Medicare Program; Implementation of Sections 6219, 6220, and 6224 of the Consolidated Appropriations Act, 2026

Issuing agencies

Abstract

This proposed rule would implement section 6219 (Adjustments to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals), section 6220 (Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act), and section 6224 (Modernizing and Ensuring Pharmacy Benefit Manager Accountability) of the Consolidated Appropriations Act, 2026.

Full Text

<html>
<head>
<title>Federal Register, Volume 91 Issue 201 (Tuesday, October 20, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 201 (Tuesday, October 20, 2026)]
[Proposed Rules]
[Pages 66408-66489]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-21420]



[[Page 66407]]

Vol. 91

Tuesday,

No. 201

October 20, 2026

Part II





 Department of Health and Human Services





-----------------------------------------------------------------------





 Centers for Medicare & Medicaid Services





-----------------------------------------------------------------------





42 CFR Parts 422 and 423





Medicare Program; Implementation of Sections 6219, 6220, and 6224 of 
the Consolidated Appropriations Act, 2026; Proposed Rule

Federal Register / Vol. 91 , No. 201 / Tuesday, October 20, 2026 / 
Proposed Rules

[[Page 66408]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Parts 422 and 423

[CMS-4214-P]
RIN 0938-AV88


Medicare Program; Implementation of Sections 6219, 6220, and 6224 
of the Consolidated Appropriations Act, 2026

AGENCY: Centers for Medicare & Medicaid Services (CMS), Department of 
Health and Human Services (HHS).

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This proposed rule would implement section 6219 (Adjustments 
to Medicare Part D Cost-Sharing Reductions for Low-Income Individuals), 
section 6220 (Requiring Enhanced and Accurate Lists of (REAL) Health 
Providers Act), and section 6224 (Modernizing and Ensuring Pharmacy 
Benefit Manager Accountability) of the Consolidated Appropriations Act, 
2026.

DATES: To be assured consideration, comments must be received at one of 
the addresses provided below, no later than 5 p.m. Eastern Standard 
Time on December 15, 2026.

ADDRESSES: In commenting, please refer to file code CMS-4214-P. Because 
of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    Comments, including mass comment submissions, must be submitted in 
one of the following three ways (please choose only one of the ways 
listed):
    1. Electronically. You may submit electronic comments on this 
regulation to <a href="https://www.regulations.gov/docket/CMS-2026-2533">https://www.regulations.gov/docket/CMS-2026-2533</a>. Follow 
the ``Submit a comment'' instructions.
    2. By regular mail. You may mail written comments to the following 
address ONLY: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-4214-P, P.O. Box 8013, 
Baltimore, MD 21244-8013.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address ONLY: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-4214-P, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT: 
    Kristy Nishimoto, (206) 615-2367--General Questions and section 
6219 of the Consolidated Appropriations Act, 2026.
    James Clark, (410) 786-3875--Section 6220 of the Consolidated 
Appropriations Act, 2026. <a href="/cdn-cgi/l/email-protection#144475666050445659547779673a7c7c673a737b62"><span class="__cf_email__" data-cfemail="3c6c5d4e48786c7e717c5f514f1254544f125b534a">[email&#160;protected]</span></a>--Section 6224 of the 
Consolidated Appropriations Act, 2026.

SUPPLEMENTARY INFORMATION: 
    Inspection of Public Comments: All comments received before the 
close of the comment period are available for viewing by the public, 
including any personally identifiable or confidential business 
information that is included in a comment. We post all comments 
received before the close of the comment period on the following 
website as soon as possible after they have been received: <a href="http://www.regulations.gov">http://www.regulations.gov</a>. Follow the search instructions on that website to 
view public comments. CMS will not post on <a href="http://Regulations.gov">Regulations.gov</a> public 
comments that make threats to individuals or institutions or suggest 
that the commenter will take actions to harm an individual. CMS 
continues to encourage individuals not to submit duplicative comments. 
We will post acceptable comments from multiple unique commenters even 
if the content is identical or nearly identical to other comments.
    Plain Language Summary: In accordance with 5 U.S.C. 553(b)(4), a 
plain language summary of this proposed rule may be found at <a href="https://www.regulations.gov/">https://www.regulations.gov/</a>.

I. Executive Summary

A. Purpose

    The primary purpose of this proposed rule is to amend the 
regulations for the Medicare Advantage (Part C) program and the 
Medicare Prescription Drug Benefit (Part D) program to implement 
section 6219 (Adjustments to Medicare Part D Cost-Sharing Reductions 
For Low-Income Individuals), section 6220 (Requiring Enhanced and 
Accurate Lists of (REAL) Health Providers Act), and section 6224 
(Modernizing and Ensuring Pharmacy Benefit Manager Accountability) of 
the Consolidated Appropriations Act, 2026 (CAA).
    We note that, as with previous rules, any new marketing and 
communications policies in this rule are proposed to be applicable for 
all contract year 2028 marketing and communications, beginning October 
1, 2027.

B. Summary of the Key Provisions

1. Adjustments to Medicare Part D Cost-Sharing Reductions for Low-
Income Individuals (Section 6219 of the Consolidated Appropriations 
Act, 2026)
    CMS is proposing to implement section 6219 of the CAA that would 
reduce the generic drug copayment from $1 to $0 for full-benefit dual 
eligible individuals at or below 100 percent of the Federal Poverty 
Level, effective for plan years starting January 1, 2028.
2. REAL Health Providers Act (Section 6220 of the Consolidated 
Appropriations Act, 2026)
    CMS proposes to codify regulations to implement section 6220 of the 
CAA, titled the Requiring Enhanced and Accurate Lists of (REAL) Health 
Providers Act, which establishes new provider directory accuracy and 
accountability requirements for Medicare Advantage (MA) organizations 
beginning in contract year 2028. Specifically, CMS proposes 
requirements to implement this new law related to provider directory 
verification and maintenance standards, annual accuracy analysis and 
reporting, public reporting of accuracy scores, and cost sharing 
protections for enrollees who rely on inaccurate provider directory 
information. CMS also proposes to codify the statutory requirements for 
contract year 2029, including that CMS must publicly display provider 
directory accuracy scores in a machine-readable format and MA 
organizations must prominently display those scores in their provider 
directories. Through these proposed codifications implementing the REAL 
Health Providers Act, CMS seeks to promote provider directory accuracy 
and accountability among MA organizations to ensure that beneficiaries 
are provided with clear, accurate information on the network of 
providers available to meet their health care needs.
3. Modernizing and Ensuring Pharmacy Benefit Manager Accountability 
(Section 6224 of the Consolidated Appropriations Act, 2026)
    CMS has several proposals to implement section 6224 of the CAA, 
which established requirements related to pharmacy benefit managers 
(PBMs) and their affiliates specific to the Medicare Part D program. 
These proposals include new and enhanced requirements governing the 
remuneration that PBMs and their affiliates may receive for services in 
connection with the utilization of Part D drugs, data reporting by PBMs 
to Part D plan sponsors and CMS, transparency in

[[Page 66409]]

price guarantee arrangements between PBMs or their affiliates and Part 
D plan sponsors, disclosure by PBMs to Part D plan sponsors of the 
terms of certain agreements between PBMs or their affiliates and 
pharmaceutical manufacturers, and other requirements added by the CAA. 
CMS also proposes to define key terms related to such requirements and 
establish compliance and enforcement mechanisms, including disgorgement 
of funds to CMS for violations of the remuneration requirements.

C. Summary of Costs and Benefits
[GRAPHIC] [TIFF OMITTED] TP20OC26.000

D. Conclusion

    Finally, we are clarifying and emphasizing our intent that if any 
provision of this rule, once finalized, is held to be invalid or 
unenforceable by its terms, or as applied to any person or 
circumstance, or stayed pending further agency action, it shall be 
severable from this rule and not affect the remainder thereof or the 
application of the provision to other persons not similarly situated or 
to other, dissimilar circumstances. Through this rule, we propose 
provisions that are intended to and will operate independently of each 
other, even if each serves the same general purpose or policy goal. 
Where a provision is necessarily dependent on another, the context 
generally makes that clear (such as by a cross-reference to apply the 
same standards or requirements).

II. Implementation of Certain Provisions of the Consolidated 
Appropriations Act, 2026

A. Adjustments to Medicare Part D Cost-Sharing Reductions for Low-
Income Individuals (Section 6219 of the Consolidated Appropriations 
Act, 2026) (Sec.  423.782)

    In the Medicare Program, Medicare Prescription Drug Benefit Final 
Rule (70 FR 4194), CMS codified at Sec.  423.782(a)(2)(iii)(A) and (B) 
the cost-sharing requirements for full-benefit dual eligible (FBDE) 
individuals with incomes that do not exceed 100 percent of the Federal 
Poverty Level (FPL) pursuant to section 1860D-14(a) of the Act, 
codified at 42 U.S.C. 1395w-114(a). Under these provisions, individuals 
are subject to cost-sharing for covered Part D drugs equal to the 
lesser of the following:
    <bullet> A copayment amount of no more than $1 for a generic drug, 
approved biological product, or preferred drugs that are multiple 
source, or $3 for any other drug in 2006.
    <bullet> For years after 2006, the amounts specified earlier are 
adjusted for the annual percentage increase in the Consumer Price Index 
(CPI) as of September of the previous year, rounded to the nearest 
multiple of 5 cents or 10 cents, respectively; or
    <bullet> Under Sec.  423.782(a)(2)(i), the copayment amount charged 
to: noninstitutionalized full-benefit dual eligible individuals who 
have income above 100 percent of the FPL, individuals with income under 
135 percent of the FPL for years prior to 2024, or individuals with 
income under 150 percent of the FPL for years 2024 and thereafter.
    On February 3, 2026, the Consolidated Appropriations Act, 2026 
(CAA), Public Law 119-75, was enacted into law. Section 6219 of the 
CAA, titled ``Adjustments to Medicare Part D Cost-Sharing Reductions 
for Low-Income Individuals,'' amends section 1860D-14(a) of the Act to 
reduce the generic drug copayment from $1 to $0 for FBDE individuals 
with incomes that do not exceed 100 percent of the FPL, effective for 
plan years beginning on or after January 1, 2028. The provision also 
clarifies that the existing annual CPI inflation adjustment methodology 
applies only to plan years before 2028 with respect to generic drug 
copayments for this population.
    Currently, for plan years before January 1, 2028, FBDE individuals 
with incomes that do not exceed 100 percent of the FPL as described in 
Sec.  423.782(a)(2)(iii), are subject to a $1 copayment for generic 
drugs covered under Medicare Part D, adjusted annually for CPI. For 
plan year 2026, this amount is $1.60 for generic drugs and $4.90 for 
other covered Part D drugs, with no deductible, as reflected in the CY 
2026 Resource and Cost-Sharing Limits for Low-Income Subsidy guidance 
issued October 31, 2025.
    To implement section 6219 of the CAA, we are proposing to amend 
Sec.  423.782(a)(2)(iii) to reflect that, for plan years beginning on 
or after January 1, 2028, the copayment for generic drugs for FBDE 
individuals with incomes that do not exceed 100 percent of the FPL is 
$0. First, we are proposing to amend Sec.  423.782(a)(2)(iii)(A) to 
specify that the cost-sharing rules in that paragraph are applicable to 
plan years before January 1, 2028. Second, we are proposing to 
redesignate paragraph (B) in Sec.  423.782(a)(2)(iii) as paragraph (C) 
and add new paragraph (B) to specify that for plan years beginning on 
or after January 1, 2028, the copayment for generic drugs for FBDE 
individuals with incomes that do not exceed 100 percent of the FPL is 
$0.
    This proposal is a conforming change to existing regulatory text 
and would not alter the eligibility criteria, subsidy

[[Page 66410]]

structure, or any other cost-sharing parameters applicable to FBDE 
individuals. CMS is not proposing any changes to the copayment amounts 
applicable to the cost-sharing requirements for non-generic (brand-
name) drugs or other covered Part D drugs for FBDE individuals. 
Specifically, the copayment for preferred multiple-source drugs and 
other covered drugs for FBDE individuals would continue to be adjusted 
annually for CPI in accordance with existing statutory and regulatory 
requirements. This proposal is narrowly tailored to implement the 
specific statutory directive in section 6219 of the CAA and does not 
introduce any discretionary policy changes.
    We estimate approximately 6 million enrollees would be affected by 
these proposed changes, based on 2026 CMS enrollment data. We believe 
the proposed changes would impact the Medicare Trust Fund and 
individuals in two ways: elimination of the co-pay is expected to 
reduce out-of-pocket costs for affected enrollees, and the anticipated 
increase in generic drug utilization is expected to affect Medicare 
Trust Fund expenditures through transferring copay costs from the 
beneficiary to the Medicare program. This rule does not include a new 
collection of information; therefore, there is no change in paperwork 
burden to plans or individuals. Additional information is provided in 
the regulatory impact analysis in section IV.C.1. of this proposed 
rule.

B. REAL Health Providers Act (Section 6220 of the Consolidated 
Appropriations Act, 2026) (Sec. Sec.  422.2, 422.111, 422.120, 422.123, 
422.124, 422.202, 422.504, 422.2265, and 422.2267)

    On February 3, 2026, in section 6220 of the Consolidated 
Appropriations Act, 2026 (CAA) (Pub. L. 119-75, H.R. 7148-484), 
Congress enacted the Requiring Enhanced and Accurate Lists of (REAL) 
Health Providers Act. The REAL Health Providers Act amends sections 
1851, 1852, and 1857 of the Act to establish new provider directory 
accuracy and accountability requirements for MA organizations, 
effective January 1, 2028, which is the beginning of contract year 
2028. These statutory requirements include provider directory accuracy 
standards, accuracy score reporting, verification requirements, public 
transparency, and enrollee cost sharing protections. CMS is proposing 
to codify regulations to implement the REAL Health Providers Act 
legislation through this proposed rule. In addition to the statutory 
authority of the REAL Health Providers Act, CMS is also relying on the 
statutory authorities of sections 1856(b)(1) and 1857(e)(1) of the Act 
to establish the standards needed to implement the REAL Health 
Providers Act that go beyond what is specifically addressed in section 
6220 of the CAA. Section 1856(b)(1) of the Act provides that CMS shall 
establish by regulation other standards for MA organizations and plans 
consistent with, and to carry out, the Part C program. Likewise, 
section 1857(e)(1) of the Act authorizes CMS to specify additional 
contract terms as necessary and appropriate in the agreements that CMS 
enters into with each MA organization.
    The REAL Health Providers Act directs the Secretary to strengthen 
requirements for the accuracy and public availability of provider 
directory information maintained by MA organizations offering specified 
MA plans. Existing regulations at Sec.  422.111(m), finalized for plan 
years beginning on or after January 1, 2026, already establish a 
foundational framework requiring MA organizations to submit provider 
directory information to CMS/HHS for publication online in a format and 
manner determined by CMS (that is, on Medicare Plan Finder (MPF)), 
update that information within 30 days of becoming aware of a change, 
and attest to its accuracy no less than annually. As CMS explained when 
finalizing the Sec.  422.111(m) requirements, these changes were 
intended to promote transparency and informed beneficiary choice by 
improving access to accurate online provider directory information for 
beneficiaries who are navigating their health care options (90 FR 
45140). These goals closely parallel the enhanced accuracy and 
transparency requirements in the REAL Health Providers Act. Therefore, 
in implementing the REAL Health Providers Act, CMS intends to build 
directly upon, reinforce, and, where necessary, supplement this 
existing regulatory infrastructure, ensuring MA organizations have a 
clear and harmonized set of provider directory requirements, rather 
than creating a parallel, duplicative, or competing set of standards.
    CMS is also actively developing a National Provider Directory 
(NPD), which is a centralized, standardized repository intended to 
serve as the authoritative public-facing platform for provider 
directory information across the entire health tech ecosystem. CMS 
expects that the provider directory data that it currently collects 
from MA organizations under the authority of Sec.  422.111(m) will be 
compatible with and may ultimately feed into the NPD infrastructure. 
Accordingly, CMS's proposed implementation of the REAL Health Providers 
Act requirements, through the existing Sec.  422.111(m) framework, as 
described here in this section, is intended to be a deliberate and 
forward-looking approach that will position MA organizations, CMS, and 
the public to realize the full transparency benefits of the NPD as it 
develops. CMS believes this integrated approach, leveraging existing 
regulatory requirements, building towards a centralized national 
directory, and now incorporating the enhanced statutory mandates of the 
REAL Health Providers Act to verify data accuracy, represents the most 
administratively sound and least burdensome path to ensuring 
beneficiaries have access to accurate, reliable, and readily available 
provider directory information.
    Taken together, these layered requirements--the existing Sec.  
422.111(m) data submission framework, the developing NPD 
infrastructure, and the new REAL Health Providers Act requirements 
regarding accuracy, verification, cost sharing protections, and public 
reporting mandates--work to support the larger health tech ecosystem to 
form a cohesive and mutually reinforcing regulatory architecture 
designed to ensure that beneficiaries can rely on provider directory 
information when making critical health care decisions. For example, 
the REAL Health Providers Act establishes statutory accuracy and 
verification standards specific to MA organizations, the MPF effort 
builds near-term data infrastructure for plan comparison, and the NPD 
advances a broader multi-payer directory accessible to all. While each 
of these initiatives operates on a distinct timeline and authority, 
they are intentionally designed to complement and reinforce one 
another. The accuracy scoring and verification framework required under 
the REAL Health Providers Act, for example, will serve to strengthen 
the integrity of the underlying provider data that both MPF and the NPD 
will likely come to depend upon, helping to ensure a consistent and 
reliable foundation for the larger health tech ecosystem.
    CMS's proposed regulatory changes align with the statutory 
requirements of the REAL Health Providers Act. The proposals impact 
various existing sections under 42 CFR part 422, including Sec. Sec.  
422.2, 422.111, 422.120, 422.202, 422.504, 422.2265, and 422.2267. In 
addition, CMS is proposing to add two new sections: Sec.  422.123--
Provider directory accuracy requirements and Sec.  422.124--Cost

