On November 13, 2020, the Centers for Medicare & Medicaid Services (“CMS”) published a final rule, demonstrating long-awaited efforts to streamline the regulatory framework governing the Medicaid and Children’s Health Insurance Program (“CHIP”) managed care programs.

According to CMS, the purpose of the final rule is to relax certain administrative burdens imposed by the Medicaid managed care rule promulgated by the Obama Administration in 2016. The 2016 rule (the “Mega Reg”), reflecting efforts to modernize the Medicaid and CHIP managed care programs and frustrate widespread fraud and abuse, was the first update to Medicaid managed care regulations in more than a decade.  The following blog post presents a brief summary of the final rule’s key changes.

  • Standard Contract Requirements/Coordination of Benefits
  • Actuarial Soundness
  • Risk-sharing Mechanisms
  • State-directed Payments
  • Pass-through Payments
  • Information Accessibility Requirements
  • Network Adequacy Standards
  • Quality Rating System
  • Grievance and Appeals

This rule became effective on December 14, 2020, with the exception of the provisions relating to actuarial soundness standards (§ 438.4(c)) and pass-through payments (§438.6(d)(6)), which are effective July 1, 2021. Thus far, the Biden Administration has given no indication that it will look to revisit any of the new changes imposed by the final rule. It is also possible—though unlikely—that the final rule will be blocked by Congress under the Congressional Review Act.

Standard Contract Requirements/Coordination of Benefits

The Mega Reg required contracts with a managed care organization (MCO), prepaid inpatient health plan (PIHP), or prepaid ambulatory health plan (PAHP) that cover Medicare-Medicaid dually eligible enrollees to provide that the MCO, PIHP, or PAHP sign a Coordination of Benefits Agreement (COBA) and participate in the automated crossover claim process administered by Medicare.

The final rule allows the states to determine the coordination of benefits method that best meets the needs of their program. CMS removed the requirement that managed care plans must enter into a COBA directly with Medicare and instead requires a state’s contracts with managed care plans to specify the methodology by which the state ensures that the managed care plans receive all appropriate crossover claims for which they are responsible. If a state elects to utilize a methodology that does not require managed care plans to enter into a COBA with Medicare, the remittance advice used by the state must indicate that the state has not denied payment, but instead that the claim has been sent to the MCO, PIHP, or PAHP for payment consideration.

Actuarial Soundness

The Mega Reg required states to develop and certify as actuarially sound each individual rate paid for each enrollee category (i.e., per rate cell) covered by the Medicaid managed care plan, with enough detail to understand the specific data, assumptions, and methodologies behind each rate. The final rule instead provides states the option to develop and certify as actuarially sound a range of capitation rates per enrollee category, subject to specific limits.

CMS acknowledged widespread fiscal and program integrity concerns with the use of rate ranges in Medicaid managed care, but explained that this change was a “critical flexibility to reduce administrative burden.” Indeed, the Mega Reg had garnered criticism from stakeholders that the requirement to certify a capitation rate per rate cell, rather than to certify a rate range, had the potential to diminish states’ ability to obtain the best rates when contracts are procured through competitive bidding.

Importantly, the final rule does include comprehensive guardrails around the use of rate ranges, including some of the following parameters:

  • The upper and lower bounds of the rate range must be certified as actuarially sound, providing for all reasonable, appropriate, and attainable costs that are required under the terms of the contract and for the operation of the managed care plan for the time period and the population covered under the terms of the contract.
  • States using rate ranges must document the criteria for paying managed care plans at different points within the rate range and must document the capitation rates prior to the start of the rating period.
  • During the contract year, states are permitted to make changes (increases or decreases) to the capitation rates within the rate range up to 1 percent during the rating period without submission of a new rate certification. That is, only modification to the capitation rates within the rate range greater than +/- 1 percent will require states to provide a revised rate certification for CMS approval.
  • States cannot take into consideration the existence of, or amount of funding provided under, intergovernmental transfer agreements in determining payment of managed care plans at different points within the rate range.
  • Prior to executing a managed care contract or contract amendment that includes or modifies a rate range, states must post on a public website:
    • The upper and lower bounds of each rate cell;
    • A description of all assumptions that vary between the upper and lower bounds of each rate cell, including for the assumptions that vary, the specific assumptions used for the upper and lower bounds of each rate cell; and
    • A description of the data and methodologies that vary between the upper and lower bounds of each rate cell, including for the data and methodologies that vary, the specific data and methodologies used for the upper and lower bounds of each rate cell.

