CMS's Final Rule on Medicaid Managed Care: A Summary of Major Provisions

Introduction

On April 21, 2016, the Centers for Medicare & Medicaid Services (CMS) issued a final rule on managed care in Medicaid and the Children’s Health Insurance Program (CHIP).¹ The new rule, which largely retains the provisions that CMS proposed on May 26, 2015, represents a major revision and modernization of federal regulations in this area, which were last updated more than a decade ago, in 2002. Since that time, the role of risk-based managed care in Medicaid has grown significantly in both scale and scope. States have expanded their programs to cover populations with more complex needs; broader geographic areas; additional services, including behavioral health and long-term services and supports (LTSS); and, in the states that have expanded Medicaid under the Affordable Care Act (ACA), millions of adults who are newly eligible for the program.

According to the most current national data, as of July 1, 2014, 43.4 million Medicaid beneficiaries, or just over 60%, were enrolled in comprehensive risk-based managed care organizations (MCOs), reflecting a 24% increase in MCO enrollment over the year before.² Currently, 38 states and the District of Columbia contract with MCOs; in many of these states, at least 75% of all beneficiaries are enrolled in plans.³ While MCOs are the predominant form of Medicaid managed care, millions of other beneficiaries receive at least some Medicaid services, such as behavioral health or dental care, through limited-benefit risk-based plans, known as prepaid inpatient health plans (PIHPs) and prepaid ambulatory health plans (PAHPs). Several million beneficiaries are also enrolled in primary care case management (PCCM) programs that range from basic managed fee-for-service (FFS) models to more enhanced models.

CMS identified a number of principles and goals that guided its development of the new regulations. The agency sought to align key Medicaid and CHIP managed care requirements with other health coverage programs, such as Medicare Advantage and the ACA Marketplaces, where appropriate; enhance the beneficiary experience of care and strengthen beneficiary protections; strengthen actuarial soundness payment provisions and program integrity; promote quality of care; and support efforts to reform the delivery systems that serve Medicaid and CHIP beneficiaries.⁴

This issue brief summarizes major provisions of the final rule. It is not an exhaustive review of the regulation, but it serves an informational guide to key federal requirements for state Medicaid managed care programs and the plans with which they contract. The general effective date of the final rule is July 5, 2016, although individual provisions of the rule take effect at different times, mostly over the next three years. Until provisions of the final rule take effect, current regulations remain in force.

Wider application of Medicaid managed care rules

Extension to additional Medicaid managed care entities. The final rule applies many new and existing Medicaid managed care standards to PAHPs as well as PIHPs and MCOs. It also applies certain of the standards to newly defined “PCCM entities,” which, in addition to furnishing basic PCCM services, also perform some of the same administrative and other functions that MCOs perform, such as intensive case management, provider contracting or oversight, enrollee outreach, and/or performance measurement and quality improvement. Under the final rule, states must obtain CMS approval of all contracts with PCCM entities, monitor and evaluate their networks and performance, and include them in their managed care quality strategies, discussed later.

CHIP alignment. The final rule extends most of the requirements and standards that apply to state Medicaid managed care programs and plans to CHIP as well, modified as appropriate for differences between the two programs. The rule aligns CHIP with Medicaid on the 85% medical loss ratio standard, beneficiary information, disenrollment, and marketing requirements, and enrollee rights and protections, discussed below. It also applies the requirements related to provider network adequacy and access to care, continuity of care, quality assessment and performance improvement, external quality review, grievances and appeals, and program integrity to CHIP managed care plans. Some Medicaid standards do not apply to CHIP. In particular, while CHIP managed care contracts, including capitation rates, are subject to CMS prior review, they are not subject to CMS prior approval as Medicaid contracts are.⁵ Nor does the final rule extend the provisions on managed LTSS to CHIP.

Anti-discrimination provisions.  The final rule expands the specific bases on which discrimination is prohibited in Medicaid managed care contracts. In addition to race, color, and national origin, plans cannot discriminate on the basis of sex, sexual orientation, gender identity or disability against individuals eligible to enroll.⁶ The final rule also adds Section 1557 of the ACA to the list of federal anti-discrimination laws with which managed care plan contracts must comply.  Section 1557 prohibits discrimination on the basis of race, color, national origin, age, disability, and sex in health programs and activities that receive federal funds.⁷

Beneficiary support and information

Beneficiary support system. The final rule requires states to establish an independent beneficiary support system to serve both potential enrollees in an MCO, PIHP, PAHP, PCCM, or PCCM entity and current enrollees who are changing plans.⁸ The system must provide assistance by phone and internet and in person, and it must offer: 1) personalized choice counseling⁹ to assist beneficiaries with evaluating their health plan options and facilitate enrollment; 2) assistance to beneficiaries in understanding managed care; and 3) assistance for enrollees who use or wish to use LTSS. Specifically, the LTSS assistance must include: 1) an access point for complaints and concerns; 2) education on enrollees’ rights and responsibilities; 3) assistance in navigating the grievance and appeal process;¹⁰ and 4) review and oversight of data to guide the state in identifying and resolving LTSS systemic issues. The overall beneficiary support system also must engage in outreach to beneficiaries. States can draw upon and expand services they already provide to meet the new requirements.  These provisions are effective for plan contracts starting on or after July 1, 2018.

