CMS Proposes Protocols for Enhanced Oversight of Medicare Part C Utilization Management Requirements

In 2024, the Centers for Medicare & Medicaid Services (CMS) leveraged its existing oversight channels¹ to assess plans’ compliance with the coverage and utilization management (UM) provisions of the CY 2024 Medicare Advantage and Part D Final Rule (CMS-4201-F). On the tail end of those efforts, the agency has now announced² a 60-day public comment period for newly proposed protocols designed to improve its oversight of plans’ compliance with UM requirements going forward. 

The proposed collections³ include an annual data submission as well as an audit protocol and data request, both of which are centered around key provisions of CMS-4201-F related to whether coverage criteria are fully established, plans’ development, and use of internal coverage criteria, public accessibility of plans’ coverage criteria, and functions of the UM Committee (UMC). Each collection would be required to include information not only relevant for plan operations but also for any first tier, downstream, and related entities (FDRs) performing UM functions and for any vendors or entities responsible for the development of internal coverage criteria (e.g., MCG). 

CMS intends to use the information provided through the annual data submissions to inform the selection of plans to participate in UM audits each year. These UM audits would further focus on particular types of services and items from a “CMS List of Targeted Services” to be updated each calendar year, and would require a data universe to be compiled and submitted addressing the following for those services or items:

• Whether the plan considers CMS criteria to be fully established;
  • If so, the specific names and references of applicable regulations, National Coverage Determinations, or Local Coverage Determinations; 
  • If not, the reason(s) the plan determined that CMS criteria were not fully established;
• The name(s) of any vendor(s) responsible for developing coverage criteria; and
• Whether the plan has documentation to support the applicable internal coverage criteria:
  • Are supported by widely used treatment guidelines or clinical literature;
  • Were reviewed and approved by the UMC before implementation; and
  • Are publicly accessible. 

In an approach already familiar to plans from existing CMS program audit protocols, the newly proposed UM audit would include a selection of a sample of services or items from the submitted data universe for which plans or impacted FDRs would be required to supply additional documentation to CMS supporting compliance with additional aspects of coverage and UM requirements. As it relates to internal coverage criteria, this requires producing evidence that the criteria are based on widely used treatment guidelines or literature and that criteria that interpret or supplement Medicare criteria provide a clinical benefit that is highly likely to outweigh any clinical harm. 

While these proposed collections are subject to change based on consideration of public comments,⁴ what is clear from this latest announcement is that CMS’s scrutiny of UM is just getting started. The detail and specificity of the proposed submissions will likely pose a challenge for many plans to generate, and the proposed oversight processes leave no room to hide for plans and FDRs as to whether they are compliant with applicable requirements. For those still struggling to fully operationalize the requirements of CMS-4201-F or that have not yet pressure-tested updated processes, CMS’s announcement should serve as a strong reminder to prioritize those efforts and validate compliance with UM requirements before CMS rolls out its updated oversight channels.

^{1. See October 24, 2023 Health Plan Management System (HPMS) memorandum titled “2024 Oversight Activities” and December 19, 2023 HPMS memorandum titled “2024 Program Audit Updates.”} 

^{2. See September 10, 2024 HPMS memorandum titled “Proposed Collection for Medicare Part C Utilization Management Annual Data Submission and Audit Protocol Data Request – 60- Day Comment.”}

^{3. See Paperwork Reduction Act (PRA) Listing CMS-10913 titled “Medicare Part C Utilization Management Annual Data Submission and Audit Protocol Data Request,” available at https://www.cms.gov/medicare/regulations-guidance/legislation/paperwork-reduction-act-1995/pra-listing/cms-10913.} 

^{4. 60-day public comments on the proposed collection are due November 12, 2024.} 

^{© Copyright 2024. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.}