[[Page 66411]]

sharing protections for reliance on incorrect provider directory 
information. CMS's proposals contained herein also consider feedback 
received from interested parties during the June 15, 2026, public 
meeting co-hosted by CMS and the Office of the National Coordinator for 
Health Information Technology (ONC), to gather input on implementing 
the REAL Health Providers Act. This virtual public meeting included 
participation from health care providers and suppliers, companies that 
specialize in relevant technologies (for example, provider data 
management, directory solutions, interoperability, verification tools, 
and data standards), health insurers (including MA organizations and 
other health plans), and patient advocates. CMS's proposals also 
considered written feedback from interested parties submitted after the 
public meeting.
    During the June 15, 2026, public meeting, participants broadly 
supported CMS's efforts to improve provider directory accuracy while 
emphasizing the importance of implementing these requirements in a 
manner that minimizes administrative burden and promotes standardized, 
interoperable data exchange. Participants consistently identified 
provider practice locations, specialty information, acceptance of new 
patients, telehealth capabilities, and provider participation status as 
among the most challenging provider directory data elements to maintain 
accurately. Several participants recommended establishing standardized 
definitions for key provider directory information, which informed 
CMS's proposal to establish consistent provider directory information 
requirements and definitions.
    Interested parties also expressed strong support for a centralized, 
authoritative source of provider directory information and encouraged 
CMS to leverage interoperability standards, existing CMS data sources, 
and emerging technologies to improve directory accuracy while reducing 
duplicative verification activities. These comments are consistent with 
CMS's proposed approach of building upon the existing provider 
directory submission framework under Sec.  422.111(m), supporting the 
development of the NPD, and permitting the use of CMS-maintained data 
sources and verification methods. In addition, interested parties 
emphasized the importance of transparent, repeatable verification 
methodologies and encouraged CMS to recognize verification approaches 
that reduce burden on both MA organizations and providers.
    Interested parties also discussed prioritizing provider specialty 
types with historically higher rates of directory inaccuracies, 
including behavioral health providers, and recommended that CMS focus 
verification and oversight efforts where they would have the greatest 
impact on beneficiary access to care. These comments informed CMS's 
proposals to identify high-inaccuracy provider specialty types and 
develop a weighted provider directory accuracy scoring methodology that 
considers both the relative importance of provider directory 
information to beneficiary access and the administrative burden 
associated with analysis. Finally, interested parties highlighted the 
importance of beneficiary protections when provider directory 
information is inaccurate, reinforcing CMS's proposal to implement the 
enrollee cost sharing protections established under the REAL Health 
Providers Act.
    Overall, these proposals support the Administration's goals of 
improving health care transparency, strengthening beneficiary access to 
accurate provider information, ensuring that beneficiaries are 
protected when they rely on information furnished by MA organizations, 
and integrating with health tech ecosystem initiatives. Specifically, 
these proposed changes align with the June 24, 2019, Executive Order 
13877, ``Improving Price and Quality Transparency in American 
Healthcare to Put Patients First'' (hereinafter referred to as E.O. 
13877) and the February 25, 2025, Executive Order 14221, ``Making 
America Healthy Again by Empowering Patients With Clear, Accurate, and 
Actionable Healthcare Pricing Information'' (hereinafter referred to as 
E.O. 14221). Through these proposed codifications implementing the REAL 
Health Providers Act, CMS seeks to promote provider directory accuracy 
and accountability among MA organizations to ensure that beneficiaries 
are provided with clear, accurate information on the network of 
providers available to meet their health care needs.
1. Definitions (Sec.  422.2)
    CMS is using the existing definition of ``provider'' under Sec.  
422.2 for purposes of this proposed regulation, unless otherwise 
indicated. Pursuant to Sec.  422.2, a provider is (1) any individual 
who is engaged in the delivery of health care services in a state and 
is licensed or certified by the state to engage in that activity in the 
state; and (2) any entity that is engaged in the delivery of health 
care services in a state and is licensed or certified to deliver those 
services if such licensing or certification is required by state law or 
regulation.
    To use consistent terminology throughout all impacted regulation 
sections, CMS proposes adding several new provider directory related 
definitions to Sec.  422.2. The REAL Health Providers Act amended the 
disclosure requirements at section 1852(c) of the Act to add new 
subsection (c)(3) entitled ``Provider Directory Accuracy.'' The statute 
provides that the obligations under this subsection will apply to 
``specified MA plans'' as defined in section 1852(c)(3)(C) of the Act. 
Thus, consistent with section 1852(c)(3)(C) of the Act, CMS proposes to 
define ``specified MA plan'' at Sec.  422.2 as: (1) a network-based 
plan as defined in Sec.  422.2--which includes MA plans that are 
coordinated care plans (for example, health maintenance organizations, 
provider-sponsored organizations, regional or local preferred provider 
organizations (PPOs), and specialized MA plans for special needs 
individuals), network-based Medicare Savings Account plans, or cost 
plans--or (2) an MA private fee-for-service (PFFS) plan that meets the 
access standards under Sec.  422.114, in whole or in part, through 
entering into contracts or agreements with a network of providers. In 
other words, the proposed definition of ``specified MA plan,'' and the 
related proposed requirements for specified MA plans described in this 
proposed rule, would apply to all types of MA plans except non-network 
regional PPOs that meet access requirements substantially through the 
authority of Sec.  422.112(a)(1)(ii) instead of written contracts. 
Likewise, the proposed definition of ``specified MA plan'' and the 
related proposed requirements for specified MA plans, would not apply 
to Program of All-Inclusive Care for the Elderly (PACE) plans.
    In addition, section 1852(c)(3)(B) of the Act defines ``provider 
directory information'' as ``information enrollees may need to access 
covered benefits from a provider with which such organization offering 
such plan has an agreement for furnishing items and services covered 
under such plan, such as name, specialty, contact information, primary 
office or facility addresses where items or services are furnished, 
whether the provider is accepting new patients, accommodations for 
people with disabilities, cultural and linguistic capabilities, and 
telehealth capabilities.'' Accordingly, CMS proposes to define 
``provider directory information'' at Sec.  422.2 to conform with this 
section of the Act as ``information enrollees may need to access 
covered benefits from a provider with which an

[[Page 66412]]

MA organization offering a specified MA plan has an agreement for 
furnishing items and services covered under such plan, including, at a 
minimum, all of the following: (1) provider name; (2) specialty; (3) 
contact information, including telephone number(s); (4) primary office 
or facility address(es) where covered items or services are furnished; 
(5) whether the provider is accepting new patients; (6) accommodations 
for people with disabilities; (7) cultural and linguistic capabilities; 
(8) telehealth capabilities; and (9) common ownership or control 
disclosure.''
    This proposed regulatory definition captures all the elements of 
the statutory definition and includes one additional element--common 
ownership or control disclosure. CMS interprets the ``such as'' in 
section 1852(c)(3)(B) of the Act to mean that the data elements 
specifically listed in the statute are required, but not exhaustive of 
the types of information that may be considered ``provider directory 
information'' (that is, information that enrollees may need to access 
covered benefits from a contracted provider) for purposes of the 
requirements provided under the REAL Health Providers Act. CMS believes 
that common ownership or control disclosure is necessary to inform plan 
and provider choice because vertical integration may affect care 
delivery arrangements, referral patterns, and negotiated charges or 
payment arrangements. Greater transparency regarding common ownership 
or control may also be useful for beneficiaries, caregivers, State 
Health Insurance Assistance Program (SHIP) counselors, agents, brokers, 
researchers, and other entities assisting beneficiaries or evaluating 
MA provider networks. In the MA marketplace, provider networks are a 
central feature beneficiaries use to compare plan options, assess 
whether they can access preferred providers, and understand how care 
may be delivered within a plan's network. Information indicating that a 
network provider, provider group, facility, or supplier is under common 
ownership or control with the MA organization or its parent 
organization may provide important context about the relationship 
between the plan and the providers from whom enrollees may obtain 
covered services. For example, such information may help beneficiaries 
and those assisting them understand whether a plan's network includes 
providers that are part of the same corporate family as the MA 
organization, which may be relevant to evaluating provider choice, 
potential care coordination arrangements, referral pathways, and the 
structure of the network. CMS also believes that this information may 
promote broader transparency in the MA marketplace by allowing 
researchers, policymakers, and other interested parties to better 
assess the prevalence and effects of vertical integration across MA 
networks, including how common ownership or control relationships may 
relate to network design, access to care, utilization patterns, and 
beneficiary decision-making.
    Under the proposed definition for ``provider directory 
information'' at Sec.  422.2, CMS proposes for common ownership or 
control disclosures to include any network provider, provider group, 
facility, or supplier that is owned or controlled, in whole or in part, 
directly or indirectly, by the MA organization, by the MA 
organization's parent organization, by a subsidiary or affiliate of the 
MA organization, or by any entity that is under common ownership or 
control with the MA organization. CMS considers a provider to share 
ownership or control with an MA organization if the provider and the MA 
organization are directly or indirectly owned or controlled by the same 
parent organization, ultimate parent organization, holding company, or 
other controlling entity, regardless of whether the MA organization 
itself directly owns the provider. For example, an MA organization may 
be one subsidiary of a parent or holding company, while a physician 
group, hospital system, or other network provider may be owned by a 
separate subsidiary of the same parent or holding company. In this 
scenario, the MA organization may not directly own the provider, and 
the provider may not be legally organized under the MA organization 
itself. However, because both the MA organization and the provider are 
owned or controlled, directly or indirectly, by the same parent or 
holding company, CMS would consider the provider to be under common 
ownership or control with the MA organization for purposes of the 
proposed provider directory disclosure requirement. The provider 
directory disclosure could state: ``This provider is under common 
ownership or control with [MA organization name or parent organization 
name].''
    As another example, an MA organization's parent organization may 
own a health care services subsidiary, and that subsidiary may own, 
control, or partially own a provider group through one or more 
intermediate entities, and such provider group may be in the MA plan's 
network. The provider group may operate under a different trade name, 
may contract with multiple health plans, and may not be directly owned 
by the MA organization. Nevertheless, if the MA organization and the 
provider group are connected through indirect ownership or control by 
the same parent organization, affiliate, subsidiary, or other 
controlling entity, then CMS would consider the provider group to be 
under common ownership or control with the MA organization for purposes 
of the provider directory disclosure requirement. In that circumstance, 
the directory could identify the relationship using standardized 
language, such as: ``This provider group is under common ownership or 
control with [MA organization name or parent organization name].'' CMS 
solicits comments on the proposed model language that should be used in 
the disclosure statement and whether different versions of the 
statement would be necessary to accommodate different types of 
ownership or affiliations. With this proposed model language, CMS aims 
to capture these various business relationships appropriately but also 
provide the information in a simple and understandable manner for 
beneficiaries.
    This requirement to disclose common ownership or control would not 
alter, or otherwise affect any existing or future standards, 
definitions, reporting obligations, or analyses related to MA bid 
development, medical loss ratio reporting, related-party disclosures, 
financial audits, or any other program integrity, payment, accounting, 
or oversight requirements outside of this provider directory disclosure 
construct. CMS solicits comments on whether these examples 
appropriately describe the types of direct, indirect, affiliate, 
subsidiary, parent, and common-control relationships that should be 
included in the proposed provider directory disclosure requirement, and 
whether additional examples or exclusions would be helpful for MA 
organizations, providers, beneficiaries, and other users of provider 
directory information.
    CMS notes that the proposed provider directory element of 
``accommodations for people with disabilities'' is referring to 
notations in the provider directory for provider listings in which 
accommodations for people with disabilities exist. Such accommodations 
may include physical accessibility features (such as accessible 
entrances with ramps, elevators, accessible exam rooms and tables, 
accessible medical equipment, and accessible parking), auxiliary aids 
and services, and other necessary accommodations. MA organizations must 
adhere to all current

[[Page 66413]]

federal laws and regulations concerning accommodations for people with 
disabilities, including Section 504 of the Rehabilitation Act of 1973, 
Title II of the Americans with Disabilities Act (ADA) of 1990, and 
Section 1557 of the Affordable Care Act of 2010. Questions regarding 
this topic should be directed to the HHS Office for Civil Rights (OCR).
    In addition, CMS notes that the proposed provider directory element 
of ``cultural and linguistic capabilities'' based on the language in 
the Act is similar to existing language at Sec.  422.111(b)(3)(i). 
However, CMS proposes to adopt the terminology used by Congress for 
``cultural and linguistic capabilities'' without retaining the 
additional language in current Sec.  422.111(b)(3)(i) specifying that 
``each provider's'' cultural and linguistic capabilities includes 
``languages (including American Sign Language) offered by the provider 
or a skilled medical interpreter at the provider's office.'' In light 
of the intervening statutory requirement enacted by Congress, CMS 
believes it is appropriate to implement section 1852(c)(3)(B) of the 
Act using the terminology selected by Congress. This approach retains 
the requirement for MA organizations to include providers' cultural and 
linguistic capabilities in their provider directories and also reflects 
changes in Federal policy since publication of the April 12, 2023, 
Medicare Program; Contract Year 2024 Policy and Technical Changes to 
the Medicare Advantage Program, Medicare Prescription Drug Benefit 
Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care 
for the Elderly final rule. Executive Order 14151, ``Ending Radical and 
Wasteful Government DEI Programs and Preferencing,'' directed agencies, 
consistent with applicable law, to review Federal policies and 
regulations adopted in furtherance of prior diversity, equity, 
inclusion, and accessibility initiatives and to align agency actions 
with the policies established by that order. CMS recognizes that 
providers may have a variety of cultural and linguistic capabilities 
that could be included in an MA organization's provider directory. 
Therefore, by removing this additional language, CMS is providing added 
flexibility regarding the types of cultural and linguistic capabilities 
that MA organizations can include in their provider directories. As 
proposed, CMS intends to allow MA organizations to include information 
beyond the examples identified in Sec.  422.111(b)(3)(i). This 
flexibility would allow MA organizations to highlight capabilities that 
respond to the specific needs of their enrollees and help beneficiaries 
identify providers who can meet those needs.
    CMS also proposes to add a definition for ``provider directory'' to 
Sec.  422.2, which would pull together provider directory categories of 
information (Sec.  422.111(b)(3)(i)(A), (b)(3)(i)(B), and (b)(12)) and 
be defined as ``for specified MA plans, as defined in this section, the 
publicly available listing, maintained and distributed by an MA 
organization pursuant to Sec.  422.2267(e)(11), of providers that are 
currently contracted and participating in that MA plan's provider 
network, and containing the information under Sec.  
422.111(b)(3)(i)(A), (b)(3)(i)(B), and (b)(12).'' CMS's proposed 
definition for ``specified MA plan'' would apply here. Note that CMS is 
proposing to include the cross-reference to Sec.  422.111(b)(3)(i)(B) 
in this proposed definition of ``provider directory,'' which eliminates 
the need to refer to ``provider directory information'' in this 
definition because CMS's proposed changes to Sec.  422.111(b)(3)(i)(B) 
(discussed in section II.B.11. of this proposed rule) include a cross-
reference to the definition of ``provider directory information.''
    Finally, CMS proposes to define ``provider directory accuracy 
score'' at Sec.  422.2 as ``the score reflecting the accuracy of 
provider directory information calculated and reported in accordance 
with Sec.  422.123(d).'' Regarding the cross-references to Sec. Sec.  
422.111(b)(12) and 422.123(d) in these two proposed definitions, these 
are two new proposed sections of the regulation which CMS discusses in 
sections II.B.4., II.B.5., II.B.6., and II.B.11. of this proposed rule. 
CMS solicits comments on these proposed changes to definitions at Sec.  
422.2.
2. Provider Directory Verification Requirements (Sec. Sec.  422.123(a) 
and (b), 422.2265(b)(3) and (b)(15), and 422.111(h)(2))
    The REAL Health Providers Act's addition of section 1852(c)(3) of 
the Act establishes new provider directory requirements for plan year 
2028 and subsequent plan years, in which each MA organization offering 
a specified MA plan shall, for each specified MA plan offered by the 
organization, do the following: (1) maintain, on a publicly available 
internet website, an accurate provider directory that includes provider 
directory information; (2) not less frequently than once every 90 days 
(or, in the case of a hospital or any other facility determined 
appropriate by the Secretary, at a lesser frequency specified by the 
Secretary but in no case less frequently than once every 12 months), 
verify the provider directory information of each provider listed in 
such directory and, if applicable, update such information; (3) if the 
organization is unable to verify such information with respect to a 
provider, include in such directory an indication that the information 
of such provider may not be up to date; and (4) remove a provider from 
such directory within 5 business days if the organization determines 
that the provider is no longer a provider participating in the network 
of such plan.
    To implement these new requirements of section 1852(c)(3) of the 
Act, CMS proposes to add new Sec.  422.123--Provider directory 
accuracy. Within new proposed Sec.  422.123, paragraph (a) would set 
forth the applicability of the section to each MA organization offering 
a specified MA plan for contract year 2028 and subsequent contract 
years. Although the statute uses the term ``plan year,'' the customary 
term that CMS uses is ``contract year,'' therefore, CMS proposes 
language using the term ``contract year'' throughout the proposed 
regulations. To codify section 1852(c)(3)(A)(i) of the Act, CMS 
proposes to amend Sec.  422.2265(b)(3) to require that an MA 
organization's website includes an accurate provider directory for each 
specified MA plan that includes provider directory information for each 
provider that is currently contracted and participating in the plan's 
provider network. CMS also proposes a slight modification to the 
existing regulatory language at Sec.  422.2265(b)(3), which currently 
reads: ``A PDF or copy of a printable provider directory.'' To ensure 
greater clarity in terminology, CMS proposes to revise this phrase to 
read as follows: ``a PDF or otherwise printable electronic copy of the 
provider directory.'' Section II.B.3. of this proposed rule includes a 
more detailed discussion of the proposed requirements for updating this 
version of the provider directory.
    In conjunction with the proposed changes at Sec.  422.2265(b)(3), 
and in line with the January 31, 2025, Executive Order 14192, 
``Unleashing Prosperity Through Deregulation,'' CMS is taking the 
opportunity to streamline existing regulations. CMS proposes to make 
conforming changes to Sec.  422.111(h)(2) to cross-reference Sec. Sec.  
422.2265, 422.120(a), and 422.2267(d) and remove duplicative 
information that is already addressed by the aforementioned 
regulations. Specifically, at Sec.  422.111(h)(2), CMS proposes to 
require MA organizations to

[[Page 66414]]

have a publicly available internet website that complies with the 
website requirements in Sec. Sec.  422.2265 and 422.120(a) and state 
that posting copies of required materials on the website does not 
relieve the MA organization of its responsibility to provide hard 
copies to enrollees upon request in accordance with Sec.  422.2267(d) 
or when required by CMS. This proposed change would remove the existing 
reference to Sec.  422.111(b) in Sec.  422.111(h)(2) and replace it 
with a reference to the website requirements at Sec.  422.2265. All the 
contents of a plan description under Sec.  422.111(b) are already 
required on MA organizations' websites per Sec.  422.2265, except 
existing Sec.  422.111(b)(9), the quality improvement program. To 
preserve this requirement, CMS proposes to add a new paragraph (b)(15) 
to Sec.  422.2265 to require an MA organization's website to include a 
description of the quality improvement program required under 
Sec. Sec.  422.152 and 422.111(b)(9). The proposed change to Sec.  
422.111(h)(2) would also remove duplicative information about hardcopy 
requirements for required materials (such as the evidence of coverage, 
provider directory, and summary of benefits) and instead include a 
cross-reference to these requirements which are already outlined at 
Sec.  422.2267(d).
    To codify section 1852(c)(3)(A)(ii) and (iii) of the Act, CMS 
proposes to add new Sec.  422.123(b) to set forth the new provider 
directory verification requirements. Aligning with the statute, at new 
proposed Sec.  422.123(b)(1), CMS proposes to require each MA 
organization offering a specified MA plan to verify the provider 
directory information of each provider listed in that specified MA 
plan's provider directory not less frequently than once every 90 days, 
except in the case of hospitals and other facilities as listed in Sec.  
422.116(b)(2)(i), (iv), and (v)--that is, acute inpatient hospitals, 
critical care services (intensive care units), and surgical services 
(outpatient or ambulatory surgery center). For these excepted hospitals 
and other facilities, CMS proposes to require each MA organization 
offering a specified MA plan to verify the provider directory 
information of these entities not less frequently than once every 12 
months. The statute provides CMS with discretion to impose verification 
requirements for hospitals or any other facility determined appropriate 
by the Secretary at a lesser frequency than once every 90 days (as is 
the case for other providers) but at a frequency no less than once 
every 12 months. At this time, CMS is proposing a 12-month verification 
frequency for these entities. CMS selected these three types of 
entities because CMS believes that data for these specific entities is 
generally more static, as they may not move locations as often as other 
providers or facilities given their size and facility requirements, 
therefore, verifying the information at least every 12 months is 
sufficient for these types of entities. This policy approach would also 
limit some of the burden associated with verification on both MA 
organizations and these facilities. In addition, CMS's proposed 
reference to hospitals and other facilities listed in Sec.  
422.116(b)(2)(i), (iv), and (v) is appropriate because MA organizations 
are familiar with this list of facilities for purposes of network 
adequacy. CMS seeks comments specifically on the proposed selection of 
other facilities listed in Sec.  422.116(b)(2)(i), (iv), and (v) for 
the 12-month verification requirement. For all providers listed in the 
provider directory, CMS proposes that the MA organization must comply 
with the appropriate verification frequency (90 days or 12 months) and 
update the provider directory in accordance with CMS's updating 
requirements, if updates are needed. Provider directory updating 
requirements are discussed in section II.B.3. of this proposed rule.
    Next, at new proposed Sec.  422.123(b)(2), CMS proposes to require 
the MA organization to use one or more CMS-specified provider directory 
verification methods to meet the provider verification requirements, 
including verification using internal plan information, verification 
via telephone or email, verification using provider attestations, 
verification using data sources maintained by CMS, claims data, or 
other verification methods specified by CMS. By including internal plan 
information as a proposed CMS-specified provider directory verification 
method, CMS is referring to information such as current, accurate 
provider rosters or recent claims information. Regarding data sources 
maintained by CMS, CMS means provider data repositories, such as the 
National Plan and Provider Enumeration System (NPPES), and provider 
directory databases, such as the NPD, that are maintained by CMS. By 
including claims data, CMS is referring to data containing information 
on recent claims between the contracted provider and the MA 
organization.
    By including data sources maintained by CMS and other verification 
methods specified by CMS in this proposed list, CMS would retain the 
flexibility to specify additional acceptable, CMS-approved verification 
methods in technical guidance. CMS is aware that this is a space where 
technology and the use of artificial intelligence is quickly evolving 
and CMS's work on the NPD is ongoing, and including this flexibility in 
proposed Sec.  422.123(b)(2) would enable CMS to respond more quickly 
to advancements in verification methods, ultimately providing MA 
organizations with more options for meeting their provider directory 
verification obligations. CMS would provide technical guidance as 
necessary.
    CMS anticipates that MA organizations may need to use more than one 
verification method to verify all the elements of provider directory 
information in the proposed provider directory verification 
requirements. For example, CMS recognizes that MA organizations may be 
accustomed to using NPPES. However, NPPES has both benefits and 
limitations, including the fact that certain provider directory 
information may not be available in NPPES, such as whether a provider 
is accepting new patients. As such, there will likely be a need for MA 
organizations to supplement use of NPPES with other verification 
method(s) to verify all the elements of provider directory information 
that CMS requires. In addition, CMS is also actively developing the 
NPD, which is intended to be a centralized, standardized repository 
meant to serve as the authoritative public-facing platform for provider 
directory information across the entire health tech ecosystem. CMS 
anticipates that once the NPD is fully operational, MA organizations 
might be able to use this source for verification, as it falls under 
the category of a data source maintained by CMS.
    CMS issued guidance through the Health Plan Management System 
(HPMS) on January 3, 2020, and June 29, 2022, about the use of NPPES 
for determining the accuracy of provider directory data in CMS's 
various monitoring and enforcement activities. In the January 3, 2020, 
HPMS memorandum, CMS stated that the agency, in its monitoring and 
enforcement activities, would employ discretion should it uncover 
errors in directories that are consistent with NPPES data that has been 
updated or certified between January 1 and April 30, 2020, so long as 
any errors identified are corrected within 30 days. In the June 29, 
2022, HPMS memorandum, CMS stated that it would continue to use 
discretion while monitoring and reviewing organizations' online 
provider directories for compliance and enforcement action and that 
during

