CMS warns Medicare Advantage organizations of upcoming utilization management compliance audits

On October 24, 2023, the Centers for Medicare & Medicaid Services (CMS) issued a memorandum to all Medicare Advantage (MA) organizations (MAOs) stating that, as early as January 2024, CMS intends to initiate program audits to assess compliance with the newly effective utilization management (UM) rules. The audits may be part of “routine” or “focused” audits, with focused audits being limited in scope and duration. 

All MAOs may be subject to the UM audit in some capacity. Record of a recent routine program audit – or preparation for a CMS-led audit valuation in the future – does not provide protection.

The following is a high-level overview of key aspects of the new UM rules on which MAOs can expect to be audited:

• Amendments to existing 42 CFR 422.101.  MAOs must comply with CMS’s national coverage determinations, applicable local coverage determinations, and general coverage and benefit conditions included in “traditional Medicare” laws.  The amendments also address cases in which coverage criteria might not be “fully established” and where an MA plan may create certain publicly accessible internal coverage criteria.
  
  
• Amendments to existing 42 CFR 422.112.  Among other edits, with respect to “basic” benefits (ie, benefits covered by traditional Medicare), approvals for prior authorization for a course of treatment must remain valid as long as medically necessary, subject to certain conditions.  MA plans must provide a minimum 90-day transition period when an enrollee who is currently undergoing an active course of treatment switches to a new MA plan, even if the healthcare provider is out of network.
  
  
• A newly effective rule governing utilization management committees at 42 CFR 422.137.  Any MAO that uses utilization management policies and procedures (including prior authorization) must establish a utilization management committee. The rule establishes the required composition and responsibilities of the committee.
  
  
• A newly effective rule governing prior authorizations at 42 CFR 422.138.  The use of prior authorizations is permitted in only a few circumstances, including to confirm the presence of diagnoses or other medical criteria, or to assess whether a basic benefit is medically necessary or a supplemental benefit is clinically appropriate.  The rule further requires that any approval granted through prior authorization or pre-service determination of coverage or payment may not later be denied on the basis of lack of medical necessity and must not be reopened, except in the circumstances specified in the rule.

In November, CMS account managers will begin contacting MAOs to conduct “strategic conversations” so MAOs can confirm their compliance with the UM rules in advance of the audits.  MAOs must continue preparing for compliance with these rules as they head into 2024, including to ensure that they do not improperly require prior authorization or other coverage requirements.

At the same time, healthcare providers will also be significantly impacted by the UM rules.  For example, MAOs have already begun announcing a rollback of their prior authorization requirements for many benefits.  Even where an MAO does not remove prior authorization requirements, providers might seek to leverage the UM rules to argue that remaining prior authorization requirements for certain services are also no longer permitted. 

While providers may now find fewer services subject to prior authorization or conditions not imposed by traditional Medicare, providers are encouraged to understand which of their healthcare services continue to be subject to prior authorization requirements or other conditions to avoid costly and avoidable payment denials.