Standards for beneficiary information. The final rule replaces existing regulations regarding the information that must be made available to beneficiaries with a more structured set of standards that apply to states, all MCOs, PIHPs, PAHPs, and PCCM entities, and, to a limited extent, PCCM arrangements. The new standards are designed to improve the content and format of information available to help beneficiaries understand how managed care works and evaluate and compare their managed care options, particularly given the expansion of managed care to people with disabilities and complex needs, and the linguistic and cultural diversity of Medicaid beneficiaries. The new requirements apply to plan contracts beginning on or after July 1, 2017.

Existing requirements are strengthened in numerous ways, as follows:

• Information for potential enrollees. The final rule expands the information that states must provide to potential managed care enrollees to help them understand the Medicaid managed care program and their options. The new information includes beneficiary disenrollment rights, expanded provider directory information (described below), the prescription drug formulary, and, to the extent available, quality and performance indicators. This information must be provided when the potential enrollee is first eligible or required to enroll in managed care and within a timeframe that enables the potential enrollee to use the information in choosing a plan.
• Information for current enrollees. Within a reasonable time after an enrollee receives an enrollment notice, the plan must provide the enrollee with a handbook that compiles specified information that is already required under existing regulations and is similar to the summary of coverage and benefits required for private health plans. Plans also must provide enrollees with a provider directory and drug formulary information. Existing federal requirements regarding state and plan information for Medicaid beneficiaries already enrolled in managed care plans continue to apply.
• Standardization of information. To improve the consistency and usefulness of beneficiary information, states must develop definitions of key managed care terms¹¹ and model handbooks and enrollee notices that all plans must use.
• Accessibility of information. States and plans must make written beneficiary materials, including, at a minimum, enrollee handbooks, provider directories, grievance and appeal notices, and denial and termination notices, available in locally prevalent non-English languages.¹²All written materials must be available in alternative formats upon request without cost to beneficiaries. In addition, states and plans must provide interpretation services in all languages, and auxiliary aids and services for enrollees and potential enrollees with disabilities, upon request and free of charge, and notify enrollees and potential enrollees about how to access these services. Taglines in large print¹³ and in locally prevalent non-English languages are required on all written materials to explain the availability of interpretation and translation services and provide the toll-free choice counseling number and the plan’s toll-free customer service number. All written materials must use easily understood language and format and be printed in at least 12 point font. Each plan also must have mechanisms to help enrollees and potential enrollees understand the plan’s requirements and benefits.
• Availability of electronic information. States must operate a Medicaid managed care website that, directly or by linking to individual plan websites, contains enrollee handbooks, provider directories, prescription drug formularies, and network adequacy standards for each managed care plan.¹⁴ Required enrollee information may be provided online by the state or plans as long as it is compliant with all language and disability accessibility standards, displayed prominently on the state or plan website, can be printed, and is available in paper form within 5 business days upon request and without charge. Plans also can provide required information by mail, by email with enrollee consent, or by other reasonable methods.

Provider directories. Each MCO, PIHP, PAHP, and when appropriate, PCCM entity, must make a provider directory available electronically and, on request, in paper form. The directory must include each network provider’s name and any group affiliation, address, telephone number, specialty, website URL, and whether the provider will accept new enrollees. The directory must also indicate each provider’s linguistic capabilities, as well as whether the provider has completed cultural competence training, and whether the provider’s offices, exam rooms, and equipment accommodate individuals with physical disabilities. The directory must include this information for physicians, hospitals, pharmacies, behavioral health providers, and LTSS providers covered under the plan contract. Paper directories must be updated at least monthly and electronic directories no later than 30 calendar days after the MCO, PIHP, PAHP, or PCCM entity receives updated provider information.

Drug formulary information. Each MCO, PIHP, PAHP, and, as appropriate, PCCM entity must make information about its drug formulary available electronically or in paper form. The formulary information must include which generic and name brand medications are covered and which tier each medication is on.

Marketing. The final rule amends current marketing restrictions on MCOs, PIHP, PAHPs, PCCMs, and PCCM entities to permit a qualified health plan (QHP) issuer to market to a Medicaid beneficiary even if the issuer is also the entity providing Medicaid managed care services. This change seeks to facilitate smoother coverage transitions and care continuity for individuals who may migrate between Medicaid and QHP eligibility, and to give families whose members are divided between Medicaid and QHP coverage opportunities to choose an issuer that offers products in both markets. These provision are effective on July 5, 2016.

Enrollment and disenrollment protections

The final rule adds new provisions that require states to have an enrollment system for both voluntary and mandatory Medicaid managed care programs. Effective for contracts starting on or after July 5, 2016, the enrollment system must meet certain requirements, as follows:

Enrollment

• Voluntary managed care programs. Enrollees eligible for voluntary managed care programs must have the opportunity to actively choose between FFS and managed care and, if applicable, their managed care plan. If the state uses a passive enrollment system – that is, selects a managed care plan for each potential enrollee – the enrollment notice to beneficiaries must clearly explain the implications of not making an active choice between FFS and managed care and of declining enrollment in the plan selected for them by the state. The notice also must explain that beneficiaries who are passively enrolled in a managed care plan have a 90-day disenrollment period during which they can accept the plan selected for them by the state, decline it and select a different plan, or decide to remain in FFS.
• Mandatory managed care programs. In mandatory managed care programs with passive enrollment, the enrollment notice to the beneficiary must explain the enrollee’s right to disenroll from the plan to which he or she is assigned and select an alternative plan within 90 days from the effective date of the beneficiary’s initial plan enrollment. In mandatory programs without passive enrollment, the state must allow beneficiaries a period of time to actively choose a plan; if beneficiaries do not make an active choice in that period, the state can enroll the beneficiary into a plan using its default enrollment process.¹⁵
• Default plan assignment. Whenever states assign beneficiaries to plans, they must seek to preserve existing provider-beneficiary relationships and relationships with providers that have traditionally served Medicaid beneficiaries, or, if that is not possible, equitably distribute individuals among participating plans. States may consider additional criteria, including the preferences of family members, previous plan assignment, quality assurance and improvement performance, accessibility for people with physical disabilities, and other reasonable factors in assigning enrollees to plans.