[[Page 66415]]

compliance reviews, if CMS finds an error in an organization's online 
provider directory and the error matches the information in NPPES, then 
that error will not be considered an ``error'' for purposes of 
compliance so long as the organization contacts the provider, whose 
information was incorrect, within 30 days to encourage the provider to 
correct their information in NPPES. By proposing to include NPPES as 
one of the verification methods that MA organizations may use to verify 
provider directory information, and also because there would be other 
verification methods that MA organizations may use, CMS would not need 
to continue to use this discretion for compliance and enforcement 
actions if these provisions are finalized as proposed. Also, since 
issuing these memoranda, the landscape related to provider directories 
in MA has shifted due to the REAL Health Providers Act and CMS's 
efforts to develop the NPD. Therefore, if these provisions are 
finalized as proposed, CMS intends to rescind this previously issued 
guidance (in both the January 3, 2020, and June 29, 2022, HPMS 
memoranda) regarding MA organizations' usage of NPPES for purposes of 
verifying provider directory accuracy.
    CMS notes that, in developing the proposal for the 90-day/12-month 
provider directory verification requirement at new proposed Sec.  
422.123(b)(2), CMS considered limiting which verification method(s) may 
be used by MA organizations for which provider directory elements. 
Including such limitations may potentially impose additional burden on 
MA organizations. At this time, CMS is not proposing any such 
limitations on MA organizations' use of the proposed verification 
method(s) for fulfilling their 90-day/12-month provider directory 
verification obligations as described in new proposed Sec.  
422.123(b)(1)(i) and (ii). However, as discussed in section II.B.5. of 
this proposed rule, at new proposed Sec.  422.123(d)(3)(i), CMS is 
proposing to limit what verification method(s) may be used by MA 
organizations to evaluate the accuracy of certain provider directory 
data elements for purposes of calculating the estimated provider 
directory accuracy score (please refer to that section of this proposed 
rule for a more detailed discussion). CMS solicits comments on the 
considerations and proposals surrounding limiting verification 
approaches, for both new proposed Sec.  422.123(b)(2) and (d)(3)(i). In 
addition, CMS intends to identify certain best practices in technical 
guidance, such as which verification methods might be more appropriate 
or reliable for the proposed 90-day/12-month provider directory 
verification requirement, depending on the particular provider 
directory data elements being verified.
    To implement section 1852(c)(3)(A)(iii) of the Act, at Sec.  
422.123(b)(3), CMS proposes to require that if the MA organization is 
unable to verify provider directory information with respect to a 
provider during the applicable verification cycle, then the MA 
organization must include in the provider directory a clear indication 
that the information of such provider may not be up to date. An example 
of language that CMS believes would be sufficient for this proposed 
indicator is: ``The provider's information may not be up to date.'' If 
Sec.  422.123(b)(3) is finalized as proposed, then CMS intends to 
update the Medicare Advantage and Section 1876 Cost Plan Provider 
Directory Model and Instructions with similar template language for the 
indicator. If the MA organization subsequently verifies or updates the 
information, then the MA organization must remove or revise the 
indicator consistent with CMS's provider directory updating 
requirements.
    Finally, per existing statutory authority under section 1856(b)(1) 
of the Act to establish by regulation other standards for MA 
organizations consistent with, and to carry out, the Part C program, 
CMS is proposing, at new proposed Sec.  422.123(b)(4), to require that 
each MA organization offering a specified MA plan must include a term 
in their contract with each contracted provider for a specified MA 
plan, obligating the contracted provider to maintain current and 
accurate provider directory information as defined in proposed Sec.  
422.2. The purpose of this new proposed contract requirement is to 
ensure that when the MA organization verifies provider directory 
information in accordance with proposed Sec.  422.123(b), the 
information the MA organization obtains from each contracted provider 
is more likely to be current and accurate. This proposed contract 
requirement is intended to improve the reliability of the data that MA 
organizations obtain directly from their contracted providers, 
specifically the type of data collected using the first four CMS-
specified verification methods outlined at proposed Sec.  
422.123(b)(2)(i) through (iv), which are internal plan information, 
telephonic verification, email verification, and provider attestations. 
CMS believes that this proposed provider contract term is necessary to 
assist MA organizations in carrying out successful verification 
efforts, which would ultimately support the broader effort to ensure 
accurate provider directories.
    In summary, to implement several aspects of the REAL Health 
Providers Act, CMS is proposing the provider directory accuracy 
applicability requirement at new proposed Sec.  422.123(a), 
verification requirements at new proposed Sec.  422.123(b), proposed 
changes to the website requirement at Sec.  422.2265(b)(3), a 
streamlining of existing regulations at Sec.  422.111(h)(2), and a 
preservation of the existing requirement for a description of the 
quality improvement program on an MA organization's website at new 
proposed Sec.  422.2265(b)(15). CMS solicits comments on these proposed 
changes.
3. Provider Directory Updating Requirements (Sec. Sec.  422.123(c) and 
422.2267(e)(11)(iv))
    Implementation of the REAL Health Providers Act presents CMS with 
the opportunity to streamline other existing provider directory 
regulations, including rules around updating provider directories. 
After considering the proposed layout of the new rules for provider 
directory accuracy, CMS determined it would be prudent to move the 
existing updating requirements for provider directories to new proposed 
Sec.  422.123, for purposes of logic and ease of reading. Therefore, 
CMS is proposing to move the updating requirements from Sec.  
422.2267(e)(11)(iv) to new proposed Sec.  422.123(c). CMS is not 
changing the basic 30-day provider directory updating requirement, but 
CMS is proposing some changes in order to implement certain 
requirements of the REAL Health Providers Act. The current provider 
directory regulations apply to MA plans with provider networks, all of 
which are included in the proposed definition of ``specified MA plan.''
    The MA organization will still be required to update both the 
online provider directory and the PDF or otherwise printable electronic 
copy of the provider directory (as specified in proposed Sec.  
422.2265(b)(3)) within at least 30 days of receiving information 
requiring update, except that a provider must be removed from the 
directory no later than 5 business days after the MA organization 
determines that the provider is no longer participating in the 
specified MA plan's network. CMS is proposing to move this requirement 
to new proposed Sec.  422.123(c)(1). This proposed 5-business-day 
updating requirement would apply to both the online provider directory 
and the PDF or otherwise printable electronic copy of the provider 
directory (as specified in proposed Sec.  422.2265(b)(3)). In other

[[Page 66416]]

words, if this requirement is finalized as proposed, MA organizations 
would be required to update the PDF or otherwise printable electronic 
copy version of their provider directory within 5 business days, but 
this would not mean printing new physical hardcopies since the PDF or 
otherwise printable electronic copy of the provider directory is 
required to be posted on the MA organization's website. This 5-
business-day updating requirement would apply to PDF or otherwise 
printable electronic copy of the provider directory posted on the MA 
organization's website and would not require an MA organization to mail 
a revised physical hardcopy directory to an enrollee within 5 business 
days. As discussed further later, for enrollees who have requested a 
physical hardcopy provider directory, CMS is separately proposing at 
Sec.  422.123(c)(2) to require MA organizations to send a quarterly 
addendum containing updates to the provider directory. This quarterly 
addendum would provide a regular mechanism for keeping enrollees who 
rely on a previously furnished physical hardcopy directory informed of 
subsequent directory changes without requiring MA organizations to mail 
a revised physical hardcopy directory each time an update is made.
    To codify section 1852(c)(3)(A)(iv) of the Act, at Sec.  
422.123(c)(4) CMS proposes to require that the MA organization must 
remove a provider from the provider directory no later than 5 business 
days after the date on which the MA organization determines that the 
provider is no longer participating in the network of the specified MA 
plan. This would be the only proposed exception to the 30-day provider 
directory updating requirement at new proposed Sec.  422.123(c)(1).
    In addition, although the REAL Health Providers Act does not 
include a specific timeframe for updating physical hardcopy provider 
directories, CMS would like to take the opportunity through this 
proposed rule to further clarify the policies regarding physical 
hardcopy updates via addenda. Currently, Sec.  
422.2267(e)(11)(iv)(B)(2) states that hardcopy directories that include 
separate updates via addenda are considered up to date. CMS has 
reconsidered this policy and determined that it would be beneficial to 
specify a regular cadence for updating physical hardcopy directories to 
avoid ambiguity or misinterpretation by MA organizations. Specifically, 
CMS proposes to require MA organizations to send a quarterly addendum 
containing updates to all enrollees who have requested a physical 
hardcopy provider directory. Sending a quarterly update only to those 
enrollees who have requested a physical hardcopy directory would meet 
the requirements for keeping physical hardcopy directories updated and 
avoid the need for MA organizations to mail updated physical hardcopy 
directories on a monthly basis, thus reducing burden. This policy would 
be a supportive beneficiary protection because it would keep enrollees 
informed with a predictable and regular cadence of updates if they are 
accustomed to using a physical hardcopy directory, and it would protect 
enrollees from making a misinformed decision based on an outdated 
version of the physical hardcopy directory. CMS proposes to add this 
requirement regarding the quarterly addendum for physical hardcopy 
provider directories at new proposed Sec.  422.123(c)(2).
    In addition, while CMS believes it is unlikely for plans or agents/
brokers to use physical hardcopy directories at marketing events (and 
instead refer to or show prospective enrollees the online provider 
directory), CMS clarifies that if plans or agents/brokers do plan to 
distribute physical hardcopy directories, then they would need to print 
out the PDF or otherwise printable electronic copy of the provider 
directory that exists on the MA organization's website and use that 
current, up-to-date version if needed for physical distribution to 
prospective enrollees. This would ensure that prospective enrollees 
have access to the most updated provider directory that exists at that 
time.
    Furthermore, due to the point-in-time nature of physical hardcopy 
directory updates and the fact that if CMS finalizes the proposed 
quarterly addenda policy then enrollees receiving a physical hardcopy 
directory would only receive four updates per year, CMS proposes to 
require that MA organizations include a disclaimer on the physical 
hardcopy provider directory that recommends beneficiaries check the 
online provider directory or contact the MA organization for the latest 
updates. CMS proposes to add this requirement at new proposed Sec.  
422.123(c)(3). CMS believes this type of disclaimer is essential to 
keep all beneficiaries (both prospective enrollees and current 
enrollees) informed and aware that the online directory is likely the 
most reliable version because of the ease and timeliness of making 
electronic updates. This would ensure that all beneficiaries have 
access to the most current and accurate information about the plan's 
provider network.
    These proposed changes related to provider directory updating 
requirements at new proposed Sec.  422.123(c) would replace and 
supplement existing updating requirements at Sec.  422.2267(e)(11)(iv). 
Accordingly, CMS is proposing to amend Sec.  422.2267(e)(11)(iv) to 
require that the provider directory be verified and updated in 
accordance with Sec.  422.123(b) and (c) (for contract year 2028 and 
subsequent contract years).
    In summary, CMS is proposing several changes to the provider 
directory updating requirements, including moving existing updating 
requirements from Sec.  422.2267(e)(11)(iv) to Sec.  422.123(c)(1), 
implementing section 1852(c)(3)(A)(iv) of the Act at Sec.  
422.123(c)(4), adding new requirements related to physical hardcopy 
directories at Sec.  422.123(c)(2) and (c)(3), and updating Sec.  
422.2267(e)(11)(iv) to refer to Sec.  422.123(b) and (c). CMS solicits 
comments on these proposed changes.
4. Provider Directory Accuracy Analysis and Sampling Methodology (Sec.  
422.123(d)(1) and (2))
    In addition to provider directory verification and updating 
requirements, the REAL Health Providers Act establishes new 
requirements regarding provider directory accuracy. Section 
1857(e)(6)(A) of the Act requires that beginning with plan years 
beginning on or after January 1, 2028, each MA organization must 
conduct an annual analysis estimating the accuracy of the provider 
directory information of each specified MA plan using a random sample 
of providers included in such provider directory. Further, section 
1857(e)(6)(A)(i)(I) and (II) of the Act states that this sample shall 
include a random sample of each specialty of providers with a high 
inaccuracy rate of provider directory information relative to other 
specialties of providers, as determined by the Secretary, and one type 
of specialty may be providers specializing in mental health or 
substance use disorder treatment. CMS believes it is important that the 
provider directory accuracy analysis focus on a blend of provider 
specialty types including those that are known to have a high 
inaccuracy rate, as required by the statute, but to further include 
other provider specialty types that do not fall within the high 
inaccuracy rate criteria. Following this process allows CMS to continue 
to test and identify areas of inaccuracy as they apply to provider 
specialty types.
    To implement the new requirements of section 1857(e)(6)(A) of the 
Act, CMS proposes to add new Sec.  422.123(d)(1) to establish the 
annual accuracy analysis requirement and Sec.  422.123(d)(2) to set

[[Page 66417]]

forth the sampling frame and methodology requirements. At new proposed 
Sec.  422.123(d)(1), beginning with contract years beginning on or 
after January 1, 2028, each MA organization would be required to 
conduct an annual analysis estimating the accuracy of all provider 
directory information, except for ``provider name,'' ``cultural and 
linguistic capabilities,'' and ``common ownership or control 
disclosure,'' of each specified MA plan. CMS's proposed definitions for 
``provider directory information'' and ``specified MA plan'' at Sec.  
422.2 would apply here. CMS proposes to add the sampling frame and 
methodology requirements at new proposed Sec.  422.123(d)(2), stating 
that the analysis must use a random sample of provider records and 
proposes specifying provider specialty types with high provider 
directory inaccuracy rates at new proposed Sec.  422.123(d)(2)(ii). 
When determining provider specialty types with high provider directory 
inaccuracy rates, at new proposed Sec.  422.123(d)(2)(i), CMS proposes 
that CMS will consider all provider specialty types included in the 
Medicare specialty codes and National Uniform Claim Committee (NUCC) 
taxonomy and may consider other provider specialty types and providers 
furnishing supplemental benefits.
    In alignment with the statute, at new proposed Sec.  
422.123(d)(2)(ii)(A), CMS proposes to identify mental health or 
substance use disorder treatment provider specialty types specified by 
CMS as provider specialty types with high provider directory inaccuracy 
rates. Studies conducted regarding behavioral health providers support 
CMS's inclusion of mental health or substance use disorder treatment as 
a provider specialty type with high provider directory inaccuracy 
rates. In 2025, the HHS Office of Inspector General (OIG) found that, 
on average, 55 percent of behavioral health providers listed in plans' 
networks did not provide a single service to enrollees in 2023 (that 
is, were inactive providers).\1\ OIG also conducted a survey of a 
random sample of inactive providers from both MA and Medicaid managed 
care plans and found that 72 percent of the inactive providers should 
not have been listed as network providers in the plan directories.\2\ 
Other studies conducted on provider networks outside of MA have also 
found issues with mental health providers in provider networks.\3\
---------------------------------------------------------------------------

    \1\ Office of Evaluation and Inspections. Many Medicare 
Advantage and Medicaid Managed Care Plans Have Limited Behavioral 
Health Provider Networks and Inactive Providers. Office of Inspector 
General: October 2025. Available from: <a href="https://oig.hhs.gov/documents/evaluation/11233/OEI-02-23-00540.pdf">https://oig.hhs.gov/documents/evaluation/11233/OEI-02-23-00540.pdf</a>.
    \2\ Office of Evaluation and Inspections. Many Medicare 
Advantage and Medicaid Managed Care Plans Have Limited Behavioral 
Health Provider Networks and Inactive Providers. Office of Inspector 
General: October 2025. Available from: <a href="https://oig.hhs.gov/documents/evaluation/11233/OEI-02-23-00540.pdf">https://oig.hhs.gov/documents/evaluation/11233/OEI-02-23-00540.pdf</a>.
    \3\ For example: Zhu JM, Charlesworth CJ, Polsky D, McConnell 
KJ. Phantom Networks: Discrepancies Between Reported And Realized 
Mental Health Care Access In Oregon Medicaid. Health Aff (Millwood). 
2022 Jul;41(7):1013-1022. doi: 10.1377/hlthaff.2022.00052. PMID: 
35787079; PMCID: PMC9876384. Available from: <a href="https://pmc.ncbi.nlm.nih.gov/articles/PMC9876384/">https://pmc.ncbi.nlm.nih.gov/articles/PMC9876384/</a>.
---------------------------------------------------------------------------

    CMS proposes to identify providers that fall under this provider 
specialty type in technical guidance using two sources, as listed in 
new proposed Sec.  422.123(d)(2)(i)(A). The primary source CMS 
anticipates using is the Medicare physician/non-physician practitioner 
specialty codes identified in section 10.8 of chapter 26 of the 
Medicare Claims Processing Manual. Physicians self-designate their 
Medicare physician specialty on their Medicare enrollment application 
or on the internet-based Medicare Provider Enrollment, Chain, and 
Ownership System (PECOS). Non-physician practitioners are assigned a 
Medicare specialty code when they enroll based on their profession. 
Specialty codes are used by CMS for programmatic and claims processing 
purposes. For example, these specialty codes are used in MA to identify 
provider specialty types for purposes of network adequacy reviews. CMS 
understands that the industry standard that is used for provider 
specialty types is the NUCC taxonomy, and CMS publishes a crosswalk 
between the Medicare specialty codes and the NUCC taxonomy codes 
semiannually.\4\ Regarding the second source that CMS would use to 
determine the provider specialty types with high provider directory 
inaccuracy rates, in addition to the Medicare specialty codes, CMS 
anticipates considering the use of additional codes from the NUCC 
taxonomy where appropriate to augment the Medicare specialty codes. CMS 
seeks comments on this proposal.
---------------------------------------------------------------------------

    \4\ Medicare Provider and Supplier Taxonomy Crosswalk. CMS: Nov 
2025. Available from: <a href="https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/medicare-provider-and-supplier-taxonomy-crosswalk">https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/medicare-provider-and-supplier-taxonomy-crosswalk</a>.
---------------------------------------------------------------------------

    CMS intends to identify the specific Medicare specialty codes and/
or NUCC taxonomy codes that correspond to the provider specialty types 
with high provider directory inaccuracy rates, as described in proposed 
Sec.  422.123(d)(2)(ii)(A), in annual technical guidance. CMS intends 
to propose the codes in draft guidance and request comments on the 
proposed codes. CMS then intends to issue final annual technical 
guidance with the final codes which will incorporate stakeholder 
feedback on what was proposed. CMS anticipates that the Medicare 
specialty codes that will meet the requirement at new proposed Sec.  
422.123(d)(2)(ii)(A) are 26 (Psychiatry), 27 (Geriatric Psychiatry), 86 
(Neuropsychiatry), 62 (Psychologist), 68 (Clinical Psychologist), 80 
(Licensed Clinical Social Worker), 79 (Addiction Medicine), D5 (Opioid 
Treatment Program), E1 (Marriage and Family Therapist), and E2 (Mental 
Health Counselor). CMS also is considering proposing some NUCC taxonomy 
codes in addition to these Medicare specialty codes, such as 104100000X 
(Behavioral Health & Social Service Providers/Social Worker), 
101Y00000X (Behavioral Health & Social Service Providers/Counselor), 
and 363LP0808X (Physician Assistants & Advanced Practice Nursing 
Providers/Nurse Practitioner, Psychiatric/Mental Health). CMS seeks 
comments on the anticipated inclusion of these Medicare specialty codes 
and NUCC taxonomy codes in technical guidance and also whether there 
are other Medicare specialty codes or NUCC taxonomy codes that CMS 
should consider including in technical guidance. CMS also notes that 
providers can have many NUCC taxonomy codes and thus anticipates 
proposing that if the taxonomy codes match any of the NUCC taxonomy 
codes that a provider has, then they would be identified as a provider 
specialty type with high provider directory inaccuracy rates. CMS seeks 
comments on whether a subset of the NUCC taxonomy codes that a provider 
has should be considered instead of all of them, and, if so, how that 
subset may be defined.
    CMS also considered using the network adequacy provider specialty 
types as defined under Sec.  422.116(b)(1)(xxviii), (b)(1)(xxix), and 
(b)(2)(xiv) to define the scope of ``mental health or substance use 
disorder treatment provider specialty types'' as described in 
422.123(d)(2)(ii)(A), but CMS identified some drawbacks to this 
alternative. The requirements at Sec.  422.116(b) do not include all 
provider and facility specialty types but only those used for purposes 
of MA network adequacy reviews. Also, our proposal to primarily use the 
Medicare specialty codes aligns with the requirements at Sec.  
422.116(b), as those are also based on the Medicare specialty codes. 
Further, CMS aims to ensure the comparability of the resulting provider 
directory