Ultimately, while CMS believes the final rule strikes the appropriate balance between prudent fiscal and program integrity and state flexibility, it noted that its approach “may reintroduce undue risk in Medicaid rate-setting.” States that elect to adopt rate ranges must comply with these requirements beginning July 1, 2021.

Risk-Sharing Mechanisms

Under the final rule, all risk-sharing mechanisms used in the payment arrangement between the state and an MCO, PIHP, or PAHP must be documented in the contract and rate certification documents prior to the start of the rating period. Risk-sharing mechanisms refer to any and all mechanisms or arrangements that have the effect of sharing risk between the MCO, PIHP, or PAHP, and the state on an aggregate level, and includes, for example, reinsurance, risk corridors, stop loss limits, and a risk mitigation strategy. CMS explained that because risk-sharing mechanisms “are intended to address the uncertainty inherent in setting capitation rates prospectively,” states should develop risk-sharing requirements prior to the start of the rating period. This means that states will be prohibited from retroactively adding or modifying risk-sharing mechanisms after the start of the rating period as some states had done via retroactive contract amendments. Notably, the final rule does not foreclose retroactive adjustments to capitation rates when appropriate, assuming other statutory requirements are satisfied.

State-Directed Payments

The final rule allows states to require managed care plans to adopt payment models based on a state plan approved FFS schedule without having to receive written approval from CMS and to provide for the approval of multi-year payment arrangements when specified criteria are met. The criteria are that the state has: (1) explicitly identified and described the payment arrangement in the contract as a multi-year payment arrangement, including a description of the payment arrangement by year, if the payment arrangement varies by year; (2) developed and described its plan for implementing a multi-year payment arrangement, including the state’s plan for multi-year evaluation, and the impact of a multi-year payment arrangement on the state’s goal(s) and objective(s) in the state’s quality strategy in § 438.340; and (3) affirmed that it will not make any changes to the payment methodology, or magnitude of the payment, described in the contract for all years of the multi-year payment arrangement without our prior approval.

Pass-Through Payments

In a continued effort to limit state direction of payments from managed care plans to providers, the final rule permits states to make pass-through payments under new managed care contracts only during a three-year transition period from FFS payments and if certain criteria are met. Pass-through payments are amounts required by the states to be added to the contracted payment rates paid by managed care organizations that are not tied to the delivery of services.

CMS has recognized that pass-through payments reduce managed care plans’ ability to control expenditures, to implement provider-based quality initiatives, and generally to use the full capitation payment to manage the care of enrollees. CMS views pass-through payments as inconsistent with the regulatory standards for actuarially sounds rates because the payments do not tie provider reimbursement to the provision of services to Medicaid beneficiaries.

On the other hand, CMS also acknowledges that some states would like to continue to make supplemental payments to providers as they transition services and populations from FFS delivery to managed care. Commenters noted that pass-through payments are helpful in preventing abrupt reductions in services or access to providers because of the lack of FFS supplemental payments, which have been critical for ensuring that safety-net providers remain profitable enough to continue to treat their patients. Commenters also pointed out that states have long used these payments to combat provider shortages in areas of need by increasing reimbursement for providers who accept a proportionally large number of Medicaid patients.

The final rule is meant to be a compromise between these two considerations. Specifically, the rule permits states transitioning Medicaid populations or services from an FFS delivery system to a managed care program to require managed care plans to make pass-through payments for up to three years at an aggregate amount that is less than or equal to their current upper payment limit payments under FFS. The rule is limited to hospitals, physicians, and nursing facilities, as these are the most common provider types for which states made the majority of supplemental payments, and these are the provider types for which states have typically sought to continue making payments as pass-through payments under managed care programs. The provision will take effect with rating periods beginning on or after July 1, 2021.

