Medicaid Managed Care Regulation (HCFA-2001-F)
Summary of Major Sections
Subpart A -- General Provisions
Contract Requirements
This section includes most of the existing managed care provisions currently found in part 434, revised to reflect changes made by the BBA, and contains the general requirements for Managed Care Organizations (MCO), Prepaid Health Plans (PHP), and Primary Care Case Management (PCCM) contracts. The regulation sets forth requirements for state ratesetting methodologies. In addition, we are applying special rules to incentive arrangements and risk corridors (e.g., the incentive arrangement or risk corridor must not be conditioned on intergovernmental transfer agreements and limit the extent to which States can claim FFP under these arrangements). The rate setting provision is being published as a final rule with a 60-day comment period. After considering comments received, HCFA will publish a final rule for this provision.
Changes from the Proposed Regulation
The final rule clarifies HCFA’s authority to review and approve all MCO and PHP contracts, including those not subject to the prior approval requirement in ' 438.806, consistent with current practice. We also include as final rule with comment period a provision to eliminate the upper payment limit requirement and replace it with new provisions governing managed care rate setting. States will be required to document the actuarial basis for their rates and how they have applied various adjustments to these rates (e.g. risk adjustment). FFP would not be allowed for amounts in excess of 105 percent of the approved capitation rates for that portion of the services or enrollees covered under the contract to which the arrangement applies. However, States may use their own funds for this purpose. Taken together, these provisions will replace the current upper payment limit.
Provisions that Apply to PHPs
This section designates those provisions of the regulation that apply risk bearing capitated plans that do not provide a comprehensive service package, called Prepaid Health Plans. These include most of the contracting requirements for MCOs, the information provisions; enrollee protections; and quality protocols, including grievance and appeals. In addition, for clarity, we are specifying which provisions of the rule apply to PHPs within each applicable section of the regulation.
Changes from the Proposed Regulation
The final rule extends the following additional MCO requirements to PHPs: physician incentive plan requirements; advance directive requirements (except where the limited scope of services would make this requirement inappropriate); and certification and program integrity requirements.
Information Requirements
In mandatory managed care programs, enrollees must be fully informed of the choices available to them in enrolling with an MCO, PHP or PCCM. The requirements under this provision describe the kind of information that must be made available to enrollees and potential enrollees. It also requires that this information, and all enrollment notices and instructional materials related to enrollment in an MCO, PHP or PCCM be in a format which can be easily understood by the individuals to whom they are directed.
Changes from the Proposed Regulation
States must identify non-English languages spoken by enrollees and potential enrollees and make available materials in non-English languages where necessary for effective communication with significant numbers of enrollees or potential enrollees. States, MCOs and PHPs must have mechanisms in place to assist enrollees and potential enrollees with special needs to understand the managed care system and the benefits of their plan. The final rule clarifies when these requirements apply to PHPs.
Provider Discrimination
MCOs and PHPs are prohibited from arbitrarily discriminating with respect to participation, reimbursement, or indemnification against any health care professional solely on the basis of his or her license or certification. This requirement does not prohibit an organization from including providers only to the extent necessary to meet the needs of the MCO=s and PHP’s enrollees, from establishing measures designed to maintain quality and control costs consistent with the responsibilities of the MCO or PHP. In other words, an MCO or PHP may exclude providers for legitimate business or quality reasons.
Changes from the Proposed Regulation
The final rule clarifies that MCOs and PHPs are not precluded from paying different reimbursement amounts for the same specialty.
Subpart B -- State Responsibilities
State Plan Amendment (SPA) Programs for Managed Care
This provision permits States to create a mandatory managed care program without a waiver. Certain groups of individuals, such as dual Medicare/Medicaid eligibles, Native Americans (where IHS, Tribal or urban Indian providers are not part of the managed care network), and specific groups of special needs children are exempted from mandatory participation in these programs.