[[Page 66418]]

accuracy scores and the MA network adequacy requirements have a 
specific different purpose that cannot be directly applied to the 
sampling frame. Although CMS did not propose this alternative, CMS is 
still actively considering this approach and seeks comment.
    CMS is also considering some additional provider specialty types 
with high provider directory inaccuracy rates for inclusion at new 
proposed Sec.  422.123(d)(2)(ii). CMS has previously conducted reviews 
of MA organizations' online provider directories. CMS conducted its 
most recent three rounds of reviews between June 2022 and June 2024. 
While CMS has published a report for the MA online provider directory 
reviews in the past, CMS did not publish a report for these most recent 
reviews.\5\ Similar to past reviews, the goal of these recent reviews 
was to gain a better understanding of MA provider directory accuracy, 
identify best practices for maintaining accurate provider directories, 
and, through appropriate compliance actions, drive industry improvement 
in providing more accurate provider directories. During the reviews 
conducted between June 2022 and June 2024, CMS examined the accuracy of 
online provider directories for 142 MA organizations that offered at 
least one eligible MA-PD plan.\6\ During each review round, CMS 
randomly sampled one contract offered by each MA organization, then 
randomly sampled an eligible plan from each contract. CMS designated 
some contracts to be ``rural'' and some to be ``urban'' to ensure a mix 
of urban and rural service areas for the eligible plan selected for 
each contract. If the eligible plan for a contract that was designated 
as ``rural'' only served urban counties, then the contract was re-
designated as ``urban'' and another contract/eligible plan was 
designated as ``rural.'' Because many MA online provider directories 
require users to enter a zip code to search for providers, CMS selected 
a county within each plan's service area and then selected a zip code 
within the search county to use as the search zip code. During each 
review round, CMS assessed the accuracy of the provider directory 
listings of between 80 and 100 providers from each selected plan. In 
rounds one and two, CMS assessed the accuracy of 20 providers of each 
of the following four provider specialty types: (1) primary care 
providers (PCPs), (2) cardiologists, (3) oncologists, and (4) 
ophthalmologists.\7\ During round three, CMS added reviews of provider 
directory listings for a fifth provider specialty type (mental health 
providers), reviewing 20 mental health providers from each plan.\8\ CMS 
reviewed approximately one-third of eligible MA organizations during 
each review round. CMS found that out of the 11,360 providers and 
18,852 locations reviewed across all three rounds, 44.29 percent of the 
location listings in the online provider directories contained at least 
one inaccuracy (``deficiency''), such as: The provider did not see 
patients at the location listed, the phone number was incorrect, the 
address was incorrect, the provider did not accept the plan at the 
location, or the provider's information could not be verified. Figure 
II.B.1 provides a high-level overview of the MA online provider 
directory review methodology. Reviewers captured provider directory 
data for sampled providers, placed calls to provider offices to verify 
the accuracy of the online provider directory data, and recorded 
findings in an MA organization-specific spreadsheet.
---------------------------------------------------------------------------

    \5\ For example, CMS published this Online Provider Directory 
Review Report in 2018: <a href="https://www.cms.gov/medicare/health-plans/managedcaremarketing/downloads/provider_directory_review_industry_report_round_3_11-28-2018.pdf">https://www.cms.gov/medicare/health-plans/managedcaremarketing/downloads/provider_directory_review_industry_report_round_3_11-28-2018.pdf</a>.
    \6\ The population from which plans were selected was the 
universe of all MA and PDP plans with enrollment at the time the 
reviews were conducted across the United States and its territories. 
The sample excluded certain types of plans either because they were 
not MA plans or because the plan type could not adequately be 
compared to most MA PBPs. Excluded types of plans were: private fee-
for-service plans, MA-only plans, employer group waiver plans, 
Medicare Part D plans, medical savings account plans, 1876 cost 
plans, health care prepayment plans--1833 cost plans, PACE plans, 
special needs plans, and financial alignment demonstration plans--
Medicare-Medicaid Plans.
    \7\ In some cases, a plan's network did not contain enough of 
one provider type to meet the sample size of 20. In these cases, CMS 
sampled additional ``supplemental'' PCPs from the plan to meet the 
sample size.
    \8\ The mental health providers sampled included the following 
types: Clinical Psychologist, Clinical Social Worker, Licensed 
Clinical Social Worker, Licensed Professional Counselor, Psychiatry, 
Psychologist, and Certified Alcohol and Drug Counselor I, II, or 
III. Nurse practitioners were excluded.
[GRAPHIC] [TIFF OMITTED] TP20OC26.001

    CMS made minor changes to the review methodology between the review 
rounds, incorporating lessons learned and refining the review approach. 
In round three, CMS incorporated two new final deficiencies: ``Provider 
should not

[[Page 66419]]

be listed in the directory at this location--information could not be 
verified'' and ``Provider should not be listed in the directory at this 
location--does not accept plan'' to capture more nuance about why a 
provider should not be listed at a location in the directory. 
Additionally, in round three, when reviewers found providers who only 
worked in a telehealth capacity, CMS assigned the provider directory 
record the deficiency of ``Address needs to be updated'' with a note 
indicating that the provider only sees patients in a telehealth 
capacity.
    Table II.B.1 provides the review counts of individual providers and 
locations by provider type.
[GRAPHIC] [TIFF OMITTED] TP20OC26.002

    At the conclusion of the June 2022 through June 2024 review 
process, CMS analyzed the data from all three review rounds to 
highlight notable findings on MA organization performance. The data is 
summarized for each round and for all three rounds together. Table 
II.B.2 lists deficiency counts and rates for all three rounds, broken 
out by location and provider specialty type.
[GRAPHIC] [TIFF OMITTED] TP20OC26.003

    Given that this online provider directory review data is data that 
CMS has available, CMS considered proposing to use this data to 
identify provider specialty types with high provider directory 
inaccuracy rates. CMS considered including provider specialty types 
with a deficiency rate of 45 percent or above across all three rounds 
of review, which would include PCPs, cardiologists, and oncologists. 
CMS recognizes that there are limitations to using this data for this 
purpose, as it was originally gathered for a different purpose. This 
data is also limited because it only includes four provider specialty 
types that were incorporated in all three rounds of review, with one 
added provider specialty type incorporated in only the third (and last) 
round of review. Although CMS did not propose to include PCPs, 
cardiologists, and oncologists as provider specialty types with high 
provider directory inaccuracy rates, they remain under active 
consideration by CMS. CMS seeks comments on the inclusion of these 
provider specialty types as provider specialty types with high provider 
directory inaccuracy rates. CMS also seeks comments on whether there 
are any other provider specialty types that should be considered 
provider specialty types with high provider directory inaccuracy rates. 
If CMS were to include any other provider specialty types as provider 
specialty types with high provider directory inaccuracy rates, CMS 
would follow a similar process as described with the proposed inclusion 
of mental health or substance use disorder treatment provider specialty 
types, meaning CMS would review the available Medicare specialty codes 
and NUCC taxonomy codes, propose the codes in annual technical guidance 
for comment, and then issue guidance with the final list of codes 
taking into account commenters' feedback. If commenters on this 
proposed rule recommend that CMS identify any other provider specialty 
types in regulation, then CMS encourages commenters to include in their 
comments what Medicare specialty codes and/or NUCC taxonomy codes would 
be relevant for CMS to propose in annual technical guidance.
    At this time, this is the information available to CMS to determine 
provider specialty types with high provider directory inaccuracy rates, 
however, as described in section II.B.6. of this proposed rule, CMS is 
considering collecting data from MA organizations in addition to the 
accuracy score, such as provider specialty type response rates by 
verification method or other sampling data by provider specialty type, 
which could inform future rulemaking regarding determinations of 
provider specialty types with high provider directory inaccuracy rates. 
This data could be supplemented with other external research. CMS seeks 
comments on other methods and other potential sources of data that CMS 
could use to determine provider specialty types with high provider 
inaccuracy rates.

[[Page 66420]]

    At new proposed Sec.  422.123(d)(2)(iii), CMS proposes to require 
that MA organizations identify the sampling frame as consisting of 
provider records in the provider directory with a unique provider, 
address, and phone number. Thus, when considering the universe of 
possible provider records that may be chosen for the sample, each 
provider record that could be selected in that universe would need to 
be a unique provider at a specific address and phone number. This means 
that, for example, a provider could be included in the sample at one 
address but not at another address. Similarly, if there is a case where 
a provider has two different phone numbers at the same address, then 
one provider/address/phone combination could be selected to be in the 
sample, but not the other. CMS proposes this approach for the sampling 
frame because CMS is aiming to ensure that a provider record 
constitutes a single, unique listing in the provider directory, and CMS 
believes that using the unique provider, address, and phone number 
constitutes a single, unique listing. When determining a unique 
provider for their sampling frame, CMS recommends that MA organizations 
use the provider's National Provider Identifier (NPI) because the NPI 
uniquely identifies the provider. CMS notes that a notice that the 
provider information may be outdated, per the proposed requirement at 
new proposed Sec.  422.123(b)(3) as discussed in section II.B.2. of 
this proposed rule, does not mean that records associated with the 
provider would be excluded for purposes of sampling. A provider with 
such a notice would still be considered part of the sampling frame. CMS 
seeks comments on this proposal.
    CMS is also considering identifying the sampling frame for MA 
organizations as consisting of provider records that contain a unique 
provider and address. CMS identified a drawback to this approach 
because there may be cases where a provider has the same address but 
different phone numbers, potentially creating confusion for MA 
organizations when they are determining their sampling frame. CMS seeks 
comments on whether the proposed identification of the sampling frame 
as a provider record in the provider directory with a unique provider, 
address, and phone number is appropriate or whether only a unique 
provider and address would be needed to identify a unique provider 
record. CMS also seeks comments on other data elements that may be 
necessary to identify a unique provider record for the sampling frame.
    CMS is proposing that MA organizations would create a sample set 
for purposes of the proposed accuracy analysis methodology as described 
in new proposed Sec.  422.123(d)(2)(iv). At new proposed Sec.  
422.123(d)(2)(iv)(A), CMS proposes to require that MA organizations use 
a simple random sample with 65 percent of the sample made up of any 
providers in the provider directory except those with provider 
specialty types with high provider directory inaccuracy rates 
identified in Sec.  422.123(d)(2)(ii), and 35 percent of the sample 
made up of providers with provider specialty types with high provider 
directory inaccuracy rates identified in Sec.  422.123(d)(2)(ii). In 
its current proposal, CMS proposes only one provider specialty type 
with high provider directory inaccuracy rates at Sec.  
422.123(d)(2)(ii)(A), the provider specialty type of mental health or 
substance use disorder treatment. Therefore, if finalized as proposed, 
the 35 percent portion of the sample would be made up of only providers 
in the mental health or substance use disorder treatment provider 
specialty type. If there are more provider specialty types that CMS 
incorporates as provider specialty types with high provider directory 
inaccuracy rates, then CMS would include in regulation the portion of 
the 35 percent of the sample that should be made up of each provider 
specialty type. If this were to occur, CMS anticipates an even split in 
the sample amongst provider specialty types with high provider 
directory inaccuracy rates but will consider whether certain provider 
specialty types should make up more of the sample than others. CMS 
seeks comments on the proposed sampling methodology at new proposed 
Sec.  422.123(d)(2)(iv). In addition, CMS intends to release annual 
technical guidance with additional information regarding its sampling 
methodology.
    CMS is also considering stratified sampling based on county type as 
a way to create a sample set. CMS is considering assigning counties 
into two groups, one containing Large Metro, Metro, and Micro counties 
and a second group with Rural counties and Counties with Extreme Access 
Considerations (CEAC). CMS is considering defining a proportion of 
records that should come from each grouping. CMS is also considering 
using a three-group stratification of Large Metro and Metro counties 
making up one group, Micro counties making up a second group, and Rural 
and CEAC counties making up a third group, or having all five county 
types representing separate strata. CMS understands that the dynamics 
associated with each county type are different, but sampling this way 
may also introduce complications. For example, a specific provider may 
serve MA plan enrollees in both a Rural and Micro county, introducing 
additional steps into the sampling methodology. Due to CMS concerns 
about the possible additional layer of complexity and the consideration 
of administrative burden on MA organizations and providers, CMS has not 
proposed stratified sampling based on county type at this time but CMS 
is still actively considering this approach. CMS seeks comments about 
whether CMS should include any of these alternative approaches in the 
sampling methodology or consider other alternative approaches.
    In the proposed sampling methodology described in Sec.  
422.123(d)(2), CMS is also considering specifying a number or 
percentage of records that must be included in the sample. CMS is 
concerned with ensuring that conducting accuracy analysis on the sample 
is not overly burdensome (that is., that the sample is not too large) 
but also that there are enough records in the sample to ensure that the 
accuracy scores calculated are meaningful (that is, that the sample is 
not too small). CMS seeks comments on the number or percentage of 
records that should be included in the sample.
    CMS is considering whether the proposed sampling methodology 
described in Sec.  422.123(d)(2) should specify a maximum number or 
percentage of records that may be incorporated in the sample. CMS 
understands that provider networks for specified MA plans vary 
considerably depending on the size of the MA organization, the number 
of plans offered, and where an MA organization operates, among other 
considerations. Conducting an accuracy analysis may be more burdensome 
for some MA organizations than for other MA organizations, some may 
prefer to use a larger sample size, and some may prefer to use a 
smaller sample size. MA organizations that are able to conduct provider 
directory accuracy analysis using a larger sample size may find that 
they can increase their accuracy score this way relative to an MA 
organization who prefers to use a smaller sample size, or they may find 
that using a larger sample size decreases their score while increasing 
the associated burden. Large differences in the sample sizes used by MA 
organizations may affect the comparability of the resulting accuracy 
scores. CMS is seeking comments about whether CMS should have a maximum

[[Page 66421]]

number or percentage of records that may be incorporated in the sample 
and what that maximum number or percentage should be. Specifically, CMS 
is seeking comments on such issues as, whether there should be 
different considerations based on the size of MA organizations or in 
which types of counties MA organizations operate (Large Metro, Metro, 
Micro, Rural, CEAC); whether there are other differences between MA 
organizations that CMS should consider when determining the maximum 
number or percentage of records in the sample; and how CMS can help to 
ensure that there is a level playing field among all MA organizations. 
While CMS has not proposed a specific value in regulation at this time, 
CMS seeks comments on what values for a maximum number or percentage 
may be appropriate as part of the sampling methodology CMS intends to 
adopt, as well as comments on the considerations discussed previously.
    In addition, CMS is considering whether the proposed sampling 
methodology described in Sec.  422.123(d)(2) should specify a minimum 
number or percentage of records both for each provider specialty type 
with high provider directory inaccuracy rates at Sec.  
422.123(d)(2)(ii) and for an overall minimum number or percentage of 
records that must be in the sample. As noted earlier, CMS is interested 
in balancing the need to ensure that the sample is large enough to be 
sufficient to calculate the accuracy scores but also not so large as to 
be overly burdensome for MA organizations. Some smaller MA 
organizations or MA organizations with plans in rural areas may have 
fewer providers in their networks than other MA organizations. 
Considering both goals of having enough of a sample for a meaningful 
accuracy score calculation and minimizing administrative burden on MA 
organizations and providers, CMS seeks comments on what the minimum 
number or percentage of providers for each provider specialty type with 
high provider directory inaccuracy rates should be. While CMS has not 
proposed a specific value in regulation at this time, CMS seeks 
comments on what values for a minimum number or percentage may be 
appropriate as part of the sampling methodology CMS intends to adopt, 
as well as comments on the considerations discussed as part of the 
sampling methodology CMS intends to adopt.
    Since the provider directory accuracy score must be reported for 
each specified MA plan, as discussed in section II.B.6. of this 
proposed rule, CMS's understanding is that the sample that supports the 
accuracy score will also need to be drawn at the plan level. However, 
to limit the burden on both MA organizations and providers, CMS intends 
to require that MA organizations consolidate their samples across the 
MA organization. For example, if a provider appears in multiple samples 
because they are contracted to participate with multiple MA plans, and 
the MA organization chooses the verification method of email (as 
described later), then using that verification method one time would be 
sufficient for each sample the provider appears in, and there would be 
no need to email the provider multiple times.
    As part of the annual provider directory accuracy analysis and 
sampling methodology that CMS proposes to implement in Sec.  
422.123(d)(1) and (d)(2), CMS is considering also setting parameters 
governing when MA organizations must draw samples for purposes of the 
proposed annual accuracy analysis. CMS is considering the possibility 
that the MA organizations would be required to draw samples on a 
specified date, or dates, each year. This would ensure that results are 
directly comparable across plans, would reduce the risk of gaming, and 
would simplify the ability of beneficiaries to compare provider 
directory accuracy across plans. CMS also recognizes that there may be 
certain disadvantages to this approach, including operational 
constraints related to a specific date, the potential for MA 
organizations to focus on accuracy efforts for a known date rather than 
maintaining accuracy on an ongoing basis, and that such an approach 
limits flexibility for MA organizations. Alternatively, CMS could allow 
MA organizations to choose the date on which they draw their samples 
for their specified MA plans. This approach would provide operational 
flexibility and may reduce the administrative burden associated with 
sampling, but it would reduce the comparability across plans, increase 
the risk of gaming, and may increase oversight complexity for CMS. CMS 
is also considering some hybrid approaches, such as defining a window 
(for example, one quarter) and randomly assigning a date to an MA 
organization within that quarter or announcing the date on which the 
sample should be pulled with minimal advance notice. While CMS has not 
proposed a specific timeframe for the sample drawing in regulation at 
this time, CMS seeks comments on these considerations as part of the 
annual provider directory accuracy analysis and sampling methodology 
that CMS intends to adopt.
    In summary, CMS is proposing to codify the provider directory 
accuracy analysis requirement at new proposed Sec.  422.123(d)(1) and 
the sampling methodology for such analysis at new proposed Sec.  
422.123(d)(2). CMS solicits comments on these proposed changes.
5. Provider Directory Accuracy Score and Scoring Methodology (Sec.  
422.123(d)(3) and (4))
    Section 1857(e)(6)(B)(i) of the Act requires that the Secretary 
shall specify plan verification methods, such as using telephonic 
verification or other approaches using data sources maintained by an MA 
organization or using publicly available data sets, that MA 
organizations may use for estimating accuracy scores of the provider 
directory information of specified MA plans offered by such 
organizations.
    To implement these statutory requirements, first CMS proposes to 
require that MA organizations must estimate an accuracy score 
reflecting the accuracy of the provider directory information. 
Furthermore, CMS proposes that the accuracy score must be: (1) 
estimated using the verification methods specified in new proposed 
Sec.  422.123(b)(2) for specified provider directory elements, (2) 
based on the verification results for the random sample specified in 
new proposed Sec.  422.123(d)(2)(i) and (d)(2)(ii) using the sampling 
methodology specified in new proposed Sec.  422.123(d)(2)(iii), and (3) 
represented in the form of a letter grade. CMS proposes to add these 
provider directory accuracy score requirements at new proposed Sec.  
422.123(d)(3).
    At new proposed Sec.  422.123(d)(3)(i), CMS proposes to limit what 
verification method(s) may be used by MA organizations to estimate the 
provider directory accuracy score, such that certain provider directory 
elements may only be verified using certain verification methods. CMS 
notes that this proposed limitation of verification method(s) for 
certain provider directory elements only applies to MA organizations' 
verification methods for purposes of estimating the accuracy score at 
new proposed Sec.  422.123(d)(3), not to the verification methods for 
the 90-day/12-month verification at new proposed Sec.  422.123(b)(2). 
At new proposed Sec.  422.123(d)(3)(i)(A), CMS proposes to limit the 
verification method ``internal plan information'' to be used only to 
confirm network participation status (that is, that the provider is 
currently contracted and participating in that MA plan's provider