Disenrollment

• Under the final rule, enrollees using LTSS have good cause to disenroll from their managed care plan if they would have to change their residential, institutional, or employment supports provider, if they would experience a disruption in their residence or employment as a result of the provider leaving the managed care plan’s network (effective for contracts starting on or after July 1, 2017).
• The final rule clarifies that states can accept beneficiaries’ disenrollment requests orally and/or in writing. It also clarifies that disenrollment requests denied by a plan must be referred to the state for review.

Network adequacy and access to care

Time and distance standards. The final rule strengthens current regulations regarding network adequacy. It requires states that contract with MCOs, PIHPs, or PAHPs to develop and enforce network adequacy standards that include, at a minimum, time and distance standards for each of the following provider types, if covered under the contract: primary care (separate adult and pediatric), OB/GYN, behavioral health, specialists (separate adult and pediatric, and including mental health and substance use disorder professionals), hospitals, pharmacies, pediatric dental, and additional provider types when it promotes the objectives of the Medicaid program as determined by CMS.¹⁶ Plans must demonstrate that their networks have family planning providers sufficient to ensure timely access to these services, but enrollees retain their right to free choice of family planning provider regardless of the provider’s network participation.

States that contract with plans that cover LTSS must develop time and distance standards for LTSS providers when the enrollee must travel to the provider, and network adequacy standards other than time and distance standards for LTSS providers that travel to the enrollee to deliver services.

The network adequacy standards are effective for the rating period for contracts starting on or after July 1, 2018.

• Considerations. The final rule adds to the elements that current regulations require states to consider in developing network adequacy standards.¹⁷ In particular, states must consider the ability of network providers to communicate with limited English proficient enrollees in their preferred language, and their ability to ensure physical access, reasonable accommodations, culturally competent communications, and accessible equipment for Medicaid enrollees with physical or mental disabilities. States must also consider the availability of triage lines or screening systems and the use of telemedicine, e-visits, and/or other evolving and technological solutions.
  –
  In developing network adequacy standards for LTSS providers, states also must consider elements that would support an enrollee’s choice of provider, strategies that ensure enrollees’ health and welfare and would support community integration, and other factors that are in the best interest of enrollees who need LTSS.

• Exceptions. If a state permits an exception to its provider-specific network adequacy standard, the criteria by which the exception will be evaluated and approved must be specified in the MCO, PIHP, or PAHP contract and be based, at a minimum, on the number of providers in the relevant specialty who practice in the plan’s service area. In addition, states must monitor enrollee access to that provider type on an ongoing basis and include their findings in their annual program report to CMS, discussed later in this brief.
• Special provisions for Indians. State contracts with MCOs, PIHPs, PAHPs, and PCCM entities (if they have provider networks) that enroll Indians must require the plans to demonstrate that they have sufficient Indian health care providers (IHCPs)¹⁸ in their network to ensure timely access to covered services for Indian enrollees. Plans must pay IHCPs for covered services provided to Indian enrollees, whether the IHCPs are in their network or not, a negotiated rate or no less than they would pay a non-IHCP network provider. State contracts with non-Indian-controlled plans must require the plans to permit Indian enrollees to choose a network IHCP primary care provider (PCP) as their PCP if the provider has capacity, and to access out-of-network IHCP providers for covered services. Plans must pay out-of-network IHCPs in accordance with federally qualified health center (FQHC) rates, Indian Health Service encounter rates, or the state plan FFS, as applicable. These provisions apply for contracts starting on or after July 1, 2017.

Plan and state assurances of plan capacity and access. Plans must document to the state that they have the capacity to serve the expected enrollee population, annually and when there are significant changes in a plan’s operations that affect its capacity.¹⁹ Significant changes are defined by the state and include changes that affect the plan’s covered services or geographic service area, the composition of or payments to its provider network, or enrollment of a new population. States, in turn, must assure CMS that the plans meet the state’s requirements for availability of services and provide an analysis that supports the state’s certification of each plan’s provider network adequacy. Plan contracts also must require plans to meet state standards for timely access to care, participate in state efforts to promote linguistically and culturally competent care, and provide physical access, reasonable accommodations, and accessible equipment for enrollees with disabilities. These provisions are effective for plan contracts starting on or after July 1, 2018.