Changes from the Proposed Regulation
States must provide a description of how the public will be involved in the design and implementation of the SPA and the method for ensuring ongoing public involvement. The final rule clarifies that the provisions in this section do not apply to programs operating under the waiver authority in sections 1915(b) or 1115 of the Act.
Choice of Managed Care Entities
This section requires States to give potential enrollees a choice of two or more MCOs, PHPs, or PCCMs, although exceptions are granted for Health Insuring Organizations (HIOs) and rural areas. The rural exception to the choice requirement permits States to offer only one MCO, PHP, or PCCM in rural areas under certain conditions, including that at least two physicians or case managers be available for selection by the enrollee. In addition, the BBA required that individuals in these programs be permitted to receive services outside of their MCO, PHP, or PCCM under Aappropriate circumstances," as defined in the regulation. In the final rule, we only permit the State to use the MSA definition found in 412.62(f)(1)(ii)).
Changes from the Proposed Regulation
In the proposed rule, we invited comments on how to define "rural" for purposes of this provision. In the final rule we selected one definition for rural area. The final rule also permits enrollees in rural areas needing more than one service to go out of network to receive these services at the same time if one is not available in the network (such as a cesarean section and a tubal ligation) and if receiving the services separately would subject the enrollee to unnecessary risk.
Enrollment: Requirements and Limitations
This provision specifies that States may choose a lock-in period of up to 12 months. Enrollees retain the right to change MCO, PHP, or PCCM during the first 90 days of enrollment and at any time Afor cause@. We specify several instances that constitute Acause@ for purposes of disenrollment, including if the enrollee was homeless or a migrant worker at the time of default enrollment, if the plan does not (because of moral or religious objections) cover the services the enrollee seeks, and if the enrollee needs related services at the same time (e.g., cesarean section and tubal ligation). States may specify other Afor cause@ situations. And enrollees may seek disenrollment Afor cause@ based on individual circumstances.
Changes from the Proposed Regulation
The final rule specifies conditions under which an MCO, PHP, or PCCM may request
disenrollment of an enrollee and clarifies when an enrollee may request disenrollment without cause.
Conflict of Interest Safeguards
This provision is a general requirement that States have in effect safeguards against conflict of interest on the part of State and local officials (or their agents).
Changes from the Proposed Regulation
No change.
Continued Service to Beneficiaries
This section requires States to have a mechanism to ensure continued access to care when an enrollee with ongoing health care needs is transitioned to or from a managed care arrangement. The final rule specifies that these mechanisms must be in place for all children and adults receiving SSI benefits, children in Title IV-E foster care, beneficiaries aged 65 or older, or other specified individuals whenever they are transitioned from fee-for-service to an MCO, PHP, or PCCM, from one MCO, PHP, or PCCM to another, or from an MCO, PHP, or PCCM to fee-for-service.
Changes from the Proposed Regulation
The final rule adds the requirements for transitioning into managed care, and into and out of PCCMs for specified populations.
Education of MCOs, PHPs, and PCCMs, and their providers
This new section is added in the final rule and requires States to have in effect procedures for educating MCOs, PHPs, and PCCMs, and their providers about the clinical and other needs of enrollees with special health care needs.
Subpart C -- Enrollee Protections
Enrollee Rights
This provision reflects several enrollee rights that are incorporated in other sections (such as confidentiality). It also includes several additional rights (such as freedom from restraint or seclusion) that are not specifically addressed in other sections of this rule. This section applies to MCOs, PHPs, and PCCMs.
Changes from the Proposed Regulation
In the proposed rule these rights applied only to MCOs and PHPs. The final rule adds as enrollee rights, the right to obtain a second opinion from an appropriately qualified health care professional and the right to be free from any form of restraint or seclusion used as a means of coercion, discipline, convenience, or retaliation, as specified in other Federal regulations on the use of restraints.