[[Page 66422]]

network) and specialty because it is possible that internal plan 
information may be dated and contain information about a provider that 
is not current (for example, an old address). At new proposed Sec.  
422.123(d)(3)(i)(B) and (d)(3)(i)(C), CMS proposes to limit the use of 
the methods ``telephonic verification'' and ``email verification'' to 
the following provider directory elements: specialty; contact 
information; primary office or facility address(es); whether the 
provider is accepting new patients; accommodations for people with 
disabilities; and telehealth capabilities. CMS believes that direct 
interaction with the provider through telephone or email communication 
is the most effective way to verify the accuracy of these provider 
directory elements. CMS has not proposed using telephone or email 
communication to verify network participation status because telephone 
and email communication are two verification methods that may cause a 
higher burden on providers, so considering that network participation 
can be verified using other verification methods, CMS has not proposed 
to include that here. Further, CMS proposes that the verification 
method of provider attestations at new proposed Sec.  
422.123(d)(3)(i)(D) would not be limited to any specified provider 
directory elements. That is, MA organizations would be permitted to use 
provider attestations to verify any provider directory element. Lastly, 
CMS proposes that the verification method of claims data at new 
proposed Sec.  422.123(d)(3)(i)(E) may be used to confirm the provider 
directory elements of network participation status and specialty. At 
this time, CMS has not proposed any provider directory elements that 
can be verified for the purposes of the accuracy score with the 
verification method ``data sources maintained by CMS.'' CMS may revisit 
this verification method with the development of the NPD and may 
incorporate the NPD as a verification method that may be used for one 
or more provider directory elements. CMS seeks comments on, for 
purposes of the accuracy score, whether there are data sources 
maintained by CMS that commenters recommend for use as reliable sources 
for any of the provider directory data elements. Finally, if CMS 
specifies other verification methods in technical guidance, as noted in 
new proposed Sec.  422.123(b)(2)(vii), then CMS will identify which 
provider directory elements the verification method may be used for, 
for purposes of estimating the accuracy score at new proposed Sec.  
422.123(d)(3).
    CMS understands that certain verification methods depend on a 
response from a provider, and a provider may not respond. If a provider 
does not respond to one verification method, another verification 
method may be used, but it is possible that an MA organization could 
exhaust the possible verification methods for a specific provider 
directory data element for their specified MA plan. As part of the 
sampling methodology that CMS proposes to implement in Sec.  
422.123(d)(2), CMS may implement a process for an MA organization to 
move on to another permitted verification method. For example, a 
possibility may be that if a provider did not respond within 7 business 
days, including at least one reminder, then the MA organization may 
consider that verification method exhausted and move on to another. In 
the event that all possible verification methods are exhausted for a 
particular record, CMS seeks comments on whether an MA organization 
should incorporate a new record into its sample to replace the non-
response. The ability to add additional records into the sample if 
there are non-responses would prevent the sample from becoming so small 
as to be insufficiently comparable to the samples of other specified MA 
plans. However, MA organizations may also choose to oversample in order 
to ensure that sufficient providers respond, which may increase the 
administrative burden on MA organizations and providers. CMS also 
understands that some provider specialty types may be more difficult to 
receive responses from than others, and therefore seeks comments on 
whether there should be requirements to fill the sample with the same 
type of provider as a non-responding provider. Given the possibility of 
non-response, CMS is also considering implementing a minimum response 
rate that each MA organization must meet for a specified MA plan and 
requests comments on what that minimum response rate should be. CMS 
also seeks comments on the provider non-responses and how they should 
be considered in the sampling methodology and verification methods.
    The next provision of the REAL Health Providers Act that CMS is 
implementing is the provider directory accuracy scoring methodology. 
Section 1857(e)(6)(B)(ii) of the Act states that with respect to each 
verification method, the Secretary shall specify a methodology for MA 
organizations to use in estimating such accuracy scores, and that each 
such methodology shall take into account the administrative burden on 
plans and providers and the relative importance of certain provider 
directory information on enrollee ability to access care.
    To describe the proposed provider directory accuracy scoring 
methodology, CMS will use an example throughout this section. This 
example is simplified for purposes of illustrating the scoring 
methodology. For each element in the proposed definition of provider 
directory information, Table II.B.3 indicates the results of the 
verification process the MA organization for MA plan Y would follow 
pursuant to the proposed sampling and verification methodology 
described in new proposed Sec.  422.123(d)(2) and (d)(3):

[[Page 66423]]

[GRAPHIC] [TIFF OMITTED] TP20OC26.004

    CMS proposes using a binary system of ``accurate'' and ``not 
accurate'' for each provider directory data element. Some of the data 
elements consist of multiple parts that make up the data element. For 
example, a provider's address may consist of a first address line, a 
second address line, a city, a state, and a zip code. A provider 
directory data element should only be considered ``accurate'' if all of 
the parts of that provider directory data element are correct. For 
example, if a provider's address has the correct first address line, 
city, and state, but wrong second address line and zip code, then the 
address would be considered ``not accurate.'' CMS notes that a 
difference in the address such as the use of the comment abbreviation 
``st'' instead of ``street'' or ``ct'' instead of ``court'' would not 
prevent an address from being considered accurate as such differences 
would be considered non-material. CMS proposes this method because the 
aim of the accuracy score analysis is to see how correct each of the 
various elements are in the provider directory, and this means that 
each of the multiple parts that make up the data element must be 
correct for the whole data element to be correct.
    CMS is considering offering a ``partial'' score if at least half of 
the multiple parts that make up the provider directory data element are 
correct. In that methodology, a score of ``not accurate'' would be 0, 
and a score of ``accurate'' would be 1, and if it was partially 
correct, the score would be ``0.5.'' In the address example mentioned 
previously, since 3 of the 5 parts of the data element were correct, 
that record would receive a score of 0.5 rather than 0. Some drawbacks 
of this approach are that it may unnecessarily complicate the scoring 
methodology and perpetuate inaccurate provider directory information. 
CMS did not propose this methodology but CMS is still actively 
considering this approach. CMS seeks comments on whether a score should 
be included for partial accuracy of any of the provider directory data 
elements.
    CMS is also considering a confidence scoring approach to determine 
the accuracy or inaccuracy of a given provider directory data element. 
Using a confidence scoring approach, a score of ``accurate'' or 1 would 
be assigned to a provider directory data element if such data element 
matched least two or more verification methods, a score of ``partially 
accurate'' or 0.5 would be assigned if a provider directory data 
element matched at least one verification method, and a score of 
``inaccurate'' or 0 would be assigned if a provider directory data 
element did not match any attempted verification methods. A concern 
that CMS identified is that this confidence scoring approach would be 
more burdensome because it would require validation against multiple 
sources. CMS has not proposed this methodology, but CMS is still 
actively considering this approach. CMS seeks comments on whether a 
confidence scoring approach should be used.
    CMS is proposing a weighted provider directory accuracy scoring 
methodology at new proposed Sec.  422.123(d)(4). CMS proposes to use 
the weights in Table II.B.4 for each element under consideration.

[[Page 66424]]

[GRAPHIC] [TIFF OMITTED] TP20OC26.005

    CMS notes that ``provider name,'' ``common ownership or control 
disclosure,'' and ``cultural and linguistic capabilities'' are not 
elements incorporated into the proposed provider directory accuracy 
scoring methodology. Thus, even though these three provider directory 
elements are part of the definition of provider directory information 
as defined in proposed Sec.  422.2, they would not count towards the 
accuracy score. CMS has not proposed that these elements be part of the 
accuracy scoring methodology. CMS did not propose to include ``provider 
name'' in the proposed provider directory accuracy scoring methodology 
because CMS believes this element is likely to be correct and is 
therefore of lower priority to incorporate into the scoring 
methodology. CMS did not propose to include ``common ownership or 
control disclosure'' in the accuracy score methodology because CMS has 
limited experience with this as a provider directory element and 
therefore a higher level of uncertainty regarding the burden on MA 
organizations and providers associated with collecting and maintaining 
this information. Lastly, CMS did not propose to include ``cultural and 
linguistic capabilities'' in the accuracy scoring methodology to reduce 
burden. This provider directory element may be difficult to 
consistently evaluate using the binary scoring methodology that CMS 
proposes. CMS believes that not proposing the inclusion of an element 
that is likely to contain information of a more varied and open-ended 
nature may limit some burden associated with the scoring methodology on 
MA organizations and providers. CMS seeks comments on whether 
``provider name,'' ``common ownership or control disclosure,'' or 
``cultural and linguistic capabilities'' should be incorporated into 
the accuracy scoring methodology, or if CMS should request that MA 
organizations collect data on the accuracy of these elements to inform 
potential future inclusion of these elements in the accuracy scoring 
methodology. CMS may consider whether to incorporate this information 
into future accuracy reporting after evaluating comments and experience 
with implementation.
    CMS is proposing these weights to emphasize the accuracy of certain 
elements in the provider directory to focus the attention of MA 
organizations on specific elements most significant to ensuring 
beneficiaries can access care. CMS proposes a weight of 40 percent for 
network participation status (that is, per proposed Sec.  422.2, that 
the provider listed in the directory is a provider with which the MA 
organization offering the MA plan has an agreement for furnishing items 
and services covered under such plan) because this is the most 
foundational piece of information in a provider directory. 
Beneficiaries expect that the providers listed in the directory are in 
the MA plan's network, and, as such, beneficiaries expect to be able to 
access care from these in-network providers at in-network cost sharing. 
An error in network participation status can lead a beneficiary to 
unknowingly receive out-of-network care, which may result in higher 
costs and undermine continuity of care.
    CMS proposes a weight of 20 percent for both contact information 
and primary office or facility address. Beneficiaries and caregivers 
may frequently rely on contact information from the directory to call 
the provider to schedule an appointment, and an incorrect phone number 
creates an immediate barrier for a beneficiary to access care. 
Beneficiaries and caregivers also need an accurate primary office or 
facility address to physically reach the provider, so an incorrect 
address would create an immediate barrier to receiving care. Also, 
beneficiaries may choose which provider to schedule an appointment with 
based on the proximity of the address to their home or other places 
they frequently visit. If the address information is inaccurate, then a 
beneficiary may inadvertently call or schedule an appointment with a 
provider at an address that they cannot easily access.
    CMS proposes a weight of 10 percent for the provider's specialty. 
Accurate specialty information helps beneficiaries identify the 
provider for the beneficiary's particular health care needs. Inaccurate 
specialty information may lead the beneficiary to contact several 
providers before one with the correct specialty can be identified, 
which may slow the beneficiary's access to needed care.
    CMS proposes a weight of 3.5 percent whether the provider has 
accommodations for people with disabilities and has telehealth 
capabilities. These elements provide important information to 
beneficiaries as they seek access to care. Beneficiaries with 
disabilities may need certain accommodations, and knowledge of which 
providers can accommodate them is integral to their decision making. 
Knowledge of a provider's telehealth capabilities allows beneficiaries 
to choose a provider that offers the option for telehealth 
appointments. While these two elements with the proposed weight of 3.5 
percent are meaningful and important for beneficiaries to access needed 
care, the potential for harm if any of these elements are incorrect is 
more limited because beneficiaries can still identify and contact 
providers even if these elements are inaccurate in the provider 
directory. Also, the accommodations for people with disabilities 
provider directory element affects a subset of the overall beneficiary 
population, which justifies a lower proposed weight relative to the 
universally applicable elements.
    CMS proposes a weight of 3 percent for whether the provider is 
accepting new patients. This element shares a lot of similarities with 
whether the provider has accommodations for people with disabilities 
and has telehealth capabilities discussed previously. This is also an 
element which provides important information to beneficiaries as they 
seek access to care. Knowing whether a provider is

[[Page 66425]]

accepting new patients may help beneficiaries identify providers that 
may have available appointments. In addition, while this element is 
also meaningful and important for beneficiaries to access needed care, 
the potential for harm if this element is incorrect is more limited 
because beneficiaries can still identify and contact providers even if 
this element is inaccurate in the provider directory. CMS proposes a 
weight of 3 percent rather than 3.5 percent proposed for whether the 
provider has accommodations for people with disabilities and has 
telehealth capabilities because of the three elements, CMS believes 
whether the provider is accepting new patients may be an element that 
could change more frequently than other elements and therefore may be a 
challenging provider directory element for MA organizations to collect 
and maintain. Recognizing the possible additional burden associated 
with collecting and maintaining this element for both MA organizations 
and providers, CMS proposes a slightly lower weight than the other two 
similar elements. Further, as a practical matter, CMS also wanted to 
ensure the proposed weights added up to 100 percent, and the most 
straightforward way to do that was to use weights of 3.5 percent for 
two elements and 3 percent for one element.
    Given these weights, CMS's proposed provider directory accuracy 
scoring methodology (also described in Table II.B.5) is that first, the 
MA organization would need to sum the number of accurate records for 
each element across all providers in the specified MA plan's sample and 
then divide the number of accurate records for each element by the 
number of providers in the sample to determine the Accuracy Percentage 
per Element. Then, CMS proposes that the MA organization would need to 
multiply the Accuracy Percentage by Element by the Element Weight in 
Table II.B.5, to determine the Weighted Score per Element. In the 
example earlier, the accuracy percentage for the element ``Network 
Participation Status'' is

5 divided by 6, or 5/6 = 0.833333

and then the weighted score for that element would be

0.833333 multiplied by 0.4, or 0.833333 * 0.4 = .333333.

    To determine the Final Composite Score, CMS proposes that the MA 
organization would need to sum the Weighted Score per Element. Then, 
CMS proposes that the MA organization would need to multiply the Final 
Composite Score by 100 to convert to a percentage, then round to the 
nearest whole number to determine the Rounded Composite Score. As a 
result, CMS proposes that, to determine the final Provider Directory 
Accuracy Score, the MA organization would need to convert the Rounded 
Composite Score to the appropriate letter grade. CMS proposes that 90 
percent to 100 percent would be equivalent to a grade of ``A,'' 80 
percent to 89 percent would be equivalent to a grade of ``B,'' 70 
percent to 79 percent would be equivalent to a grade of ``C,'' 60 
percent to 69 percent would be equivalent to a grade of ``D,'' 50 
percent to 59 percent would be equivalent to a grade of ``E,'' and 49 
percent and below would be equivalent to a grade of ``F.'' Table II.B.5 
illustrates this calculation for MA plan Y's scores in the example.
[GRAPHIC] [TIFF OMITTED] TP20OC26.006

    In this example, for MA plan Y, the accuracy score would be a ``C'' 
because the Rounded Composite Score is 73 percent. Note that while 
Table II.B.5 only includes 6 decimal places, CMS proposes that MA 
organizations should not round to the nearest whole number until they 
get to the Final Composite Score calculation. That calculation should 
then be rounded to the nearest whole number and be represented in the 
form of a percentage as the Rounded Composite Score. CMS is proposing 
these requirements for the provider directory accuracy scoring 
methodology in new proposed Sec.  422.123(d)(4).
    In developing this proposal, CMS considered a scoring methodology 
approach that incorporated the proposed verification requirements, 
described at new proposed Sec.  422.123(b), into the accuracy score. 
Table II.B.6 shows the sample data for one of the example providers, 
Jane Doe, with accuracy records from both when the sample was drawn and 
during the most recent 90-day verification that the MA organization 
conducted. As seen in Table II.B.6, the results from the accuracy of 
the provider directory information may be different on the date that 
the sample is drawn as compared to the date of the 90-day verification.

[[Page 66426]]

[GRAPHIC] [TIFF OMITTED] TP20OC26.007

    CMS is considering a methodology in which the MA organization use 
both records of provider directory accuracy data when they develop the 
accuracy score. This may provide additional incentives for MA 
organizations to ensure their verification activities are thorough and 
also not unduly penalize MA organizations if through most of the year 
the provider directory information is correct but happened to be 
incorrect when the sample was drawn. A possible drawback for this 
approach is that MA organizations could choose the exact timing that 
they conduct their verification as long as it is consistent with CMS 
requirements at new proposed Sec.  422.123(b), which may introduce 
opportunities for gaming, and the resulting accuracy scores may also be 
less of a direct ``apples-to-apples'' comparison between specified MA 
plans given these differences. CMS considered several different ways to 
incorporate the verification results into the accuracy score 
methodology. For example, CMS considered incorporating the most recent 
verification for the provider and also considered incorporating the 
results from all of the 90-day and 12-month verifications that the MA 
organization completed. Additionally, CMS considered whether the 
verification results should be weighed equally with the sample, whether 
the sample should be weighed more than the verification results, or 
whether the verification results should be weighed more than the 
sample. CMS further considered whether specific verification methods 
would have to be used if the verification results were incorporated 
into the provider directory accuracy score. For example, CMS considered 
requiring that only verification results that used the same 
verification method as the sample could be included. CMS has not 
proposed incorporating the verification results into the accuracy score 
at this time because a more complex scoring methodology may increase 
the burden on MA organizations and providers, but CMS is still actively 
considering these approaches and interested in comments on whether CMS 
should consider an accuracy scoring methodology that incorporates the 
verification results.
    CMS is also considering whether certain provider specialty types 
with high provider directory inaccuracy rates should be weighed in the 
accuracy score more so than other provider specialty types and whether 
certain provider specialty types, regardless of whether it is 
considered a provider specialty type with high provider directory 
inaccuracy rates, should be weighed in the accuracy score more so than 
other provider specialty types. A drawback of either of these 
approaches is that they would likely add additional complexity into the 
provider directory accuracy scoring methodology. CMS has not proposed 
either of these approaches but is still considering them and seeks 
comments on whether accuracy scores should be calculated differently 
for provider specialty types with high provider directory inaccuracy 
rates or if scores for certain provider specialty types should be 
calculated differently regardless of whether it is considered a 
provider specialty type with high provider directory inaccuracy rates.
    CMS is further considering whether geographical considerations 
should be part of the scoring methodology. CMS is considering whether 
records in the sample with an address in a rural or CEAC county should 
have different weights associated with the provider directory data 
elements or whether some provider directory data elements should not be 
included in the scoring methodology for records in the sample with an 
address in a rural or CEAC county. CMS is also considering whether 
specified MA plans with 75 percent or more of their service area in 
rural and CEAC counties should have a different scoring methodology 
than other plans. CMS recognizes that a drawback of this approach may 
be that it represents less of a direct ``apples-to-apples'' comparison 
among specified MA plans and also that it may add additional complexity 
to the scoring methodology. CMS has not proposed different scoring 
methodologies based on geographic considerations but is still actively 
considering this approach. CMS seeks comments on whether different 
scoring methodologies would be appropriate and if so, how the scoring 
methodology should differ and what criteria should be used to identify 
which scoring methodology an MA organization should use when 
determining its accuracy score for a specified MA plan.
    In alignment with the statute, as CMS developed this proposed 
accuracy scoring methodology, CMS considered the relative importance of 
certain provider directory information on enrollee ability to access 
care and the administrative burden of verification on MA organizations 
and providers. As described at new proposed Sec.  422.123(d)(4), CMS 
proposes to have a weighted provider directory accuracy scoring 
methodology, in which provider directory information elements are 
weighed according to their relative importance for beneficiary access 
to care. By choosing to weigh specific pieces of information, CMS 
emphasizes the accuracy of certain elements of provider directory 
information over others.
    In summary, CMS is proposing to codify the provider directory 
accuracy score requirements at new proposed Sec.  422.123(d)(3) and the 
provider directory accuracy scoring methodology requirements at new 
proposed Sec.  422.123(d)(4). CMS solicits comments on these proposed 
changes.