Utilization management and authorization of services. States must ensure, through their contracts with MCOs, PIHPs, and PAHPs, that services supporting individuals who have ongoing or chronic conditions or require LTSS are authorized in a manner that reflects their ongoing needs for such services. In addition, utilization controls must not interfere with enrollees’ freedom to choose their method of family planning. The final rule also requires that decisions to deny authorization for a service or authorize a more limited scope of services than requested be made by individuals with appropriate expertise in addressing the enrollee’s medical, behavioral health, or LTSS needs. The rule also changes the required timeframe in which plans must make expedited authorization decisions, from 3 working days, as existing regulations provide, to 72 hours after receipt of the request for the service; this change aligns the Medicaid standard with Medicare Advantage and commercial standards. These provisions are effective for plan contracts starting on or after July 1, 2017.

Care coordination. The final rule effectively broadens current care coordination requirements to ensure that MCO, PIHP, and PAHP enrollees have access to ongoing sources of all care appropriate to their needs, including not only primary care but also behavioral health services and LTSS. Federal standards for care coordination also are expanded to encompass coordination between settings, coordination with services provided outside the plan by a different plan or through FFS, and coordination with community and social support providers. Plans must provide enrollees with the contact information for their care coordinator. MCOs, PIHPs, and PAHPs must make their best effort to conduct a health risk assessment within 90 days of enrollment for all new enrollees, including subsequent attempts to contact the enrollee if the initial attempt is unsuccessful. These provisions are effective for plan contracts starting on or after July 1, 2017.

Continued services during transitions. States must have a continuity of care policy to ensure continued access to services during beneficiary transitions from FFS to a managed care plan (including PCCMs and PCCM entities), or from one managed care plan to another, when, without continued services, an enrollee would suffer serious detriment to his or her health or a risk of hospitalization or institutionalization. Among other requirements, the policy must ensure access to services consistent with enrollees’ previous access and permit enrollees to retain their current provider for a period of time (to be specified by the state) if the provider is not in the plan’s network. State contracts with MCOs, PIHPs, and PAHPs must require that the plans implement continuity of care policies that meet these standards. States also must make their continuity of care policy publicly available and instruct enrollees and potential enrollees about how to access continued services during a transition. These provisions are effective for contracts starting on or after July 1, 2018.

Prescription drug coverage. MCOs, PIHPs, and PAHPs whose contracts include covered outpatient prescription drugs are required to meet federal Medicaid FFS standards regarding the availability and prior authorization of these drugs as if the standards applied directly to the health plans. These provisions are effective for plan contracts starting on or after July 1, 2017.

“In lieu of” services and short stays in Institutions for Mental Diseases (IMDs). The final rule codifies longstanding CMS policy regarding when plans may cover services and settings in lieu of those available under the Medicaid state plan. The state must identify any such services in the plan’s contract and determine that these services are medically appropriate and cost-effective. In lieu of services are offered at plan option, and an enrollee cannot be required to use them.

Under the final rule, states can, for the first time, receive federal matching funds for capitation payments made to an MCO or PIHP on behalf of enrollees ages 21-64 who receive psychiatric or substance use disorder (SUD) inpatient or crisis residential services in an IMD for no more than 15 days in a month,²⁰ provided that the psychiatric or SUD treatment provided in an IMD meets the criteria for “in lieu of” services. This provision establishes an exception to the general federal prohibition against any Medicaid payments for adult Medicaid beneficiaries while they are patients in an IMD. The change is intended to improve access to short-term inpatient psychiatric and SUD treatment for Medicaid managed care enrollees, and to improve the coordination and management of care for enrollees who need such treatment. This provision take effect on July 5, 2016.

Managed long-term services and supports (MLTSS)

For the first time, CMS includes regulations specific to the provision of MLTSS, acknowledging the significant expansion of this delivery system model since the Medicaid managed care regulations were last revised. The final rule defines LTSS for purposes of the managed care rules²¹ and includes references to LTSS throughout, whereas existing regulations refer only to medical services provided by plans. Some new requirements particular to MLTSS are detailed below. Many of the provisions in the final rule seek to codify the MLTSS best practices in programs identified in CMS’s 2013 guidance.²²

Identification and assessment of enrollees with LTSS needs. States must have mechanisms to identify enrollees with LTSS needs, and MCOs, PIHPs, and PAHPs must use appropriate providers or LTSS service coordinators to comprehensively assess such enrollees to identify any ongoing special conditions  that require a course of treatment or regular care monitoring. These provisions are effective for plan contracts starting on or after July 1, 2017.

Person-centered planning process. Health plans must produce a treatment or service plan for enrollees who need LTSS. The plan must be developed by an LTSS service coordinator trained in person-centered planning, with enrollee participation and in consultation with the enrollee’s providers. The final rule also requires that, when an MCO, PIHP, or PAHP authorizes LTSS for an enrollee, it take into account the enrollee’s current needs assessment and person-centered service plan. Plans must be reviewed at least annually, as well as when the enrollee’s circumstances or needs change significantly or at the enrollee’s request. These provisions are effective for health plan contracts starting on or after July 1, 2017.

Services provided in home and community-based settings. Plan contracts that include MLTSS must comply with the same rules on home and community-based services settings that apply to Medicaid LTSS delivered on a FFS basis.²³ This provision is effective for plan contracts starting on or after July 5, 2016.

Provider credentialing. The state’s provider credentialing process must address behavioral health and LTSS providers. This provision is effective for plan contracts starting on or after July 5, 2016.