Protection of Enrollee-Provider Communications
This provision requires that an MCO or PHP may not prohibit, limit, or restrict a participating health care professional from advising a patient about his or her health status and discussing appropriate treatment regardless of whether the treatment is covered under the contract with the MCO or PHP. It does not require MCOs and PHPs to provide, reimburse for, or provide coverage of counseling or referral services for specific services, if the MCO or PHP objects to the services on moral or religious grounds. If the MCO or PHP does not provide those services, States remain responsible for assuring access to all covered services. In these cases, the MCO or PHP must inform beneficiaries in writing of its policies before and at the time of enrollment. If the MCO or PHP changes its policies with regard to a specific counseling or referral service, the organization must provide written notification to enrollees within 90 days after the date that the organization adopts the change in policy.
Changes from the Proposed Regulation
If the MCO or PHP does not cover a service under this section, then it is not required to inform enrollees and potential enrollees about how and where to obtain the service, but rather how and where to obtain information about a service. States must provide information to enrollees on how and where to obtain a service that the MCO or PHP does not cover based on moral or religious objections.
Marketing Activities
This provision defines marketing, specifies that States must prior approve marketing materials in consultation with a Medical Care Advisory Committee, and prohibits certain types of direct and indirect marketing activities, including cold call, telephonic, door-to-door and other forms of cold call marketing. The provision also defines direct and indirect cold call marketing.
Changes from the Proposed Regulation
The final rule revised the definition of marketing to address confusion by commentors to the proposed rule.
Emergency and Post-Stabilization Services
An MCO, PHP, or PCCM is required to provide coverage of emergency services. Emergency services are defined based on the "prudent layperson" standard. The MCO or PHP must pay for the cost of emergency services obtained by Medicaid enrollees. In addition we clarify that a PCCM that has a risk contract is responsible for coverage and payment of emergency services and post-stabilization services and that the State is responsible in the case of a PCCM that has a fee-for-service contract. PCCMs must also allow direct access to emergency services without prior authorization. An MCO or PHP must provide information to enrollees regarding access to emergency services. The treating practitioner must decide when an enrollee is sufficiently stabilized to facilitate appropriate transfer or discharge, and that decision is binding on the MCO, PHP, or PCCM.
Changes from the Proposed Regulation
The final rule clarifies that the entity responsible for payment may not limit what constitutes an emergency medical condition based on lists of particular diagnoses or symptoms and it may not refuse to process a claim because it does not contain the primary care provider’s authorization number. To protect the enrollee from financial liability in the event of a payment dispute between the MCO and hospital, the final rule also specifies that once a qualified provider determines that an enrollee has an emergency medical condition, the enrollee may not be held liable for subsequent screening and treatment needed to diagnose the specific condition or stabilize the patient.
Subpart D -- Quality Assessment and Performance Improvement
Quality Strategy
We require States to develop a quality strategy and evaluate the effectiveness of the strategy at least every three years.
Changes from the Proposed Regulation
The strategy must be in writing and must be made available for public input prior to its adoption. It must also be updated every three years and submitted to HCFA when initiated and when any significant changes are made to the strategy. States must report to HCFA on the implementation and effectiveness of the strategy at least every three years.
Elements of State Quality Strategy
We require that certain components be included in State strategies including: contract provisions that incorporate standards for access; MCO and PHP structure and operations, and quality measurement and improvement; procedures for assessing quality of care of Medicaid managed care enrollees; annual independent external review of MCOs and PHPs; intermediate sanctions; and a State information system.
Changes from the Proposed Regulation
As part of the overall quality strategy, the final rule adds requirements that the State identify enrollees with special health care needs and assess the quality and appropriateness of their care; identify the race, ethnicity and primary language spoken by each Medicaid enrollee and provide this to each MCO and PHP at time of beneficiary enrollment; and use performance indicators and levels specified by the Secretary.