[[Page 66427]]

6. Provider Directory Accuracy Reporting to CMS (Sec.  422.123(d)(5))
    Section 1857(e)(6)(A)(ii) of the Act requires that beginning with 
plan years beginning on or after January 1, 2028, each MA organization 
must submit to the Secretary a report containing the results of the 
analysis conducted under clause (i), including an accuracy score for 
such provider directory information (as determined using a plan 
verification method specified by the Secretary under subparagraph 
(B)(i)).
    CMS proposes to codify this requirement at new proposed Sec.  
422.123(d)(5)(i), requiring that the MA organization must submit to CMS 
an annual provider directory accuracy report containing the results of 
the accuracy analysis for its specified MA plans. CMS proposes that the 
report must contain the provider directory accuracy score for each 
specified MA plan. In addition to this basic statutory requirement, CMS 
is considering requiring additional elements for the annual provider 
directory accuracy report so that CMS can monitor MA organizations' 
implementation of the new provider directory accuracy requirements and 
can issue updated technical guidance taking into account the experience 
and burden of MA organizations. Furthermore, CMS is also aware of 
section 6220(b)(3) of the CAA, which states that the Comptroller 
General of the United States (or the Government Accountability Office, 
GAO) shall conduct a study and corresponding report including an 
analysis of the use of cost sharing protections; the trend in provider 
directory information accuracy scores submitted to CMS, both overall 
and among providers specializing in mental health or substance use 
disorder treatment; provider response rates by plan verification 
methods; administrative costs to providers and MA organizations; and 
other items determined appropriate by the Comptroller General (or GAO). 
Therefore, as CMS considers what reporting data to collect from MA 
organizations, CMS is bearing in mind what information the GAO may be 
interested in for purposes of the GAO study and corresponding report. 
Specifically, in addition to the provider directory accuracy score, CMS 
is considering requiring that the annual provider directory accuracy 
report also contain elements, including but not limited to provider 
specialty type response rates by verification method or other sampling 
data by provider specialty type (including possibly requiring reporting 
based on the NUCC provider taxonomy code set), estimated administrative 
costs to the MA organization, estimated administrative costs to the MA 
organization's contracted providers, and data on the use of cost 
sharing protections. CMS requests comments on whether these additional 
reporting elements should be required. CMS will take into account 
commenters' feedback and may finalize the collection of these 
additional data elements in the final rule should such an outcome be 
supported.
    In addition, regarding timing for MA organizations' annual 
submission of the provider directory accuracy report, at new proposed 
Sec.  422.123(d)(5)(ii), CMS proposes that the report must be submitted 
not later than the first Monday in April of the year following the 
contract year being measured, in a form and manner specified by CMS. In 
proposing this date, CMS intends to give MA organizations at least 
three months to compile the required information and complete their 
provider directory accuracy report for the previous contract year. CMS 
solicits comments specifically on this proposed annual reporting 
deadline and whether it provides MA organizations with sufficient time. 
CMS also solicits comments on all aspects of these proposed changes 
regarding provider directory reporting at new proposed Sec.  
422.123(d)(5).
    CMS is also considering whether to require that the annual provider 
directory accuracy analysis and resulting provider directory accuracy 
score be independently reviewed and certified by a qualified third 
party prior to submission to CMS. CMS believes that an independent 
review could promote consistency in the application of the sampling 
methodology, strengthen confidence in the reported accuracy scores, and 
provide an additional safeguard against variability in implementation 
across MA organizations. Similar to other CMS reporting requirements 
that require independent certification or attestation, the third party 
would be responsible for evaluating whether the MA organization's 
analysis was conducted in accordance with CMS requirements and that the 
reported results reasonably reflect the underlying provider directory 
information.
    CMS seeks comments on whether an independent third-party 
certification requirement should be adopted, the qualifications such 
entities should possess, whether certification should be performed 
under generally accepted attestation or audit standards, and whether 
CMS should establish independence requirements comparable to those used 
for other CMS certification and reporting requirements.
7. Exception for Specified MA Plans With Low Enrollment
    Section 1857(e)(6)(C) of the Act specifies that the Secretary may 
waive the requirements of paragraph (e)(6) ``Provider Directory 
Accuracy Analysis and Reports,'' in the case of a specified MA plan 
with low enrollment (as defined by the Secretary). CMS is considering 
whether to implement this statutory authority to exempt low-enrollment 
specified MA plans from the annual provider directory accuracy analysis 
and reporting requirements. Since the statute allows the Secretary to 
define what low enrollment means, CMS is contemplating various 
approaches for this definition if the low-enrollment exception were to 
be implemented. One approach might be to use a threshold for low 
enrollment that is already used in other areas of the MA program. For 
example, CMS could potentially apply similar criteria as the existing 
minimum enrollment threshold for MA plans, such as 500 enrollees for 
non-special needs plans (non-SNPs) and 100 enrollees for SNPs. 
Alternatively, CMS could apply similar criteria as is currently used 
for the Star Ratings threshold, which is 30 enrollees.
    Considering these approaches, if CMS implements the low-enrollment 
exception so that specified MA plans with low enrollment do not have to 
complete the annual provider directory accuracy analysis and report, 
then some of the administrative burden on smaller plans may be eased, 
though all MA organizations offering specified MA plans, including low-
enrollment plans, would still be subject to the verification and 
updating requirements in proposed Sec.  422.123(b) and (c). There would 
also be a consistency in approach in terms of other areas of the MA 
program in which low enrollment thresholds are used. However, CMS 
believes that provider directory accuracy is important for all 
specified MA plans, regardless of the number of enrollees. It is 
important to balance the burden on specified MA plans and the need for 
enrollees to have accurate provider directories to ensure they can 
access care. CMS is inclined towards making the annual provider 
directory analysis and reporting requirements applicable to all 
specified MA plans, regardless of enrollment size, in which case CMS 
would not implement an exception to these new requirements for 
specified MA plans with low enrollment. CMS strongly supports the idea 
that accurate provider directories are important regardless of the plan 
size. In addition, the fact that

[[Page 66428]]

some traditionally smaller sized MA organizations tend to offer SNPs, 
which may include more vulnerable enrollees, leads CMS to believe that 
a waiver for enrollment size may not be in the best interest of the 
beneficiary. Taking into account all of these factors, CMS solicits 
comments on whether and, if so, how to implement the statutory 
authority to exempt low-enrollment specified MA plans from the annual 
provider directory accuracy analysis and reporting requirements.
8. Contract Requirement for MA Organizations (Sec.  422.504(a)(22))
    Section 1857(e)(6)(A) of the Act requires that, beginning with plan 
years beginning on or after January 1, 2028, each CMS contract with an 
MA organization shall require the MA organization, for each specified 
MA plan it offers, to annually conduct a provider directory accuracy 
analysis using a random sample of providers in accordance with 
subparagraph (A)(i) and submit to the Secretary a report containing the 
results of such analysis, including a provider directory accuracy 
score. To codify this statutory requirement, CMS proposes to add new 
paragraph (a)(22) to the regulations for contract provisions at Sec.  
422.504, stating that in the contract between the MA organization and 
CMS, the MA organization agrees to comply with the provider directory 
accuracy requirements under Sec.  422.123(d)--for contract year 2028 
and subsequent contract years--for each specified MA plan. CMS solicits 
comments on this proposed change.
9. Provider Directory Public Transparency (Sec.  422.123(e))
    Section 1857(e)(6)(D) of the Act requires that, beginning with plan 
years beginning on or after January 1, 2029, the Secretary shall post 
accuracy scores (as reported under subparagraph (A)(ii)), in a machine-
readable file, on an internet website maintained by CMS. To codify this 
public transparency requirement, CMS proposes to add new Sec.  
422.123(e), which would state that beginning with contract years 
beginning on or after January 1, 2029, CMS will post provider directory 
accuracy scores as reported under paragraph (d)(5) of this section in a 
machine-readable file on the CMS website. If finalized as proposed, 
this would mean that in contract year 2029, CMS would post the contract 
year 2028 provider directory accuracy scores that MA organizations 
would be required to report to CMS by April 2029 in accordance with 
proposed Sec.  422.123(d)(5). In addition to this proposed public 
online posting in a machine-readable file, CMS is considering posting 
the scores through various Application Programming Interfaces (APIs) 
that CMS offers. CMS is currently also considering posting the provider 
directory accuracy scores of MA organizations on the MPF website. CMS 
solicits comments on this proposed change.
10. Enrollee Cost Sharing Protections When Provider Directories Are 
Inaccurate (Sec. Sec.  422.124 and 422.202(f))
    Section 1852(d) of the Act establishes provider directory cost 
sharing protections for enrollees who rely on incorrect provider 
directory information. Specifically, if a provider is in the provider 
directory of a specified MA plan on the date an enrollee makes an 
appointment, but at the time of the appointment when the item or 
service is furnished by the provider, it is determined that the 
provider is no longer in-network, then the MA organization must limit 
enrollee cost sharing to the lesser of the in-network or otherwise 
applicable cost sharing amount. These protections take effect beginning 
in contract year 2028 and apply to all subsequent contract years.
    To implement the new cost sharing protections contained within 
section 1852(d) of the Act, CMS proposes to add new regulations at 
Sec.  422.124, which would outline the scope of the protections, and 
the process enrollees must follow to access them. The protections would 
apply under proposed Sec.  422.124(a) and (b) when an enrollee receives 
services from an out-of-network provider who was listed as in-network 
in the specified MA plan's directory on the date the appointment was 
made, and those services would otherwise be covered. In such cases, the 
MA organization would limit the enrollee's cost sharing to whichever 
amount is less, the in-network or otherwise applicable cost sharing 
amount. To initiate the process, the enrollee or their authorized 
representative would submit a request for the cost sharing protections 
to the MA organization, which would treat the request as an 
organization determination or reconsideration request per Sec.  
422.124(c). The MA organization would then determine eligibility by: 
(1) confirming the date the appointment was made per Sec.  422.124(d); 
and (2) verifying whether the provider appeared in the specified MA 
plan's online directory on that date per Sec.  422.124(e). If the MA 
organization cannot obtain the documentation necessary to make that 
determination from provider documentation, attestation, or a provider 
directory archive, the protections would be applied in the enrollee's 
favor per Sec.  422.124(f). Once the MA organization confirmed that the 
protections apply, the lower cost sharing would be reflected in the 
enrollee's bill and maximum out-of-pocket (MOOP) calculation consistent 
with Sec.  422.124(g).
    Regarding the scope of the protections, CMS proposes to add Sec.  
422.124(a) and (b) providing that the cost sharing protections would 
apply if an enrollee in a specified MA plan is furnished an item or 
service from a provider that is not participating in the MA plan's 
network, but that provider is listed in the MA plan's provider 
directory as defined in Sec.  422.2 on the date the appointment is 
made. The protections apply if the item or service would otherwise be 
covered under the MA plan if furnished by an in-network provider. In 
such cases, the MA organization offering the MA plan must ensure that 
the enrollee pays no more than the lesser of either: (1) the amount of 
cost sharing that would apply if the provider had been participating in 
the network of the plan; or (2) the amount of cost sharing that would 
otherwise apply.
    CMS proposes adding Sec.  422.124(c) to require the MA organization 
to apply the provider directory cost sharing protections without 
requiring an enrollee request when the MA organization knows or 
reasonably should know that the protections apply. In other words, if 
an enrollee or authorized representative references the use of 
incorrect provider directory information when requesting an 
organization determination or reconsideration for an out-of-network 
cost sharing bill but does not appear to be aware of the provider 
directory cost sharing protections, the MA organization must inform the 
enrollee of the available protections and evaluate whether the 
protections apply to the claim or claims. CMS also proposes to permit 
an enrollee or the enrollee's authorized representative to request 
application of the protections verbally or in writing to their MA 
organization. CMS proposes at Sec.  422.124(c)(1) that such requests 
would be processed as organization determinations or reconsideration 
requests, as applicable, consistent with subpart M of this part. 
Consistent with current practice, when an enrollee or provider believes 
an item or service may not be covered, or could be covered only under 
specific conditions, a pre-service organization determination should be 
requested from the MA organization. If the item or service is denied, 
the standardized

[[Page 66429]]

denial notice must include information about the enrollee's appeal 
rights.
    To confirm the date on which the appointment was made, CMS proposes 
to require at Sec.  422.124(d) that MA organizations include a term in 
each provider contract for a specified MA plan obligating the provider 
to supply documentation of the earliest date on which the enrollee's 
appointment was scheduled, regardless of any subsequent rescheduling. 
For example, if an enrollee makes an appointment on April 12, 2028, and 
reschedules the appointment on May 15, 2028, the MA organization would 
look at the provider directory on April 12, 2028, to see if the 
provider was listed as in-network. At Sec.  422.124(d), CMS proposes 
that acceptable documentation would include a paper or electronic 
record from the provider's scheduling system or confirmation sent to 
the enrollee or their authorized representative from the provider. If a 
record of the date the appointment was made is not reasonably 
obtainable, a signed attestation from the provider, accompanied by any 
available corroborating information such as a calendar entry, a 
referral record, electronic communications, or a phone log, if 
available would be sufficient to show the approximate date the 
appointment was made. CMS proposes that this contract term survives the 
expiration or termination of the contract between the MA organization 
and the provider for not less than 10 years, beginning on the date the 
contract expiration or termination becomes effective, thereby ensuring 
that providers who were previously participating in the specified MA 
plan's network remain obligated to supply documentation regarding the 
date on which the enrollee's appointment was made, even after departing 
from the network.
    In order to verify the accuracy of the provider directory, at Sec.  
422.124(e) CMS proposes to add a requirement that the MA organization 
would determine whether the provider was listed as an in-network 
provider in the specified MA plan's online provider directory on the 
date the appointment was made by referencing archived electronic 
provider directory data maintained online by the MA organization. 
Archived provider directory data must be sufficient to identify whether 
any provider was listed in the specified MA plan's online directory at 
any point on a given date, retained for not less than ten years 
consistent with Sec.  422.504(d), and made available to CMS upon 
request within 5 business days. If the archived provider data provided 
indicates that the provider in question was listed in the specified MA 
plan's online provider directory at any point during a given day, 
whether in the morning or later in the afternoon, the provider would be 
considered to have been listed in the online directory for that entire 
day for the purpose of determining whether the cost sharing protections 
apply. In addition, a notice that the provider information may be 
outdated, per the requirement at new proposed Sec.  422.123(b)(3) in 
this proposed rule, would not affect an enrollee's eligibility for the 
cost sharing protections.
    CMS solicits comments on whether the provider directory data used 
to determine whether the cost sharing protection applies should be 
limited to the online provider directory as proposed here, or whether 
the cost sharing policy should similarly apply to the contents of a 
physical hardcopy of the provider directory upon which an enrollee 
relied given that MA organizations have an obligation to provide 
enrollees with a physical hardcopy of a current provider directory upon 
request in accordance with Sec.  422.2267(d). For example, under the 
proposed requirement at Sec.  422.123(c)(2), an MA organization must 
send a quarterly addendum with provider directory updates to all 
enrollees who have requested a physical hardcopy provider directory. 
CMS is seeking comments on whether, under this proposed framework, an 
enrollee who uses the most current physical hardcopy directory 
available (that is, a physical hardcopy version with up-to-date 
addenda) to schedule an appointment--even if that physical hardcopy 
differs from the online directory on the date of the appointment--
should qualify for the cost sharing protections described in proposed 
Sec.  422.124. CMS also solicits comments on the duration of the 
proposed data retention requirement and whether MA organizations should 
be required to publicly post daily versions of their provider 
directories instead of being made available to CMS upon request within 
5 business days as proposed. CMS believes that inclusion of such a 
requirement may be necessary to ensure accuracy and ease the review of 
archived provider directories. Finally, CMS seeks public comment on 
whether formatting requirements for archived provider directory 
information should be established, such as through a log of provider 
updates or removals or another auditable archive sufficient to identify 
the directory status of a provider on a given date.
    CMS proposes at Sec.  422.124(f) that if the MA organization is 
unable to obtain documentation demonstrating the date on which the 
appointment was scheduled or is unable to verify archived provider 
directory data within the applicable standard or expedited organization 
determination timeframes provided under 42 CFR 422 subpart M, the 
provider directory cost sharing protections must be applied in favor of 
the enrollee. This default application may be reversed only if the MA 
organization is able to clearly demonstrate that the cost sharing 
protections do not apply.
    To apply the cost sharing protections, at Sec.  422.124(g)(1) CMS 
proposes that if the MA organization collects cost sharing from an 
enrollee in excess of the amount permitted under the provider directory 
cost sharing protections, and the protections apply, the MA 
organization must refund the excess amount to the enrollee consistent 
with Sec.  422.270(b). Additionally, when the protections apply and a 
refund is issued, at Sec.  422.124(g)(2) CMS proposes that MA 
organizations treat that cost sharing as in-network cost sharing for 
purposes of any applicable MOOP limit, consistent with Sec.  
422.100(f)(4).
    The purpose of the cost sharing protections created by the REAL 
Health Providers Act is to protect MA enrollees who rely on the 
provider directory of a specified MA plan to schedule an appointment 
with an in-network provider and later discover that the provider is 
out-of-network. The following example illustrates a scenario when the 
cost sharing protection would apply. An MA enrollee needs to see a 
cardiologist, checks their MA plan's online provider directory, and 
finds Dr. Smith listed as an in-network provider. On January 5, 2028, 
they schedule an appointment with the provider's office for March 6, 
2028. The enrollee receives items and services from Dr. Smith on March 
6, 2028, and subsequently receives an EOB reflecting cost sharing at 
the out-of-network rate, higher than the in-network rate the enrollee 
expected. The enrollee contacts their MA organization to see why the 
bill is so high and explains that the doctor was listed on their plan's 
provider directory at the time the appointment was made. The MA 
organization educates the enrollee about the provider directory cost 
sharing protections and offers to determine whether the enrollee 
qualifies. The enrollee agrees and the MA organization works with the 
enrollee's provider's office to confirm the appointment was made on 
January 5, 2028, and verifies via its archived provider directory data 
that Dr. Smith was listed as in-network on the same date. The MA 
organization then applies the protections, capping the enrollee's

[[Page 66430]]

cost sharing at the in-network rate, refunding any excess cost sharing 
the enrollee may have already paid, and counts the cost sharing toward 
the enrollee's in-network MOOP limit.
    Notably, if Dr. Smith's office has no scheduling records available 
or an archive of the plan directory was unavailable, the MA 
organization would still be required to apply the protections in the 
enrollee's favor unless the MA organization was able to clearly 
demonstrate that the cost sharing protections do not apply, such as 
proof that the provider was never in the specified MA plan network.
    These proposed requirements are designed to strengthen enrollee 
protections and reduce the risk of unexpected higher out-of-network 
costs resulting from inaccurate provider directory information. CMS 
believes these proposals align with the statutory goal of ensuring all 
enrollees have timely access to the new cost sharing protections and 
incentivizing MA organizations to maintain accurate and up-to-date 
directories on an ongoing basis. CMS proposes that the burden of proof 
for determining whether these protections apply rests with the MA 
organization, not the enrollee, and that MA organizations must make 
reasonable, good-faith efforts to gather all relevant documentation 
prior to rendering an eligibility determination from the provider 
consistent with the contract term requirements at Sec.  422.124(d). The 
impact of the proposed policy changes is discussed in the Collection of 
Information Requirements and Regulatory Impact Analysis under sections 
III.A. through D. and IV.A. through K. of this proposed rule, 
respectively. CMS seeks comments on ways to improve enrollee access to 
the cost sharing protections, the operational feasibility of these 
requirements, including the processes MA organizations would use to 
verify whether an enrollee relied on directory information at the time 
an appointment was made, and whether additional documentation or 
verification standards are necessary to ensure the integrity and 
effective administration of these protections.
11. Provider Directory Disclosure Requirements (Sec. Sec.  
422.111(b)(3)(i), (b)(12), and (k) and 422.120(b)(1))
    The REAL Health Providers Act also affects CMS's current MA 
disclosure requirements. First, section 1852(c)(1)(C) of the Act 
requires MA organizations, for plan year 2028 and subsequent plan 
years, in the case of a specified MA plan, to disclose to enrollees the 
information described in paragraph (c)(3)(B) (that is, provider 
directory information). CMS's current regulatory text corresponding to 
this section of the statute is located at Sec.  422.111(b)(3)(i). where 
the disclosure requirement for the provider directory currently states 
``the number, mix, and distribution (addresses) of providers from whom 
enrollees may reasonably be expected to obtain services; each 
provider's cultural and linguistic capabilities, including languages 
(including American Sign Language) offered by the provider or a skilled 
medical interpreter at the provider's office.''
    To codify the new provider directory disclosure requirement in the 
statute, CMS proposes to amend Sec.  422.111(b)(3)(i) to include both 
phrases ``the number, mix, and distribution of providers from whom 
enrollees may reasonably be expected to obtain covered benefits'' and 
``provider directory information as defined in Sec.  422.2 and in 
accordance with Sec.  422.2267(e)(11).'' The reason for the proposed 
removal of ``(addresses)'' is to avoid duplication because the proposed 
definition of provider directory information at Sec.  422.2 includes 
``Primary office or facility address(es) where covered items or 
services are furnished'' as one of the proposed required pieces of 
information. Further, CMS's proposed cross-reference to the definition 
of provider directory information at Sec.  422.2 aligns with the 
statute, and the additional proposed cross-reference to Sec.  
422.2267(e)(11) would ensure that provider directory requirements 
related to timing of required disclosure, verification, and updates are 
also captured. In addition, as discussed in section II.B.1. of this 
proposed rule, CMS is proposing to remove the phrase ``each provider's 
cultural and linguistic capabilities, including languages (including 
American Sign Language) offered by the provider or a skilled medical 
interpreter at the provider's office'' from Sec.  422.111(b)(3)(i). CMS 
believes that the codification of the statutory term ``cultural and 
linguistic capabilities'' from section 1852(c)(3)(B) of the Act for the 
proposed definition of ``provider directory information'' at Sec.  
422.2 suffices. For ease of reading of the regulatory text, CMS's 
proposal at Sec.  422.111(b)(3)(i) includes a breakdown of the 
different disclosure elements in the form of paragraphs (b)(3)(i)(A) 
through (E), wherein ``the number, mix, and distribution of providers 
from whom enrollees may reasonably be expected to obtain covered 
benefits'' and ``provider directory information as defined in Sec.  
422.2 and in accordance with Sec.  422.2267(e)(11)'' would be located 
at proposed subparagraphs (b)(3)(i)(A) and (B), and the remaining 
subparagraphs would contain existing Sec.  422.111(b)(3)(i) regulatory 
text that CMS is not proposing to modify.
    The REAL Health Providers Act also establishes provider directory 
disclosure requirements related to the cost sharing protections and the 
accuracy score. First, section 1852(d)(7)(B)(i) and (ii) of the Act 
requires that for plan year 2028 and subsequent plan years, each MA 
organization that offers a specified MA plan shall: (1) notify 
enrollees of their cost sharing protections under this paragraph and 
make such notifications, to the extent practicable, by not later than 
the first day of an annual, coordinated election period under section 
1851(e)(3) of the Act with respect to a year; and (2) include 
information regarding such cost sharing protections in the provider 
directory of each specified MA plan offered by the MA organization. 
Second, section 1851(d)(4)(F) of the Act requires that, beginning with 
plan years beginning on or after January 1, 2029, in the case of a 
specified MA plan, the accuracy score of the plan's provider directory 
(as reported under section 1857(e)(6)(A)(ii) of the Act) must be listed 
prominently on the MA plan's provider directory.
    To codify these new provider directory disclosure requirements, CMS 
is proposing to add new paragraph (b)(12) to Sec.  422.111, titled 
``Cost sharing protections and accuracy score in provider directory.'' 
In new proposed Sec.  422.111(b)(12), each MA organization offering a 
specified MA plan would be required to disclose, in a form and manner 
specified by CMS, information within the provider directory regarding 
cost sharing protections and accuracy, including: (1) for contract year 
2028 and subsequent contract years--by no later than the first day of 
the annual coordinated election period under Sec.  422.62(a)(2)--a 
plain-language description of the enrollee cost sharing protections 
required under Sec.  422.124; and (2) for contract year 2029 and 
subsequent contract years, the most recent provider directory accuracy 
score reported to the Secretary in accordance with Sec.  422.123(d)(5), 
prominently displayed. Pursuant to CMS's current regulations at Sec.  
422.2267(e)(11), MA organizations are required to provide the provider 
directory to current enrollees no later than the start of the annual 
coordinated election period. Thus, by including the specified cost 
sharing protection and accuracy information to enrollees in the 
provider directory as proposed in