Stakeholder engagement. States must create and maintain a stakeholder group to solicit and address the opinions of beneficiaries, individuals representing beneficiaries, providers, and other stakeholders in the design, implementation, and oversight of a state’s MLTSS program. The composition of the group and frequency of meetings must be sufficient to ensure meaningful engagement. In addition, plans providing MLTSS must have a member advisory committee that includes at least a reasonably representative sample of the populations receiving LTSS covered by the plan or other individuals representing those enrollees. This provision is effective for plan contracts starting on or after July 1, 2017.

Appeals

The final rule includes provisions intended to better align the Medicaid managed care appeals process with the processes required for Marketplace and MA plans. These provisions are effective for health plan contracts starting on or after July 1, 2017.

Timeframes. The final rule changes the timeframes for several components of the appeals process, as summarized below in Table 1. The new appeal timeframes for managed care appeals may differ from the timeframes for appeals of Medicaid eligibility determinations and claims for Medicaid-covered benefits that are provided on a FFS basis; under existing law, states must afford beneficiaries a reasonable time, up to 90 days from the date the notice is mailed, to request these latter types of appeals.

Internal plan appeal process and access to state fair hearing. The final rule allows only one level of internal plan appeals for enrollees. Once an enrollee exhausts this single level of internal appeal, he or she can request a state fair hearing. CMS also revised the existing regulation that allowed states to determine whether enrollees can bypass the internal plan appeal process and proceed directly to a state fair hearing; under the final rule, all enrollees must exhaust the internal plan appeal process first. The final rule adds a provision that deems exhaustion of the internal plan appeal if the plan does not follow the regulations governing notice and timing to resolve appeals; in such cases, the enrollee can request a state fair hearing without first receiving notice from the plan of its decision.

Table 1: Changes to Timeframes for Appeals Process
Process	Existing Rule	New Rule for Plan Contracts Starting on or after July 1, 2017
Beneficiary request for an internal plan appeal	State selects a period between 20 and 90 days from notice of adverse benefit determination	60 calendar days from date of the notice of adverse benefit determination
Standard timeframe for decision on an internal plan appeal	45 days* from plan’s receipt of appeal	30 calendar days* from plan’s receipt of appeal (state may set shorter timeframe)
Notice of expedited resolution of an appeal by health plan	3 working days from plan receipt of appeal	72 hours from plan receipt of appeal
Beneficiary request for a state fair hearing	State selects a period between 20 and 90 days from notice of adverse benefit determination; state option about whether beneficiaries can bypass internal plan appeal and go directly to fair hearing	120 calendar days from the date of the notice of internal plan appeal resolution; beneficiaries must exhaust internal plan appeal before accessing fair hearing
Health plan implementation of internal plan appeal decision or state fair hearing decision when an adverse benefit determination is overturned	Promptly and as expeditiously as the enrollee’s health condition requires	72 hours from plan’s receipt of notice reversing the determination
NOTE: *These timeframes may be extended by up to 14 calendar days at the enrollee’s request or if the plan shows to the state’s satisfaction the need for additional information and how the delay is in the enrollee’s interest.

Optional external medical review. The final rule includes a new option for states to offer and arrange for an external medical review as part of the appeals process. These reviews must be independent of the state and the health plan, at the enrollee’s option, and without cost to the enrollee. External medical reviews cannot be required before, or used as a deterrent to, accessing a state fair hearing and must neither extend the timeframes required to resolve appeals nor disrupt continuation of benefits during appeals.

Continuation of benefits during appeals. The final rule modifies existing regulations to enable beneficiaries to continue to receive services while an appeal of a plan’s decision to terminate, suspend, or reduce previously authorized services, and subsequent state fair hearing, are pending. A beneficiary must request continuation of benefits within 10 calendar days of the plan sending the termination notice or the intended effective date of the termination, whichever is later. Additionally, the beneficiary must file a timely request for an internal plan appeal (within 60 days from the termination notice), and the original authorization period must not have expired.²⁴ For benefits to continue until a state fair hearing decision is issued, the beneficiary must request a fair hearing and continuation of benefits within 10 calendar days of the plan sending the internal appeal resolution notice.  If an enrollee loses an appeal and had received continued services during the appeal, the plan can recoup the cost of the continued services, but only to the extent that the state does so in FFS.

Beneficiary access to documents and records. The final rule clarifies that beneficiaries must have reasonable access to and copies of documents, records, and other information relevant to their claims for benefits, including medical necessity criteria and any processes, strategies, or evidentiary standards used by the plan in setting coverage limits. Access to these materials must be provided without cost to the beneficiary and provided sufficiently in advance of the timeframe for resolution of the appeal.

Information considered during appeals. The final rule clarifies that plans must consider all comments, documents, records, and other information submitted by beneficiaries or their representatives in appeals, regardless of whether the information was considered in the plan’s initial decision.

Recordkeeping. The final rule sets minimum standards for the types of information that states, through their contracts, must require plans to include in their appeals records. The rule also clarifies that states must review these records as part of their ongoing monitoring and oversight procedures.

Rate-setting

The final rule strengthens federal requirements regarding the development of capitation rates for MCOs, PIHPs, and PAHPs to increase transparency, fiscal integrity, and beneficiary access to care, and to promote innovation and improvement in the delivery of services.

Actuarial soundness standards. The final rule significantly strengthens the standards that states must meet in developing actuarially sound capitation rates and that CMS will apply in its review and approval of rates, effective July 5, 2016 except as indicated otherwise. Actuarially sound capitation rates are defined as those projected to provide for all reasonable, appropriate, and attainable costs required under the terms of the contract,²⁵ developed in accordance with standards detailed in the final rule, and approved by CMS as actuarially sound.