Availability of Services
This rule includes provisions that address: State responsibility to provide State plan-covered services not included in an MCO or PHP contract, the adequacy of the MCO’s or PHP’s provider network and considerations the MCO or PHP must address in constructing its Medicaid network, women enrollees’ direct access to women’s health specialists for routine and preventive care, accessibility of services, and responsibilities of MCOs and PHPs for providing culturally competent care.
Changes from the Proposed Regulation
MCOs and PHPs must consider persons with special health care needs and the training and experience of providers when establishing and maintaining provider networks. Enrollees are entitled to a second opinion from a qualified health care provider. If no such provider is available within the MCO’s/PHP’s network, the MCO/PHP must make arrangements for a second opinion from outside its network at no cost to the enrollee. MCOs and PHPs must adequately and timely cover out-of network services if the MCO or PHP network is unable to provide medically necessary service to an enrollee. MCOs and PHPs must require out-of-network providers to coordinate with the MCO or PHP with respect to payment and ensure that costs to enrollees are no greater than they would be if the service were delivered within the network. The final rule clarifies that provider hours of operation must be "convenient" to enrollees as determined by a State methodology that is at least comparable to that under fee-for-service.
Assurances of Adequate Capacity and Services
The rule includes provisions to require MCOs and PHPs to provide the State with assurances of the adequacy of its provider network to serve the expected enrollment in its service area.
Changes from the Proposed Regulation
The final rule changes certain requirements so that MCOs and PHPs are to give assurances to the State, rather than to HCFA. After State review, the State (rather than the MCO or PHP) must provide certification to HCFA that the MCO or PHP has complied with State requirements for availability of services.
The assurance of network adequacy must be submitted once per year (proposed rule provided for every two years). MCO and PHP documentation must address policies and practices to address unanticipated need for providers with particular experience or limitations in the availability of such providers. All documentation collected by the State from MCOs and PHPs should be made available to HCFA upon request. Finally, MCOs and PHPs must resubmit documentation whenever there is a significant change in services, benefits, service area, enrolled populations, or payment rates.
Continuity and Coordination of Care
The rule contains provisions pertaining to primary care and overall coordination of care and provisions addressing enrollee participation in their care and the maintenance of patient care information.
Changes from the Proposed Regulation
MCOs and PHPs must screen all enrollees and assess certain enrollees, including those identified through the screening. States are required to identify to MCOs and PHPs: enrollees at risk of having special health care needs (including, children and adults receiving SSI; children in Title IV-E foster care; enrollees over age 65; enrollees in certain payment categories; and other categories of beneficiaries identified by HCFA); enrollees known to be pregnant or to have special health care needs and children under the age of two. In addition, MCOs and PHPs are required to make best efforts to screen enrollees at risk of having special health care needs within 30 days of identification and all others within 90 days; comprehensively assess pregnant enrollees, enrollees under the age of 2, and other enrollees known by the State to have special health care needs no later than 30 days from identification, implement certain requirements for treatment planning, and implement primary care and care coordination programs that meet certain other requirements.
Coverage and Authorization of Services
The rule contains provisions requiring each contract with an MCO or PHP to describe and identify all services offered under the contract and require each MCO and PHP to follow written policies and procedures for processing requests for services in a manner which ensures access to these services.
Changes from the Proposed Regulation
Requirements have been added that MCO and PHP contracts must specify that the MCO or PHP services will be provided in the amount, duration, and scope of services in the State Plan and in a manner reasonably expected to achieve the purpose for which the services are furnished. If a provider or the MCO or PHP determines that the standard timeframe could seriously jeopardize the enrollee=s life or health or ability to attain, maintain, or regain maximum function, then the MCO or PHP must make the authorization decision within 72 hours.
The final rule eliminates the requirement that providers receive written notice of any decision to deny or limit care, and the option for an MCO or PHP to request a 14-day extension in the authorization process.
Provider Selection
The rule contains standards for the initial credentialling and recredentialling of network providers.