[[Page 66431]]

Sec.  422.111(b)(12), CMS is proposing that MA organizations would also 
be considered to satisfy the statutory requirement under section 
1852(d)(7)(B)(i) of the Act that such notification must be made by MA 
organizations, ``to the extent practicable, by not later than the first 
day of an annual, coordinated election period under section 1851(e)(3) 
of the Act with respect to a year.''
    For the proposed disclosure requirement at new proposed Sec.  
422.111(b)(12)(ii) that the MA organization prominently display the 
most recent provider directory accuracy score, CMS believes the most 
appropriate place for the accuracy score would be at the end of the 
introduction to the provider directory, before the list of network 
providers. In addition, CMS believes that providing a simple 
explanation alongside the accuracy score would be sufficient, for 
example, ``Information Accuracy: [insert letter grade score]. We have 
rated this directory based on how correct the information we provide 
is. We always aim to give you the most accurate details possible.'' If 
Sec.  422.111(b)(12) is finalized as proposed, then CMS intends to 
update the Medicare Advantage and Section 1876 Cost Plan Provider 
Directory Model and Instructions with similar template language for the 
new disclosure requirements for the provider directory.
    In addition, consistent with section 1852(d)(7)(B)(iii) of the Act, 
CMS is proposing to amend the heading of Sec.  422.111(k) to clarify 
that the paragraph addresses the Explanation of Benefits (EOB) and add 
Sec.  422.111(k)(6) to require that a notification about the cost 
sharing protection be included in the first EOB issued in a plan 
year.\9\ CMS proposes that the first EOB issued in a plan year for each 
specified MA plan would include a plain-language description of the 
provider directory cost sharing protections available to enrollees 
under Sec.  422.124; a toll-free telephone number and website URL 
through which an enrollee or their representative may request 
application of the protections, and information describing how an 
enrollee or their representative may request a correction if cost 
sharing was applied in a manner inconsistent with those protections. If 
Sec.  422.111(k)(6) is finalized as proposed, then CMS intends to 
update the EOB model document with template language, such as ``If you 
receive items or services from an out-of-network provider who was 
listed in your plan's provider directory as in-network on the date your 
appointment was made, and those services would otherwise be covered, 
your cost sharing is limited to the in-network cost sharing amount.'' 
In addition, CMS would update the Medicare Advantage and Section 1876 
Cost Plan Provider Directory Model and Instructions with similar 
template language regarding the enrollee cost sharing protections if 
Sec.  422.111(b)(12)(i) is finalized as proposed. CMS has also 
considered adding notification about the cost sharing protection in the 
Summary of Benefits (SB) as well as the Evidence of Coverage (EOC), as 
that would ensure that beneficiaries receive both pre-enrollment (via 
the SB) and post-enrollment (via the EOC) notification. CMS solicits 
comments on including the notification in these two additional 
materials.
---------------------------------------------------------------------------

    \9\ Sec.  422.2267(e)(2).
---------------------------------------------------------------------------

    Lastly, after reviewing all existing provider directory sections in 
the regulation, CMS believes that a conforming change to the provider 
directory API requirements at Sec.  422.120(b)(1) is necessary to 
ensure consistency in regulatory language. Currently, Sec.  
422.120(b)(1) requires that the API must provide a complete and 
accurate directory of the MA plan's network of contracted providers, 
including ``names, addresses, phone numbers, and specialties, updated 
no later than 30 calendar days after the MA organization receives 
provider directory information or updates to provider directory 
information.'' CMS proposes to amend Sec.  422.120(b)(1) to remove the 
references to names, addresses, phone numbers, specialties, and the 30-
day updating requirement, and replace this information with cross-
references to the proposed definition for provider directory 
information at Sec.  422.2 and the proposed provider directory 
verification and updating requirements at new proposed Sec.  422.123(b) 
and (c). This proposed modification simplifies the regulatory text, 
ensures consistency, and avoids the need to update regulatory language 
in multiple sections in the future. CMS believes that this change is 
also a productive step towards ensuring that the proposed definition of 
provider directory information at Sec.  422.2 is applied consistently 
to all formats of the provider directory (including the API) that an MA 
organization produces.
    In summary, CMS is proposing to codify the provider directory 
disclosure requirements at Sec.  422.111(b)(3)(i), (b)(12), and (k), 
and to make a conforming change to the provider directory API 
requirements at Sec.  422.120(b)(1). CMS solicits comments on these 
proposed changes.
12. Conclusion
    As discussed in section II.B. of this proposed rule, CMS believes 
that the accuracy scoring and verification framework required under the 
REAL Health Providers Act will serve to strengthen the integrity of the 
underlying provider data that both MPF and the NPD will likely come to 
depend upon, helping to ensure a consistent and reliable foundation for 
the larger health tech ecosystem. In addition, CMS recognizes that the 
data flow contemplated under this framework--in which MA organizations 
submit data to CMS, the NPD conceivably ingests that data and may 
enrich that data from additional sources, and MA organizations then 
publish NPD-informed directories--could raise questions about the 
appropriate scope of MA organization accountability for accuracy 
scores. CMS wishes to clarify that MA organization accountability under 
the REAL Health Providers Act as proposed herein attaches to the data 
the MA organization submits, verifies, and attests to, and to the rigor 
of the MA organization's own verification processes, rather than to 
data elements that may be added or modified by the NPD from sources 
outside the MA organization's control. MA organizations will retain an 
independent obligation under the REAL Health Providers Act to verify 
their provider directory information on the prescribed cycle as defined 
under Sec.  422.123(b), if finalized. In addition, as CMS's various 
provider directory initiatives mature, CMS anticipates a process that 
will allow MA organizations to reconcile any discrepancies between NPD-
returned data and their own verified records prior to publication if 
such discrepancies are identified. CMS will provide further guidance on 
the delineation of accountability between MA organization-originated 
and NPD-enriched data elements as the NPD infrastructure continues to 
be developed, implemented, and operationalized. This delineation of 
accountability approach could possibly include a safe-harbor component, 
as NPD infrastructure matures to be able to accept validated data 
programmatically from health care providers and organizations.
    CMS seeks comments on whether this proposed approach effectively 
integrates the REAL Health Providers Act requirements with the existing 
Sec.  422.111(m) framework and the developing NPD initiative in a way 
that is practical and achieves the statute's goals. CMS is particularly 
interested in

[[Page 66432]]

whether any conflicts or gaps exist among these three frameworks that 
this proposed implementation does not adequately address, and whether 
additional guidance is needed prior to the contract year 2028 effective 
date of the REAL Health Providers Act mandates. More broadly, CMS 
welcomes input on any aspects of provider directory accuracy, 
verification burden, data standardization, or beneficiary transparency 
that interested parties believe CMS has not fully considered, including 
potential specific mechanisms for an effective technology-based safe 
harbor that allows for the NPD to mediate accountability.

C. Modernizing and Ensuring PBM Accountability (Section 6224 of the 
Consolidated Appropriations Act, 2026)

1. Background
    Section 6224 of CAA (Pub. L. 119-75, enacted February 3, 2026) 
added sections 1860D-12(h) and 1857(f)(3) of the Act, which establish 
new and enhanced requirements under the Medicare Part D program that 
address, among other issues, compensation and data transparency for 
pharmacy benefit managers (PBMs). CMS is proposing to implement these 
requirements through this rulemaking.
    PBMs provide services such as drug price negotiation, prescription 
claims adjudication, formulary development, and pharmacy network 
contracting for insurance plans, including Part D plan sponsors that 
manage the Part D prescription drug benefit. Federal agencies, 
academics, and others have raised concerns that PBM business practices 
and corporate structure have contributed to the high cost of 
prescription drugs in the United States.\1\
---------------------------------------------------------------------------

    \1\ <a href="https://www.ftc.gov/reports/pharmacy-benefit-managers-report">https://www.ftc.gov/reports/pharmacy-benefit-managers-report</a>.
    \2\ <a href="https://www.ftc.gov/reports/pharmacy-benefit-managers-report">https://www.ftc.gov/reports/pharmacy-benefit-managers-report</a>.
    \3\ <a href="https://www.ftc.gov/reports/pharmacy-benefit-managers-report">https://www.ftc.gov/reports/pharmacy-benefit-managers-report</a>.
---------------------------------------------------------------------------

    In 2022, the Federal Trade Commission (FTC) issued special orders 
pursuant to section 6(b) of the Federal Trade Commission Act to the six 
largest PBMs to gather information about their business practices. 
After studying the information received, the FTC released two reports: 
a 2024 report titled ``Pharmacy Benefit Managers: The Powerful 
Middlemen Inflating Drug Costs and Squeezing Main Street Pharmacies'' 
and a 2025 report titled ``Specialty Generic Drugs: A Growing Profit 
Center for Vertically Integrated Pharmacy Benefit Managers.'' 
<SUP>10</SUP> These reports discussed several concerning aspects of the 
PBM industry, including a market featuring a high degree of 
concentration and vertical integration (with the three largest PBMs, 
which are integrated with both pharmacies and health plans, processing 
about 80 percent of prescription drug claims in the United States), 
higher payment rates for pharmacies that are affiliated with PBMs 
(especially specialty pharmacies) compared to unaffiliated pharmacies, 
opaque contract terms that disadvantage smaller and independent 
pharmacies, formulary placement decisions that favor higher-cost 
branded drugs over generics in exchange for higher rebates, and 
significant spread pricing in which PBMs retain a portion of the amount 
that a health plan pays the PBM for a drug rather than passing on the 
full amount to the pharmacy for specialty generics.
    The FTC reports also expressed concern with PBM-affiliated rebate 
aggregators, also referred to as PBM group purchasing organizations 
(PBM GPOs), which do not function as traditional GPOs but rather as 
spin-off entities to which PBMs have shifted the function of rebate 
negotiation with pharmaceutical manufacturers. There are three PBM GPOs 
in this category, affiliated with the three largest PBMs in the United 
States. The first FTC report <SUP>11</SUP> referenced previously 
discussed the recent formation of these entities--which the FTC noted 
likely occurred in an attempt to take advantage of the antikickback 
safe harbor for GPOs. The FTC issued supplemental orders to collect 
information from those three PBM GPOs in 2023 but noted in its second 
report that the PBM GPOs had provided only a partial response to these 
orders.\12\ While PBM GPOs themselves are relatively new, they are 
representative of a consistent pattern of utilization of complex 
affiliate structures and vertical and horizontal integration in the PBM 
industry and demonstrate PBMs' ability to adapt in the face of changing 
legislative and regulatory dynamics.
---------------------------------------------------------------------------

    \12\ <a href="https://www.ftc.gov/reports/specialty-generic-drugs-growing-profit-center-vertically-integrated-pharmacy-benefit-managers">https://www.ftc.gov/reports/specialty-generic-drugs-growing-profit-center-vertically-integrated-pharmacy-benefit-managers</a>
---------------------------------------------------------------------------

    Academics have similarly raised concerns with PBMs' impact on the 
price of drugs. Revenue retained by PBMs at several points in the 
pharmaceutical supply chain--including pharmacy spread pricing, 
retention of a portion of the rebate negotiated with the pharmaceutical 
manufacturer, and increasing ownership of 340B contract pharmacies--is 
often not transparent to health plans and may contribute to high drug 
prices.\13\ Because PBM compensation is often linked to the price of 
the drug, there are perverse incentives for PBMs to favor higher cost 
drugs; \14\ one recent article estimated that if compensation for 
wholesalers, pharmacies, and PBMs were delinked from list prices, net 
drug spending could be reduced by approximately 15 percent.\15\ As 
similarly noted by the FTC, the PBM market is also highly concentrated 
and vertically integrated; almost all major PBMs operate their own mail 
order or specialty pharmacies (and some retail pharmacies), and the 
largest health insurers in the country either own PBMs or share a 
common ownership structure with PBMs.\16\
---------------------------------------------------------------------------

    \13\ <a href="https://pmc.ncbi.nlm.nih.gov/articles/PMC11482839/">https://pmc.ncbi.nlm.nih.gov/articles/PMC11482839/</a>.
    \14\ <a href="https://www.commonwealthfund.org/publications/explainer/2025/mar/what-pharmacy-benefit-managers-do-how-they-contribute-drug-spending">https://www.commonwealthfund.org/publications/explainer/2025/mar/what-pharmacy-benefit-managers-do-how-they-contribute-drug-spending</a>.
    \15\ <a href="https://pmc.ncbi.nlm.nih.gov/articles/PMC12287691/pdf/qxaf126.pdf">https://pmc.ncbi.nlm.nih.gov/articles/PMC12287691/pdf/qxaf126.pdf</a>.
    \16\ <a href="https://www.brookings.edu/articles/a-brief-look-at-current-debates-about-pharmacy-benefit-managers/">https://www.brookings.edu/articles/a-brief-look-at-current-debates-about-pharmacy-benefit-managers/</a>.
---------------------------------------------------------------------------

    In addition to the reports that the FTC has issued following its 
issuance of 6(b) orders, the FTC has also filed lawsuits against the 
three largest PBMs and their affiliated PBM GPOs in September 2024, 
alleging that their rebating practices for insulin products were 
anticompetitive, unfair, and artificially inflated list prices. 
Specifically, the FTC claimed that PBMs gave insulin products with 
higher list prices favorable formulary placement due to the potential 
to extract and retain higher rebates and price-linked fees associated 
with such products, which caused pharmaceutical manufacturers to 
artificially inflate list prices and prevented patients from accessing 
insulin products with lower list prices and lower cost-sharing. The FTC 
reached settlements with two of the PBMs--Express Scripts, Inc. (ESI), 
announced in February 2026,\17\ and Caremark, announced in July 
2026.\18\ The proposed ESI consent order include requirements to 
prohibit formulary placement on the basis of wholesale acquisition cost 
(WAC) (also known as list price), to pass through rebates at the point 
of sale so that they will be incorporated into patient cost-sharing, to 
provide a standard offering to plan sponsors allowing them to 
transition away from rebate guarantees and spread pricing, to delink 
fees paid from

[[Page 66433]]

pharmaceutical manufacturers to PBM GPOs from drug prices, and to 
maintain PBM GPO activities in the United States (two of the three 
major PBM GPOs had been established off shore), among other 
requirements.\19\
---------------------------------------------------------------------------

    \17\ <a href="https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-secures-landmark-settlement-express-scripts-lower-drug-costs-american-patients">https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-secures-landmark-settlement-express-scripts-lower-drug-costs-american-patients</a>.
    \18\ <a href="https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-secures-major-settlement-caremark-resolving-antitrust-case-against-second-drug-middleman">https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-secures-major-settlement-caremark-resolving-antitrust-case-against-second-drug-middleman</a>.
    \19\ <a href="https://www.federalregister.gov/documents/2026/02/12/2026-02844/express-scripts-inc-et-al-analysis-of-agreement-containing-consent-order-to-aid-public-comment">https://www.federalregister.gov/documents/2026/02/12/2026-02844/express-scripts-inc-et-al-analysis-of-agreement-containing-consent-order-to-aid-public-comment</a>; <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/CaremarkandZinc-DecisionandOrder.pdf">https://www.ftc.gov/system/files/ftc_gov/pdf/CaremarkandZinc-DecisionandOrder.pdf</a>.
---------------------------------------------------------------------------

    CMS has already made some efforts to address PBM practices in 
Medicare. In the May 9, 2022, Federal Register (87 FR 27704), we 
addressed opaque performance-based penalties and price concessions from 
pharmacies that PBMs sometimes applied after the point of sale, 
preventing pharmacies from having access to predictable, transparent 
payment structures. CMS analysis showed that pharmacy price concessions 
grew more than 107,400 percent between 2010 and 2020. These practices 
rendered prescription drug prices less transparent and less 
representative of the actual amount the plan sponsor paid to the 
pharmacy for the drug dispensed. The new requirements, finalized in the 
final rule, ``Medicare Program; Contract Year 2023 Policy and Technical 
Changes to the Medicare Advantage and Medicare Prescription Drug 
Benefit Programs,'' restructured the financial relationship between 
plan sponsors, PBMs, and pharmacies by mandating transparency for all 
pharmacy price concessions at the point of sale.
    The new requirements changed the definition of the negotiated price 
for a covered Part D drug at 42 CFR 423.100 to include all pharmacy 
price concessions at the point of sale, and not just those that could 
be reasonably determined at the point of sale. Beginning in 2024, a 
patient's cost share is based on the lowest possible reimbursement that 
a pharmacy could receive for that drug. CMS has noted a significant 
decrease in plan-reported pharmacy price concessions. Pharmacy direct 
and indirect remuneration (DIR) changed from a positive amount in CY 
2023 (meaning Part D plan sponsors and PBMs recouped more from 
pharmacies in price concessions than they paid to pharmacies in bonus 
payments) to a negative amount in CY 2024 (meaning Part D plan sponsors 
and PBMs recouped less from pharmacies in price concessions than they 
paid to pharmacies in bonus payments).\20\ Pharmacy payment for covered 
Part D drugs is now more transparent and predictable for pharmacies.
---------------------------------------------------------------------------

    \20\ Internal CMS data.
---------------------------------------------------------------------------