Information Accessibility Requirements

The final rule adopts several changes to information accessibility requirements, including:

  • Deleting the definition of large print (no smaller than 18-point) in § 438.10(d)(2) and adopting the “conspicuously visible” standard for taglines that is codified at 45 C.F.R. § 92.8(f)(1).
  • Replacing the requirement to include taglines on “all written materials” with a requirement for taglines only on materials for potential enrollees that “are critical to obtaining services” in § 438.10(d)(2).
  • Changing the requirement at § 438.10(f)(1) that managed care plans issue notices within 15 calendar days after receipt or issuance of the termination notice to the later of 30 calendar days prior to the effective date of the termination or 15 calendar days after the receipt or issuance of the notice.
  • Requiring information in a directory to include a provider’s cultural and linguistic capabilities, including the languages spoken by the provider or by the skilled medical interpreter providing interpretation, to align with the new standards for provider directories in FFS Medicaid.
  • Modifying the requirements for updating a paper provider directory to permit quarterly updates if the managed care plan offers a mobile-enabled directory. If the plan does not offer a mobile-enabled directory, the plan would still be required to update the paper provider directory monthly.

Network Adequacy Standards

The Mega Reg required states to develop time and distance network adequacy standards for specialist, adult, and pediatric providers. The final rule removes the requirement that states set time and distance standards and replaces it with a more flexible requirement that states merely set a quantitative network adequacy standard. The rule explains that the quantitative standards that states may elect to use include, but are not limited to: (1) minimum provider-to-enrollee ratios, (2) a minimum percentage of contracted providers that are accepting new patients, (3) maximum wait times for an appointment, (4) hours of operation requirements (for example, extended evening or weekend hours), and (5) maximum travel time or distance to providers. CMS encourages states to use the quantitative standards in combination to ensure that there are not gaps in access to, and availability of, services for enrollees.

CMS recognized that in some situations, time and distance may not be the most effective type of standard for determining network adequacy and do not accurately reflect provider availability. For example, a state that has a heavy reliance on telehealth in certain areas may find that a provider-to-enrollee ratio is more useful in measuring access, as the enrollee could be well beyond a time and distance standard, but can still access many different providers virtually. CMS recognized that states are in the best position to set specific quantitative standards that reflect the scope of their programs, the populations served, and the unique demographics and characteristics of each state.

Many commenters disagreed with the proposal to delete the requirement for states to set time and distance standards, noting that the current requirements already provide states with adequate flexibility and are necessary to avoid narrowing existing networks. In response, CMS noted that time and distance analysis may not always produce results that accurately reflect provider availability within a network, and that the new rule enables states to choose from a variety of quantitative network adequacy measures that meet the needs of their respective programs in more meaningful and effective ways. It acknowledged that providing states this level of flexibility could result in widely varied standards, but stated that given the diversity and complexity of Medicaid managed care programs, such variation may be warranted.

Many commenters expressed concern with what they perceived to be CMS’s rationale for the new rule—the availability of telehealth decreasing the efficacy of time and distance requirements. Commenters noted that telehealth cannot offer the full array of services that are otherwise available to a patient who is physically present in a provider’s office, and that states should be required to maintain network adequacy standards for traditional service delivery. In response, CMS clarified that it was not its intent to imply that telehealth offers the full array of services otherwise available to a patient physically present in a provider’s office. It merely used telehealth as an example of a situation in which measuring access using time and distance metrics may not effectively evaluate the adequacy of a provider network. CMS clarified that states need to balance the use of telehealth with the availability of providers that can provide in-person care, in addition to enrollees’ preferences for receiving care, in establishing appropriate network adequacy standards.

The Mega Reg also required states to establish time and distance standards for “additional provider types when it promotes the objectives of the Medicaid program, as determined by CMS.” Since the 2016 rule was published, states have expressed concern that if CMS relies on this authority and flexibility to identify “additional provider types,” managed care plans may have to assess network adequacy, and possibly build network capacity, without sufficient time. Based on this state input, CMS removed this requirement from the final rule.