Changes from the Proposed Regulation
The final rule clarifies that the credentialling requirements do not apply to providers who are permitted to furnish services only under the direct supervision of a physician or other provider and hospital-based providers who provide services only incidentally to hospital services.
Confidentiality
The rule contains provisions to assure that States ensure that MCOs and PHPs maintain accurate and timely records and generally safeguard the confidentiality of enrollee=s medical records, consistent with Federal and State law.
Changes from the Proposed Regulation
MCOs and PHPs must establish and implement procedures that specify to where and for what purpose the MCO or PHP uses or discloses enrollee information. States must ensure that MCOs and PHPs ensure that enrollees receive, upon request, information on how the MCO and PHP uses and discloses identifiable information.
Grievance Systems
The rule contains provisions to ensure that each MCO and PHP has in effect a grievance system that meets certain requirements.
Changes from the Proposed Regulation
The final rule adds two new requirements: 1) if the State delegates to the MCO or PHP responsibility for notices of action, the state must conduct random reviews of each MCO and PHP and its providers and subcontractors to ensure that enrollees are notified in a timely manner; and 2) States are required to establish a process to review, upon request, grievances not resolved by the MCO or PHP to the satisfaction of the enrollee.
Practice Guidelines
The rule contains provisions to require each MCO and PHP to adopt practice guidelines that are based on valid and reliable clinical evidence or a consensus of health care professionals in the particular field, consider the needs of the MCO’s or PHP’s enrollees, are adopted in consultation with contracting health care professionals and are reviewed and updated periodically.
Changes from the Proposed Regulation
The final rule clarifies that the MCO’s and PHP’s responsibility is to adopt (not develop) practice guidelines, and replaces the words "reasonable medical evidence" with "valid and reliable clinical evidence." Also, in response to comments, there is specific reference to the Guidelines for the Use of Antiretroviral Agents in HIV-Infected Adults and Adolescents and the Guidelines for the Use of Antiretroviral Agents in Pediatric HIV Infection as examples of guidelines that meet the requirements of this provision.
Quality Assessment and Performance Improvement Program
The rule requires States to require MCOs and PHPs to have a program for quality assessment and improvement. The State must require the MCO or PHP to meet minimum performance levels on standardized measures and conduct performance improvement projects.
Changes from the Proposed Regulation
HCFA may specify standardized quality measures and topics for performance improvement projects to be required by States in their contracts with MCOs and PHPs. The State must include any minimum performance levels specified by HCFA; must require MCOs and PHPs to have in effect mechanisms to assess the quality and appropriateness of care furnished to enrollees with special health care needs; and must include "cultural competence" as a required area for MCO and PHP performance improvement projects. Additionally, the rule clarifies that on an annual basis performance measures must be set. MCOs and PHPs must initiate at least one improvement project and each MCO and PHP must measure its performance.
Health Information Systems
The rule requires States to require that each MCO and PHP maintain a health information system that collects, analyzes, integrates, and reports data and achieves certain quality measurement and improvement objectives.
Changes from the Proposed Regulation
The final rule makes two changes: a requirement that the health information system produce information on financial solvency has been dropped and, we have clarified that information on disenrollments pertains only to information on disenrollments for other than loss of Medicaid eligibility.
Subpart F -- Grievance Systems
Grievance Systems
We require MCOs and PHPs to have a system to accommodate grievances and appeals. We have worked closely with Medicare to ensure that our requirements and terminology are consistent, where appropriate. We have specified that the time an enrollee has to file a grievance is to be set by the State but must be no less than 20 days and no more than 90 days. We have also provided that the 90-day period for action to be completed on an appeal begins with the filing of the appeal to the MCO or PHP but that the clock stops when the MCO or PHP decision is issued and resumes when the enrollee files for a State fair hearing. We require States to have expedited fair hearings for expedited appeals when the issue is the denial of authorization for a service.