To be approved by CMS, rates must meet numerous requirements. Any proposed differences among capitation rates for different covered populations must be based on valid rating standards and not on the federal matching rates associated with those populations. The payment rate under one rate cell must not subsidize the payment rate under any other. Capitation rates must be adequate to ensure that plans can meet their requirements regarding the availability of services, adequate networks and capacity, and coordination and continuity of care provided to enrollees (effective for contracts beginning on or after July 1, 2018). As explained in more detail below, the final rule incorporates a minimum medical loss ratio (MLR) standard in the definition of actuarial soundness (effective for contracts beginning on or after July 1, 2019). An actuary must certify that the capitation rates meet all requirements.

• Specificity of capitation rates. Capitation rates must be specific to each rate cell under the contract, and states must certify a specific rate, rather than a rate range, for each rate cell (effective for contracts beginning on or after July 1, 2018). States have flexibility to increase or decrease the capitation rate for each rate cell by 1.5 percent without submitting a revised rate certification to CMS for review and approval.
• State certification of capitation rates. States must certify the final capitation rate for each rate cell that is paid under each MCO, PIHP, and PAHP contract as actuarially sound and document the underlying data, assumptions, and methodologies in enough detail so that CMS or an actuary can understand and evaluate them. States must submit all rate certifications to CMS for review and approval concurrent with the CMS review and approval process for all contracts.
• Plan certification of data and documentation. MCOs, PIHPs, and PAHPs must submit to states the data on the basis of which states certify the actuarial soundness of capitation rates, determine plan compliance with the MLR requirement, and certify plan compliance with state requirements for availability and accessibility of services, including provider network adequacy. The data and documentation submitted by plans must be certified by the plan’s CEO or CFO or an individual who reports directly to the CEO or CFO and is authorized to sign for him or her; the certification must attest that the submitted data and documentation are accurate, complete, and truthful.

Minimum medical loss ratio (MLR). An MLR is the ratio of a health plan’s incurred claims and expenditures for health care quality improvement activities to the plan’s adjusted premium revenue. The final rule establishes a minimum MLR standard for MCOs, PIHPs, and PAHPs for the first time. The minimum MLR is 85%, the same standard that applies to Medicare Advantage and private large group plans.²⁶ States must develop capitation rates in a manner such that the plan can reasonably achieve an MLR of at least 85% in a rate year, taking into account the plan’s actual MLR in the past rate year. The rule does not require remittances from plans that fail to meet the minimum MLR standard, but states have authority to require such remittances. The minimum 85% MLR standard applies to contracts starting on or after July 1, 2019.

Each MCO, PIHP, and PAHP must calculate and report its MLR to the state annually. The rule defines standards regarding both how plans must calculate their MLR and the information to be included in the MLR report to the state. Plans must attest that the MLR was calculated accurately in accordance with the federal standards. The MLR calculation and reporting requirements apply to contracts starting on or after July 1, 2017.

Delivery system and payment initiatives. The final rule clarifies states’ authority to require MCOs, PIHPs, or PAHPs to: implement value-based purchasing models for provider payment, such as pay-for-performance arrangements, bundled payments, or other models intended to reward value over volume; participate in multi-payer or Medicaid-specific delivery system reform or performance improvement initiatives; adopt a minimum or maximum fee schedule for network providers that provide a particular service; or provide a uniform dollar or percentage increase for network providers that provide a particular service. Any such arrangements must be based on the utilization and delivery of services, be expected to advance the goals of the state managed care quality strategy (described below), not be renewed automatically, and meet other requirements. This provision is effective for contracts starting on or after July 1, 2017.

Pass-throughs of state supplemental provider payments. The final rule phases out “pass-throughs” of state supplemental provider payments in the capitation rates paid to MCOs, PIHPs, or PAHPs, because they are not tied to the provision of services covered under plan contracts and therefore conflict with the actuarial soundness requirement. Pass-through payments to hospitals will phase out over the period 2017-2027 by 10 percentage points per year, and pass-through payments to physicians and nursing facilities will phase out over the period 2017-2022.

Quality of care

The final rule amends and increases existing regulatory requirements regarding quality assurance standards for managed care programs. It also extends application of the quality standards to PAHPs and, in many cases, to PCCM entities whose contracts include financial incentives for improved quality outcomes. (All mentions of PCCM entities in this section refer to these PCCM entities only.)

Managed care state quality strategy. Under the final rule, each state contracting with an MCO, PIHP, PAHP, or PCCM entity must draft and implement a written quality strategy for assessing and improving the quality of all care and services furnished by these entities.²⁷ The managed care quality strategy must include, among other elements: the state-defined standards for network adequacy and availability of services for MCOs, PIHPs, and PAHPs; the state’s goals and objectives for continuous quality improvement, which must be measurable and take into account the health status of all populations served by plans; the quality and performance measures the state will publish at least annually on its website; performance improvement projects (PIP) required by the state or CMS; the state’s transition of care policy; and the arrangements for annual external reviews of quality under each contract, discussed further below. The quality strategy must also describe the state’s mechanism for identifying for plans those enrollees who need LTSS or have special health care needs. It must also describe the state’s plan to reduce health disparities based on age, race, ethnicity, sex, primary language, and disability, and states must collect and share this demographic information with plans for each Medicaid enrollee at the time of enrollment.