    Section 6224 of the CAA builds on prior efforts to address PBM 
practices. The law introduces enhanced requirements for remuneration 
that PBMs may receive for services in connection with the utilization 
of covered Part D drugs. Generally, section 6224 of the CAA requires 
that such remuneration be restricted to bona fide service fees that may 
not be tied to the price of a drug or the rebates, discounts, or other 
price concessions negotiated. The law also introduces requirements for 
increased transparency, such as a new requirement for PBMs to report 
certain information such as drug prices and utilization, DIR, formulary 
placement of branded and generic drugs, information about payment rates 
at affiliated and unaffiliated pharmacies, and information on 
affiliates and brokers, to both Part D plan sponsors and the Secretary 
of Health and Human Services (HHS) annually. These requirements are to 
be effectuated through written agreements between Part D plan 
sponsors--inclusive of both sponsors offering standalone Part D 
prescription drug plans (PDPs) and sponsors offering Medicare Advantage 
prescription drug (MA-PD) plans that combine Medicare Advantage and 
Part D prescription drug benefits--and PBMs beginning with contract 
year 2028.
    An overview of the new requirements included in section 6224 of the 
CAA related to Part D plan sponsor contract requirements and federal 
oversight and enforcement mechanisms is provided later in this section, 
as well as a summary of the proposed policies that are required to 
implement this law. The remainder of this discussion is organized to 
address the major provisions of the law in more detail.
    <bullet> Section II.C.2. of this proposed rule defines key terms.
    <bullet> Section II.C.3. of this proposed rule discusses the 
definition of a pharmacy benefit manager.
    <bullet> Section II.C.4. of this proposed rule discusses the 
definition of an affiliate.
    <bullet> Sections II.C.5 through C.10. of this proposed rule 
discuss remuneration and transparency requirements of the written 
agreement between Part D plan sponsors and PBMs acting on behalf of 
such sponsors.
    <bullet> Section II.C.11. of this proposed rule addresses 
additional compliance and enforcement mechanisms available to Part D 
plan sponsors and CMS.
    <bullet> Section II.C.12. of this proposed rule addresses 
confidentiality of information shared under the new requirements of the 
CAA.
    <bullet> Section II.C.13. of this proposed rule addresses 
severability.
a. Overview of Part D Plan Sponsor Contract Requirements for Written 
Agreements With PBMs
    Section 6224 of the CAA amended section 1860D-12 of the Act by 
adding a new subsection (h)(1), which specifies that beginning with 
contract year 2028, any Part D plan sponsor with a contract under 
section 1860D-12 of the Act to offer a prescription drug plan must have 
a written agreement, containing certain requirements, with any PBM 
acting on its behalf. The requirements that must be in the written 
agreement with the PBM address remuneration derived by PBMs and their 
affiliates in connection with the utilization of Part D drugs, 
transparency regarding guarantees and cost performance evaluations, 
reporting of information by PBMs to Part D plan sponsors and the 
Secretary, and enforcement mechanisms provided to the Part D plan 
sponsor. We briefly describe each of the topics that the written 
agreement between the Part D plan sponsor and the PBM must address; 
each topic is addressed in greater detail in subsequent sections of 
this rule.
(1) Remuneration
    Section 1860D-12(h)(1)(A)(i) of the Act, as added by the CAA, 
generally requires that PBMs and any affiliates of such PBMs not derive 
any remuneration with respect to any services provided on behalf of any 
entity or individual, in connection with the utilization of covered 
Part D drugs, other than bona fide service fees. Included in the 
definition of bona fide service fees is that such fees must be flat 
dollar amounts, reflective of fair market value (as specified by the 
Secretary through notice and comment rulemaking), for an itemized 
service, and that they may not be contingent on the amount of rebates, 
discounts, fees, or other direct or indirect remuneration; drug price; 
coverage or formulary placement; and any other amounts or methodologies 
prohibited by the Secretary.
    There are certain exceptions to the requirement that PBMs and their 
affiliates only receive remuneration in the form of bona fide service 
fees. First, section 1860D-12(h)(1)(A)(ii) of the Act allows PBMs or 
their affiliates to receive incentive payments paid by a Part D plan 
sponsor if they meet certain requirements. Second, section 1860D-
12(h)(1)(A)(iii) of the Act provides that rebates, discounts, or other 
price concessions received by a PBM or an affiliate of a PBM from 
manufacturers are not considered a violation of the bona fide service 
fee requirement if they are fully passed through to a Part D plan

[[Page 66434]]

sponsor and are compliant with all regulatory and sub-regulatory 
requirements related to DIR for manufacturer rebates, discounts, and 
other price concessions. Third, these remuneration requirements do not 
prohibit flat dispensing fees or reimbursement or payment for 
ingredient costs to PBMs or affiliates of PBMs that acquire or dispense 
prescription drugs, nor do they modify regulatory requirements or sub-
regulatory program instruction or guidance related to pharmacy payment, 
reimbursement, or dispensing fees, in accordance with the rule of 
construction at section 1860D-12(h)(4) of the Act.
    Section 1860D-12(h)(1)(A)(iv) of the Act requires that components 
of subsets of remuneration agreements between PBMs or their affiliates 
and other entities involved in the dispensing or utilization of covered 
Part D drugs be subject to review by the Secretary, in consultation 
with the Office of the Inspector General of the Department of Health 
and Human Services, as determined appropriate by the Secretary, for 
consistency with fair market value. It also requires that the PBM 
disgorge any remuneration received by the PBM or its affiliate that is 
in violation of the requirements added by the CAA to the Part D plan 
sponsor.
(2) Transparency
    The CAA also introduces new requirements regarding transparency 
that must be reflected in the written agreements between Part D plan 
sponsors and PBMs. Part D plan sponsors must include in their written 
agreements with PBMs a requirement that PBMs ``define, interpret, and 
apply'' terms in a fully transparent and consistent manner for purposes 
of evaluating PBM performance against pricing guarantees or similar 
cost performance measurements. Pricing guarantees are agreements under 
which PBMs guarantee Part D plan sponsors a certain price for drugs--
often represented as a percent off list price for specific categories 
of drugs, such as brand, generic, or specialty drugs--and either retain 
or reimburse the Part D plan sponsor for the difference between that 
price and the actual price negotiated with a pharmacy. As discussed 
later in this rule, PBMs' interpretation of certain terms such as 
`generic' or `specialty' can significantly impact their ability to 
retain revenue through price guarantees.
    Section 1860D-12(h)(1)(C) of the Act, as added by the CAA, requires 
that PBMs annually submit a report to the Part D plan sponsor and the 
Secretary of HHS beginning no later than July 1 of 2028. This report is 
to include information on dispensed drugs covered by the plan, 
information about affiliate pharmacies, information on cost-sharing and 
formulary placement for reference listed drugs and reference products 
compared to their generic or biosimilar biological products, plan 
spending, PBM remuneration, benefit design parameters, information on 
brokers and consultants, and a list of affiliates.
    Finally, PBMs must also provide a written explanation of certain 
information to Part D plan sponsors within 30 days of finalization of a 
contract or agreement between the PBM or an affiliate of the PBM and a 
manufacturer that makes rebates, discounts, payments, or other 
financial incentives related to one or more covered Part D drugs or 
other prescription drugs, as applicable, directly or indirectly 
contingent upon coverage, formulary placement, or utilization 
management conditions on any other covered Part D drugs or other 
prescription drugs.
(3) Enforcement by the Part D Plan Sponsor
    In addition to the previous requirements, the CAA also requires 
that the written agreement between the Part D plan sponsor and PBM 
include certain mechanisms that the Part D plan sponsor may use to 
enforce the new requirements. Section 1860D-12(h)(1)(D) of the Act, as 
added by the CAA, requires that not less than once a year, at the 
request of the Part D plan sponsor, the PBM allow for an audit of the 
PBM to ensure compliance with all terms and conditions of the written 
agreement. Additionally, sections 1860D-12(h)(2)(A)(ii) and (iii) of 
the Act provide that the written agreement between the Part D plan 
sponsor and the PBM must require that the PBM or any affiliate of such 
PBM reimburse the Part D plan sponsor for any civil money penalty 
imposed on the Part D plan sponsor as a result of the failure of the 
PBM or affiliate to meet the requirements of section 1860D-12(h)(1) of 
the Act that are applicable to the PBM or affiliate, and must require 
in a written agreement with the PBM that the PBM or its affiliate be 
subject to punitive remedies for breach of contract for failure to 
comply with the requirements under section 1860D-12(h)(1) of the Act.
b. Overview of Federal Enforcement and Compliance Mechanisms
    Sections 1860D-12(h)(2) and (3) of the Act, as added by the CAA, 
introduce certain enforcement and compliance mechanisms related to 
section 1860D-12(h) of the Act. Section 1860D-12(h)(2)(A)(i) of the Act 
requires that each Part D plan sponsor shall disgorge to the Secretary 
any amounts disgorged to the Part D plan sponsor by a PBM due to 
violations of the remuneration requirements under section 1860D-
12(h)(1)(A) of the Act. Additionally, section 1860D-12(h)(2)(B) of the 
Act specifies that the Secretary shall make available and maintain a 
mechanism for manufacturers, Part D plan sponsors, pharmacies, and 
other entities that have contractual relationships with PBMs or their 
affiliates to report, on a confidential basis, alleged violations of 
section 1860D-12(h)(1)(A) or (C) of the Act to the Secretary. Section 
1860D-12(h)(2)(C) of the Act requires that a Part D plan sponsor shall 
not retaliate against an individual or entity for such reporting of an 
alleged violation, nor coerce, intimidate, threaten, or interfere with 
the ability of an individual or entity to report any such alleged 
violations. In addition, section 1860D-12(h)(3) of the Act requires 
that each Part D plan sponsor furnish to the Secretary an annual 
certification of compliance with section 1860D-12(h) of the Act, as 
well as information the Secretary determines necessary to carry out 
section 1860D-12(h) of the Act; the Secretary may implement this 
requirement by program instruction.
c. Summary of Proposed Policies Related to Section 6224 of the CAA
    CMS is proposing to implement section 1860D-12(h) of the Act as 
follows:
    <bullet> Proposed Sec.  423.2800 establishes the basis and scope of 
the new subpart BB, titled ``Modernizing and Ensuring Pharmacy Benefit 
Manager Accountability.''
    <bullet> Proposed Sec.  423.2802 defines several key terms that are 
set forth in the statute and warrant additional definition to 
effectively implement the law and clearly delineate its applicability.
    <bullet> Proposed Sec. Sec.  423.2804 and 423.2806 provide further 
detail on the definitions of PBM and affiliate.
    <bullet> Proposed Sec.  423.2808 describes the contractual 
requirements for Part D plan sponsors, further described in subsequent 
sections.
    <bullet> Proposed Sec.  423.2810 addresses requirements related to 
remuneration, including specifying fair market value for bona fide 
service fees and incentive payments.
    <bullet> Proposed Sec.  423.2812 establishes requirements for PBMs 
to provide transparency regarding guarantees and cost performance 
evaluations.

[[Page 66435]]

    <bullet> Proposed Sec.  423.2814 establishes requirements for PBMs 
to report information to Part D plan sponsors and the Secretary 
annually, beginning no later than July 1, 2028, and further defines 
certain terms related to such reporting.
    <bullet> Proposed Sec. Sec.  423.2810, 423.2816, 423.2818, and 
423.2820 address requirements for compliance and enforcement mechanisms 
to be used by both Part D plan sponsors (such as audit rights) and CMS 
(such as annual requirements for Part D plan sponsor certifications of 
compliance and disgorgement of fees in violation of the remuneration 
requirements established at proposed Sec.  423.2810).
    <bullet> Proposed Sec.  423.2822 addresses confidentiality and use 
of information disclosed by PBMs or their affiliates to Part D plan 
sponsors or CMS.
    We published a request for information (RFI) on Pharmacy Benefit 
Manager Compensation and Data Collection on June 18, 2026 (91 FR 36776) 
to solicit technical input on the services and business practices of 
PBMs and their affiliates to inform this rulemaking.\21\ The comments 
that we received in response to that RFI informed the proposals in this 
rule, and we thank commenters for their input.
---------------------------------------------------------------------------

    \21\ <a href="https://www.federalregister.gov/documents/2026/06/18/2026-12344/request-for-information-rfi-pharmacy-benefit-manager-compensation-and-data-collection">https://www.federalregister.gov/documents/2026/06/18/2026-12344/request-for-information-rfi-pharmacy-benefit-manager-compensation-and-data-collection</a>.
---------------------------------------------------------------------------

2. Definitions
    In this proposed rule, CMS proposes to codify the definitions of 
terms consistent with the meanings given in section 1860D-12(h) of the 
Act. At proposed Sec.  423.2802, CMS proposes definitions for the 
following terms in section 1847A of the Act that are discussed in 
greater detail in subsequent sections of this proposed rule:
    <bullet> Affiliate, discussed in section II.C.4. of this proposed 
rule.
    <bullet> Bona fide service fee, discussed in section II.C.6. of 
this proposed rule.
    <bullet> Fair market value, discussed in section II.C.6. of 
proposed rule.
    <bullet> Fully passed through, discussed in section II.C.6. of this 
proposed rule.
    <bullet> Incentive payment, discussed in section II.C.6. of this 
proposed rule.
    <bullet> Intermediary, discussed in section II.C.3. of this 
proposed rule.
    <bullet> Pharmacy benefit manager (PBM), discussed in section 
II.C.3. of this proposed rule.
    <bullet> PBM function, discussed in section II.C.3. of this 
proposed rule.
    <bullet> Related service, discussed in section II.C.3. of this 
proposed rule.
    <bullet> Remuneration, discussed in section II.C.6. of this 
proposed rule.
3. Pharmacy Benefit Manager (PBM)
    Section 1860D-12(h)(7)(C) of the Act defines a PBM as ``any person 
or entity that, either directly or through an intermediary, acts as a 
price negotiator or group purchaser on behalf of a PDP sponsor or 
prescription drug plan, or manages the prescription drug benefits 
provided by such sponsor or plan, including the processing and payment 
of claims for prescription drugs, the performance of drug utilization 
review, the processing of drug prior authorization requests, the 
adjudication of appeals or grievances related to the prescription drug 
benefit, contracting with network pharmacies, controlling the cost of 
covered Part D drugs, or the provision of related services. Such term 
includes any person or entity that carries out one or more of the 
activities described in the preceding sentence, irrespective of whether 
such person or entity calls itself a 'pharmacy benefit manager.' ''
    This definition is functional in nature. An entity may qualify as a 
PBM based on the activities it performs, regardless of how it describes 
itself. The Act identifies the functions of a PBM as including the 
processing and payment of prescription drug claims, drug utilization 
review, processing of prior authorization requests, adjudication of 
appeals or grievances related to the prescription drug benefit, 
contracting with network pharmacies, controlling the cost of covered 
Part D drugs, and the provision of related services, but does not limit 
the scope of the PBM definition to the persons and entities that engage 
in those activities. In addition, a person or entity may qualify as a 
PBM even if it carries out these functions indirectly through an 
intermediary.
    Determining whether a particular entity is: (1) a PBM; (2) an 
affiliate as defined in section 1860D-12(h)(7)(A) of the Act and 
discussed in section II.C.4. of this proposed rule; or (3) neither is 
necessary to establish the entity's obligations under section 1860D-
12(h) of the Act.
    Specifically, a PBM--but not an affiliate--must have a written 
agreement with the Part D plan sponsor under which the PBM and its 
affiliates agree to satisfy certain requirements as specified in 
section 1860D-12(h) of the Act. The PBM--but not its affiliates--also 
bears responsibility, under its statutorily required contractual 
arrangement with the Part D plan sponsor, for submitting an annual 
report to the Part D plan sponsor and the Secretary under section 
1860D-12(h)(1)(C)(i) of the Act, as discussed in section II.C.8. of 
this proposed rule Although an affiliate may hold information that must 
be reported, the affiliate is not responsible for submitting that 
information directly to the Part D plan sponsor or the Secretary.
    The PBM also has audit-related obligations under its contractual 
arrangement with the Part D plan sponsor, as required by section 1860D-
12(h)(1)(D) of the Act. The PBM must allow an annual audit at the 
request of the Part D plan sponsor and must provide relevant records, 
data, contracts, and other information requested by the Part D plan 
sponsor. Although an affiliate's records may be produced during an 
audit, the PBM is responsible for providing information held by its 
affiliates to the Part D plan sponsor.
    Under the contractual requirements mandated by section 1860D-
12(h)(1)(B)(i) through (iii) of the Act, a PBM is further responsible 
for defining, interpreting, and applying pricing guarantee and cost-
performance terms transparently and consistently; identifying 
exclusions; and providing WAC-based equivalents when required. These 
responsibilities are not imposed directly on affiliates.
    Finally, pursuant to the contractual requirements mandated by 
section 1860D-12(h)(1)(A)(vi)(I) of the Act, a PBM must enter into 
written agreements with its affiliates requiring them to identify and 
disgorge impermissible remuneration and must attest that it has entered 
into those agreements.
(i) Contract Requirement
    As a threshold matter, an entity qualifies as a PBM under section 
1860D-12(h)(7)(C) of the Act if it: (1) directly, or through an 
intermediary, performs at least one PBM function; and (2) performs that 
function on behalf of a Part D plan sponsor or prescription drug plan. 
Separately, section 1860D-12(h)(7)(A) of the Act defines an 
``affiliate''--with respect to any PBM or Part D plan sponsor--to 
include any entity that, directly or indirectly, acts as a contractor, 
principal, or agent to such PBM or Part D plan sponsor insofar as it 
performs any of the functions described in 1860D-12(h)(7)(C) of the 
Act.
    These two definitions create a potential overlap. Absent 
clarification, a contractor or agent of a PBM that performs one or more 
PBM functions could simultaneously be considered to: (1) qualify as a 
PBM in its own right under subparagraph (C) because it performs PBM 
functions and the definition captures entities performing even a single 
such function regardless of

[[Page 66436]]

self-identification; and (2) qualify as an affiliate of the contracting 
PBM under subparagraph (A)(ii) because it is acting as a contractor 
performing those same functions. For example, based solely on the 
requirements related to the performance of PBM functions, a third-party 
claims processor retained by a PBM to process Part D prescription drug 
claims for a Part D plan sponsor could qualify as a PBM under 
subparagraph (C) because it performs a PBM function on behalf of a Part 
D plan sponsor, while also qualifying as an affiliate under 
subparagraph (A)(ii) because it performs that function as the PBM's 
contractor.
    Section 1860D-12(h)(1) of the Act also establishes a general rule 
that any contract entered into with a Part D plan sponsor under this 
part with respect to a prescription drug plan offered by such sponsor 
must provide that any PBM acting on behalf of such sponsor has a 
written agreement with the Part D plan sponsor under which the PBM 
agrees to certain requirements as specified in section 1860D-12(h) of 
the Act.
    Based on this statutory structure, we propose to clarify that an 
entity qualifies as a PBM only if it holds a written agreement with a 
Part D plan sponsor, either directly or through a parent organization 
of such Part D plan sponsor. We believe this clarification resolves the 
definitional overlap between PBMs and their affiliates and is 
consistent with the Act's requirement of a contractual relationship 
between a PBM and a Part D plan sponsor. We intend that this proposed 
requirement for a written agreement between a PBM and the Part D plan 
sponsor can be met by an agreement between the PBM and the parent 
organization of the Part D plan sponsor to account for instances in 
which the parent organization possesses delegated contracting authority 
for subsidiary Part D plan sponsors. We note that our proposal to allow 
for a Part D plan sponsor to meet its obligation to have a written 
agreement under section 1860D-12(h)(1) of the Act through its parent 
organization is consistent with the implementation of section 1860D-
12(b)(1) of the Act, under which a Part D plan sponsor may also meet 
its contract requirements through a written agreement by its parent 
organization when the parent organization has a legally enforceable 
delegation of Part D plan sponsor's contracting authority (see, for 
example, 42 CFR 423.503(a)(3) and 423.504(b)(8)).
    Accordingly, we propose to establish at 42 CFR 423.2804(a) a 
general rule for PBM status. An entity would qualify as a PBM, 
regardless of how it describes itself, if: (1) the entity has a written 
contract with the Part D plan sponsor, either directly or through a 
parent organization of such Part D plan sponsor; and (2) the entity, 
directly or through an intermediary, performs at least one PBM function 
on behalf of a Part D plan sponsor or prescription drug plan with which 
it has such written contract.
    We solicit comment on this proposal.
(ii) Related Services and PBM Functions
    As described earlier in this section, a PBM is any person or entity 
that acts as a price negotiator or group purchaser on behalf of a Part 
D plan sponsor or prescription drug plan, or that manages the 
prescription drug benefits provided by such a sponsor or plan. Section 
1860D-12(h)(7)(C) of the Act identifies the functions of a PBM as 
including the processing and payment of prescription drug claims, drug 
utilization review, processing of prior authorization requ

[…truncated; see source link]