Changes from the Proposed Regulation
The rule no longer requires that all appeals be automatically forwarded to the State, but rather limits this requirement to expedited appeal. The terminology used in the final rule differs from the proposed rule in that we now use the terms Agrievances and appeals@ rather than Acomplaints and grievances@. A timeframe of 90 days is specified for the disposition of grievances. Enrollees may pursue quality of care grievances with the State Medicaid agency when dissatisfied with their outcome. Providers must give a general notice of action to enrollees, but the rule permits the MCO or PHP to provide specific information to enrollees on actions. The criteria for expedited appeals are revised to include that an appeal is to be expedited not only if delay would jeopardize the enrollee=s health or ability to regain function, but also if delay would jeopardize the enrollee=s ability to attain or maintain function.
Subpart H -- Certifications and Program Integrity Provisions
Certifications and Program Integrity Provisions
We require the State to ensure that the MCO or PHP submits certain data and that the data is certified by an appropriate MCO or PHP officer. We also require an appropriate MCO or PHP officer to certify contracts and other documents specified by the State. The MCO or PHP is required to have a compliance plan that, for example, requires the appointment of a compliance officer and training for the MCO=s or PHP’s employees. Finally, we require that the MCO or PHP and all subcontractors certify that they are in substantial compliance with the terms of their contract.
Changes from the Proposed Regulation
We added more specific requirements for MCOs and PHPs when submitting their certifications. The MCO or PHP must have administrative and management arrangements, including a mandatory compliance plan, that are designed to guard against fraud and abuse and which include written policies and procedures, designation of a compliance committee that is accountable to senior management, effective training and education, effective lines of communication, enforcement of standards through well-publicized disciplinary guidelines; provision of internal monitoring and auditing, and provision for prompt response to detected offenses and development of corrective action initiatives.
Subpart I -- Sanctions
Sanctions for Noncompliance
We require States to establish intermediate sanctions that may be imposed in specified circumstances. The types of intermediate sanctions that may be imposed include civil money penalties, suspension of enrollment, suspension of payment and disenrollment by enrollees without cause. States also have authority to terminate an MCO=s or PCCM’s contract and transfer enrollees to another MCO or PCCM or provide services under the State Plan. States must provide MCOs and PCCM’s with a hearing prior to actual termination. If an MCO repeatedly fails to meet the requirements of its contract (under sections 1903(m) or 1932 of the Act), the State must appoint temporary management. This is a measure of last resort as States have the authority to terminate the contract first.
Changes from the Proposed Regulation
Intermediate sanctions may be imposed if the State determines that the MCO or PCCM distributes marketing materials that have not been approved by the State or that contain false or materially misleading information. The State may impose an intermediate sanction that suspends all new enrollment, including default enrollment, after the effective date of the sanction. The final rule removes the requirement for States to provide notice to HCFA of sanctions, but now requires that the State must publish a notice that describes the intermediate sanction imposed, explains the reasons for the sanction, and specifies the amount of any civil money penalty.
Subpart J -- Conditions for Federal Financial Participation (FFP)
Basic Requirements
This provision specifies the conditions under which FFP is available for MCO and PHP contracts.
Changes from the Proposed Regulation
The provision was added that FFP is available as long as the MCO or PHP and the State are in "substantial compliance" with the contract, the physician incentive plan requirements, and other regulatory requirements. This addresses a concern raised in comments that all FFP was subject to loss due to a minor infraction.
FFP Limitation for Enrollment Brokers
This section requires an enrollment broker to be independent of any MCO, PHP, PCCM or other health care provider that provides services in the State. All initial enrollment broker contracts and Memorandums of Agreement must be approved by HCFA.
Changes from the Proposed Regulation
The final rule includes definitions of choice counseling, enrollment activities, and enrollment broker that were originally in ' 438.104. We clarified that an enrollment broker is not independent if it is an MCO, PHP, PCCM or other health care provider in the State, or owns or is owned by any of these entities.