States must make their quality strategy publicly available and obtain input before submitting it to CMS for review. States must post the final quality strategy on their website, review and update it at least every three years, and post the review results on their website. States must submit a revised strategy to CMS whenever they make significant changes to it. States must comply with the quality strategy requirements by July 1, 2018.

Medicaid managed care quality rating system (QRS). Under the final rule, CMS, through a public notice and comment process, will identify performance measures and a methodology for a Medicaid managed care QRS that aligns with the summary indicators of the QRS for QHPs (these currently include clinical quality management; member experience; and plan efficiency, affordability, and management). CMS anticipates that it will finalize the QRS by 2018. Within three years after the final CMS notice is published, states contracting with an MCO, PIHP, or PAHP must implement CMS’s QRS. Alternatively, states may request CMS approval to implement a QRS that uses different measures or a different methodology provided that it yields information substantially comparable to CMS’s QRS, and only following a public notice and comment period. Once the QRS is implemented, states must issue an annual quality rating for each plan based on data collected from the plan and display the ratings prominently on their website.

State review of MCO, PIHP, and PAHP accreditation status. Under the final rule, states must confirm the accreditation status of each contracting plan at least annually.²⁸ They must post and update the accreditation information on their website at least annually. These provisions apply to contracts starting on or after July 1, 2017.

Quality assessment and performance improvement (QAPI) programs. The final rule expands the scope of QAPI programs, and applies QAPI requirements to PAHPs and PCCM entities as well as MCOs and PIHPs. Under the final rule, states must require each plan to establish and implement an ongoing comprehensive QAPI program. The QAPI program for MCOs, PIHPs, and PAHPs must include performance improvement projects (PIPs), collection and submission of performance measurement data, mechanisms to identify underutilization and overutilization of services, and mechanisms to assess the quality and appropriateness of care furnished to enrollees with special needs; the QAPI program for PCCM entities must include at least the second and third elements in this list. For MCOs, PIHPs, or PAHPs that provide LTSS, the QAPI must include mechanisms to assess the quality and appropriateness of care furnished to enrollees using these services, including an assessment of transition care and whether the enrollee received the services and supports set forth in his or her treatment plan.

States must identify PIPs and standard performance measures for MCOs, PIHPs, and PAHPs. These must include any national performance measures that CMS may specify in the future.²⁹ In the case of MCOs, PIHPs, and PAHPs that provide LTSS, states must also identify standard performance measures related to quality of life, rebalancing, and community integration activities. Plans must either annually report their performance on these standard measures to the state and/or submit data that enable the state to calculate the plan’s performance. These provisions apply to contracts starting on or after July 1, 2017.

External quality review (EQR). States that contract with MCOs and PIHPs must ensure that a qualified external quality review organization (EQRO) performs an annual external quality review (EQR) for each plan; the final rule extends this requirement to states that contract with PAHPs and PCCM entities as well. The final rule also tightens the requirements related to the independence of the EQRO and any subcontractor from the entities it is reviewing.³⁰ All Medicaid services provided by an MCO, PIHP, or PHP in any setting are subject to EQR. The revised EQR provisions apply to contracts starting on or after July 1, 2018.

The HHS Secretary, in coordination with the National Governors Association, must develop protocols for the required EQRs.³¹ Mandatory and optional EQR-related activities may be performed by the state, its agent that is not an MCO, PIHP, PAHP, or PCCM entity, or an EQRO. The final rule adds validation of MCO, PIHP, or PAHP network adequacy during the preceding 12 months as a mandatory EQR-related activity, effective no later than one year from CMS’ issuance of the associated EQR protocol. The protocols issued by the Secretary must specify the data to be gathered through the EQR-related activities, steps to be followed in collecting the data, the methods for analyzing and interpreting the data, and any documents and tools necessary to implement the protocols. The information obtained from the EQR-related activities must be used for the annual EQR. As under current rules, states may use information from a Medicare or private accreditation review of a plan for the EQR to avoid duplication, but only if specified criteria set by the final rule are met.

Under the final rule, the annual detailed technical report that results from an EQR must include new required elements. The report must include validated performance measurement data associated with PIPs that were underway and performance measures calculated by the state in the preceding 12 months. Also, the report’s recommendations must include how the state can better target its quality strategy to better to foster quality, timeliness, and access to services.³² States are required to finalize and post the annual EQR report on their website by April 30 of each year.

The federal match rate is 75% for EQR and EQR-related activities performed by EQROs on MCOs. Effective immediately, the federal match rate is 50% for EQR-related activities conducted by a non-EQRO entity and also for EQR and EQR-related activities performed by an EQRO on PIHPs, PAHPs, and PCCM entities.³³

State monitoring

State monitoring system. The final rule strengthens the requirements for state monitoring of managed care programs. Under the rule, each state Medicaid agency must have a monitoring system for all managed care programs, including PCCM entities The monitoring system must address all aspects of the state’s managed care program, including the performance of each managed care entity in virtually every area of operations and management (e.g., appeals and grievance systems, claims management, enrollee materials and customer service, information systems, marketing, medical management, provider network management, availability and accessibility of services). States must use data collected from their monitoring activities, including enrollment and disenrollment trends in each plan, grievance and appeal logs, findings from the state’s EQR process, MLR reports, and many other specified types of data, to improve the performance of their managed care programs. These provisions apply for contracts starting on or after July 1, 2017.

