2) Identify non-compliance or unethical behavior; and

(3) Provide for timely, consistent, and effective enforcement of the standards when non-compliance or unethical behavior is determined.

(F) Establishment and implementation of an effective system for routine monitoring and identification of compliance risks. The system should include internal monitoring and audits and, as appropriate, external audits, to evaluate the Part D plan sponsors, including first tier entities', compliance with CMS requirements and the overall effectiveness of the compliance program.

(G) Establishment and implementation of procedures and a system for promptly responding to compliance issues as they are raised, investigating potential compliance problems as identified in the course of self-evaluations and audits, correcting such problems promptly and thoroughly to reduce the potential for recurrence, and ensure ongoing compliance with CMS requirements.

(1) If the Part D sponsor discovers evidence of misconduct related to payment or delivery of prescription drug items or services under the contract, it must conduct a timely, reasonable inquiry into that conduct;

(2) The Part D sponsor must conduct appropriate corrective actions (for example, repayment of overpayments and disciplinary actions against responsible individuals) in response to the potential violation referenced above.

(3) The Part D plan sponsor should have procedures to voluntarily self-report potential fraud or misconduct related to the Part D program to CMS or its designee.

(5) Not have non-renewed a contract under § 423.507 within the past 2 years unless—

(i) During the 6-month period, beginning on the date the entity notified CMS of the intention to non-renew the most recent previous contract, there was a change in the statute or regulations that had the effect of increasing Part D sponsor payments in the payment area or areas at issue; or

(ii) CMS has otherwise determined that circumstances warrant special consideration.

(6) Not have terminated a contract by mutual consent under which, as a condition of the consent, the Part D plan sponsor agreed that it was not eligible to apply for new contracts or service area expansions for a period up to 2 years per § 423.508(e) of this subpart.

(7) For a full risk or limited risk PDP applicant, not submitted a bid or offered a fallback prescription drug plan in accordance with the following rules.

(i) CMS does not contract with a potential PDP sponsor for the offering of a full risk or limited risk prescription drug plan in a PDP region for a year if the applicant—

(A) Submitted a bid under § 423.863 for the year (as the first year of a contract period under § 423.863 to offer a fallback prescription drug plan in any PDP region;

(B) Offers a fallback prescription drug plan in any PDP region during the year; or

(ii) Construction. For purposes of this paragraph (b)(6), an entity is treated as submitting an application to become qualified to contract as a full risk or limited risk PDP sponsor, if the entity is acting as a subcontractor for an integral part of the drug benefit management activities of a full risk or limited risk PDP sponsor or applicant. The previous sentence does not apply to entities that are subcontractors of an MA organization except insofar as the MA organization is applying to act as a full risk or limited risk PDP sponsor.

(c) Contracting authority. CMS may enter into contracts under this part, or in order to carry out this part, without regard to Federal and Departmental acquisition regulations set forth in Title 48 of the CFR and provisions of law or other regulations relating to the making, performance, amendment, or modification of contracts of the United States if CMS determines that those provisions are inconsistent with the efficient and effective administration of the Medicare program.

(d) Protection against fraud and beneficiary protections. (1) CMS annually audits the financial records (including, but not limited to, data relating to Medicare utilization and costs, including allowable reinsurance and risk corridor costs as well as low income subsidies and other costs) under this part of at least one-third of the Part D sponsors offering Part D drug plans.

(2) Each contract under this section must provide that CMS, or any person or organization designated by CMS, has the right to—

(i) Inspect or otherwise evaluate the quality, appropriateness, and timeliness of services performed under the Part D plan sponsor's contract;

(ii) Inspect or otherwise evaluate the facilities of the Part D sponsor when there is reasonable evidence of some need for the inspection; and

(iii) Audit and inspect any books, contracts, and records of the Part D plan sponsor that pertain to—

(A) The ability of the organization or its first tier or downstream providers to bear the risk of potential financial losses; or

(B) Services performed or determinations of amounts payable under the contract.

(e) Severability of contracts. The contract must provide that, upon CMS' request—

(1) The contract could be amended to exclude any State-licensed entity, or a Part D plan specified by CMS; and

(2) A separate contract for any excluded plan or entity must be deemed to be in place when a request is made.

[70 FR 4525, Jan. 28, 2005, as amended at 72 FR 68732, Dec. 5, 2007; 73 FR 20507, Apr. 15, 2008; 75 FR 19820, Apr. 15, 2010]