Some commenters disagreed with the proposal to eliminate the requirement that states establish time and distance standards for “additional provider types when it promotes the objectives of the Medicaid program, as determined by CMS.” Commenters reasoned that the Mega Reg requirement gives CMS an efficient way to address changes in Medicaid benefits, workforce shortages, or concerns regarding access to care without engaging in the rulemaking process, which could impair CMS’s ability to respond to emergent concerns. CMS responded that designating additional provider types subject to network adequacy analysis is a state responsibility, not a federal one. CMS noted that it considered proposing a specific timeline for advance notice by CMS in identifying additional provider types subject to network adequacy standards, but ultimately concluded that that approach was inconsistent with the overall goal and purpose of the new rule—to give states more flexibility in managing their Medicaid programs.

Quality Rating System

The Mega Reg required states to operate a Medicaid managed care quality rating system (“QRS”). It also provided that CMS would develop a Medicaid managed care QRS. States have the option to use the CMS-developed QRS or establish an alternative state-specific QRS, provided that the state alternative QRS produces substantially comparable information about plan performance as the CMS-developed QRS. The final rule makes explicit CMS’s intention to take feasibility into consideration when assessing whether a state alternative QRS produces substantially comparable information to that yielded by the CMS-developed QRS. Moreover, the final rule makes explicit that CMS will engage with states and other stakeholders in developing sub-regulatory guidance on what it means for a state alternative QRS to yield substantially comparable information, and how a state would demonstrate it meets that standard.

In an effort to better balance the goal of facilitating inter-state comparisons of plan performance and the need for state flexibility in measuring plan performance, CMS revised the QRS section of the rule to add a requirement that CMS develop, as part of its QRS framework, a set of mandatory minimum performance measures that states are required to evaluate, whether a state chooses to implement the CMS-developed QRS or a state-alternative QRS. States retain flexibility to include additional quality measures aimed at serving their specific quality goals and meeting the needs of their beneficiaries. Many commenters supported the establishment of mandatory minimum measures, noting that this will reduce administrative burden and allow for more easily comparable data across states.

The final rule also provides that the CMS-developed QRS and the mandatory minimum set of quality measures will align with the Medicaid Scorecard initiative, the Qualified Health Plan (“QHP”) quality rating system, the Medicare Advantage 5-Star Rating system, and other CMS managed care rating systems, as appropriate. Many commenters expressed concern with aligning the CMS-developed QRS with other CMS managed care rating systems, given the different populations that Medicaid programs serve, as compared to Medicare and QHP programs. These commenters noted that there could be large measurement gaps for key Medicaid populations, such as adults and children with disabilities, pregnant women and newborns, and persons receiving long term services and supports. CMS responded that while the rule calls for alignment with other related CMS quality rating approaches, this does not mean alignment in all aspects, and that differences would be appropriate, for example, to address the different populations and services covered by Medicaid.

Grievance and Appeals

The final rule makes several changes related to the grievance and appeal system. First, CMS revised the definition of “adverse benefit determination” in § 438.400(b) to specify that a denial, in whole or in part, of a payment for a service because the claim does not meet the definition of a clean claim at § 447.45(b) is not an adverse benefit determination. Section 447.45(b) defines “clean claim” as one that can be processed without obtaining additional information from the provider of the services or from a third party, and includes a claim with errors originating in a State’s claims system. With this change, the final rule alleviates the requirement for managed care plans to generate a notice of an adverse benefit determination when the denial of payment was made for purely administrative reasons and generates no financial liability for the enrollee.

Second, the final rule eliminates the requirement for enrollees to submit a written, signed appeal after an oral appeal is submitted. CMS based this change on the belief that the removal of the requirement would reduce barriers for enrollees who would not have to write, sign, and submit the appeal, would enable plans to resolve appeals more quickly, and would decrease the economic and administrative burden on plans.

Finally, the final rule changed the timeframe for managed care enrollees to request a state fair hearing from 120 calendar days to no less than 90 calendar days and no more than 120 calendar days. The specific deadlines in this range are to be decided by the states. CMS contends that this revision will allow states that wish to align managed care with the FFS filing timeframe to do so without jeopardizing the enrollee’s ability to gather information and prepare for a state hearing.