Readiness reviews. New under the final rule, states must assess the readiness of each MCO, PIHP, PAHP, and PCCM entity with which it contracts, prior to implementing a managed care program, and when a specific plan has not previously contracted with the state, and when any plan currently contracting with state will provide covered benefits to new eligibility groups. Readiness reviews must be conducted at least three months before the effective date of any of those events and in time to ensure smooth implementation, and the reviews must be submitted to CMS for the agency’s approval of any associated contract or contract change. That is, all contracts with MCOs, PIHPs, PAHPs, and PCCM entities require prior review and approval by CMS. Readiness reviews of plans prior to initial state implementation of a managed care program or of a contract with a plan new to Medicaid must include both a desk review of documents and an onsite review. Readiness reviews of currently contracting plans that are adding new eligibility groups must include a desk review and states may require an on-site review. Readiness reviews must assess the capacity and ability of each MCO, PIHP, PAHP, and PCCM entity to perform satisfactorily in virtually every aspect of operations/administration, service delivery, financial management, and systems management. These provisions apply for contracts starting on or after July 1, 2017.

Annual program report to CMS. Within 180 days after each contract year, states must submit a report to CMS on each managed care program they administered. The program report must provide information on and an assessment of the operation of the managed care program in the following areas at a minimum: the financial performance of each risk-based plan, including the MLR; grievances, appeals, and state fair hearings for the program; availability and accessibility of covered services; plan performance on quality measures; results of any sanctions or corrective action plans imposed by the state or other intervention with a plan to improve performance; activities and performance of the beneficiary support system, and any additional factors in the delivery of long-term services and supports not otherwise addressed. States must post the annual program report on their Medicaid managed care website. CMS will issue guidance on the content and form of the program report; the initial report will be due after the contract year following the release of that guidance.

Program integrity

The final rule strengthens Medicaid managed care program integrity requirements and standards at both the state and plan level, and applies them to PAHPs as well as MCOs and PIHPs. The provisions apply to contracts starting on or after July 1, 2017.

Plan responsibilities. The final rule applies the current requirements for arrangements or procedures to detect and prevent fraud, waste, and abuse to PAHPs as well as MCOs and PAHPs, and increases the level of plan responsibility and accountability for them. Under the rule, plans must have procedures and a system with dedicated staff for routine internal monitoring and auditing of compliance risks. Plan procedures must also provide for prompt reporting of all overpayments, specifying those due to potential fraud, prompt referral of any potential fraud, waste, or abuse to the state, and other enumerated activities to ensure program integrity.

State responsibilities. Effective for contracts starting on or after July 1, 2018, states must screen, enroll, and periodically (generally, every five years) revalidate all network providers of MCOs, PIHPs, and PAHPs that are not already enrolled with the state to provide services to FFS Medicaid beneficiaries;³⁴ this requirement applies to PCCMs and PCCM entities as well. Plans may execute network provider agreements pending the outcome of the screening process of up to 120 days, but if notified by the state that a network provider cannot be enrolled, they must terminate the agreement and notify affected enrollees.

Other state responsibilities include (but are not limited to): review of plan ownership and control disclosures; monthly federal database checks to identify excluded plans, subcontractors, and other parties, and prompt action if they find an excluded party; independent audits at least every three years of the encounter and other data that plans are required to submit to the state (as described below); and posting specified information on their website, including the data submitted by plans and the results of any audits.

Encounter data. Through their contracts, states must require MCOs, PIHPs, PAHPs, PCCMs, and PCCM entities to submit encounter data that meet specified form and content standards and criteria for accuracy and completeness. Further, effective for contracts starting on or after July 1, 2018, the final rule conditions federal matching funds for payments made to MCOs, PIHPs, and PAHPs on state reporting of validated, complete, and timely enrollee encounter data, and set standards for the data reports.

Fraud detection and prevention. State contracts with an MCO, PIHP, or PAHP must require that plan, or subcontractor that provides services or pays claims, to implement procedures to detect and prevent fraud, waste, and abuse. The procedures must include a compliance program that meets specified standards and that, among other requirements, provides for prompt reporting to the state of all overpayments identified or recovered, specifying those due to potential fraud. State contracts with plans must also specify how the plan will treat recoveries of overpayments. Plans’ compliance procedures must also provide for prompt state notification of changes that may affect an enrollee’s eligibility or a provider’s eligibility to participate (e.g., termination of the provider agreement), and include a method to verify whether services that network providers indicate they delivered were actually received by enrollees.

Looking ahead

The final rule on Medicaid managed care is a milestone in Medicaid’s ongoing modernization as the delivery systems that serve Medicaid beneficiaries continue to evolve. In keeping with states’ increasingly heavy reliance on managed care plans to provide care for millions of Medicaid enrollees, including many with complex care needs and special vulnerabilities, the regulatory framework and state and plan requirements established by the final rule reflect increased federal expectations regarding fundamental aspects of states’ Medicaid managed care programs. At the same time, the rule seeks to strike an appropriate balance between federal minimum requirements and state flexibility to determine specific standards and processes. In the months and years ahead, CMS, states, managed care plans, beneficiaries, providers, and other stakeholders will be focused on implementation of the provisions of the new rule and its impact on the quality of care, beneficiary support and experience of care, and innovation and value in Medicaid managed care programs.