2020-28877. Medicare Program; Secure Electronic Prior Authorization For Medicare Part D

AGENCY:

Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

This final rule names a new transaction standard for the Medicare Prescription Drug Benefit program's (Part D) e-prescribing program as required by the “Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act” or the “SUPPORT Act.” Under the SUPPORT Act, the Secretary is required to adopt standards for the Part D e-prescribing program to ensure secure electronic prior authorization request and response transmissions. In this final rule, we amend the Part D e-prescribing regulations to require Part D plan sponsors' support of version 2017071 of the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard for use in certain electronic Prior Authorization (ePA) transactions with prescribers regarding Part D-covered drugs to Part D-eligible individuals.

DATES:

These regulations are effective on February 1, 2021. The incorporation by reference of certain publications listed in the rule was approved by the Director of the Federal Register as of July 28, 2017.

FOR FURTHER INFORMATION CONTACT:

Joella Roland [phone].

SUPPLEMENTARY INFORMATION:

I. Background

The purpose of this final rule is to adopt a new standard for certain transactions concerning Part D-covered drugs prescribed to Part D-eligible individuals under the Part D e-prescribing program. Under this final rule, Part D plan sponsors will be required to support version 2017071 of the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard for four electronic Prior Authorization (ePA) transactions, and prescribers will be required to use that standard when performing ePA transactions for Part D-covered drugs they wish to prescribe to Part D-eligible individuals. Part D plans, as defined in 42 CFR 423.4, include Prescription Drug Plans (PDPs) and Medicare Advantage Prescription Drug Plans (MA-PDs); Part D sponsor, as defined in 42 CFR 423.4, means the entity sponsoring a Part D plan, MA organization offering a MA-PD plan, a Programs of All-Inclusive Care for the Elderly (PACE) organization sponsoring a PACE plan offering qualified prescription drug coverage, and a cost plan offering qualified prescription drug coverage. The ePA transaction standard will provide for the electronic transmission of information between the prescribing health care professional and Part D plan sponsor to inform the sponsor's determination as to whether or not a prior authorization (PA) should be granted. The NCPDP SCRIPT standard version 2017071 was adopted as a Part D e-prescribing program standard for certain defined transactions in the April 16, 2018 final rule (83 FR 16440) titled “Medicare Program; Contract Year 2019 Policy and Technical Changes to the Medicare Advantage, Medicare Cost Plan, Medicare Fee-for-Service, the Medicare Prescription Drug Benefit Programs, and the PACE Program” that became effective June 15, 2018.

A. Legislative Background

1. Health Insurance Portability and Accountability Act of 1996 (HIPAA)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) was enacted on August 21, 1996. Title II, Subtitle F, of HIPAA requires covered entities—health plans, health care providers that conduct covered transactions, and health care clearinghouses—to use the standards HHS adopts for certain electronic transactions. The standards adopted by HHS for purposes of HIPAA are in regulations at 45 CFR part 162.

2. Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA)

The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173) was enacted on December 8, 2003. It amended Title XVIII of the Social Security Act (the Act) by redesignating Part D as Part E and inserting a new Part D to establish a voluntary prescription drug benefit program. As part of that program, section 1860D-4(e) of the Act, as added by the MMA, required the adoption of Part D e-prescribing standards for electronic prescriptions and prescription-related transactions between Part D plan sponsors, providers, and pharmacies. The Secretary's selection of standards is informed by the National Committee on Vital and Health Statistics (NCVHS), an advisory committee that gives advice to the Secretary in accordance with the Federal Advisory Committee Act, including regarding implementation of the administrative simplification provisions of HIPAA. Under section 1860D-4(e)(4)(B) of the Act, NCVHS develops recommendations for Part D e-prescribing standards, in consultation with specified groups of organizations and entities. These recommendations are then taken into consideration when developing, adopting, recognizing, or modifying Part D e-prescribing standards. The statute further requires that the selection of standards be designed, to the extent practicable, so as not to impose an undue administrative burden on prescribers or dispensers, but to be compatible with standards established under Part C of title XI of the Act (the HIPAA standards), comport with general health information technology standards, and permit electronic exchange of drug labeling and drug listing information maintained by the Food and Drug Administration and the Library of Medicine.

The standards adopted by CMS for purposes of the Part D e-prescribing program are in regulations at 42 CFR 423.160. Part D plan sponsors are required to support the Part D e-prescribing program transaction standards, and providers and pharmacies that conduct electronic transactions for which a program standard has been adopted must do so using the adopted standard. (For additional information about the MMA program authority, see the February 4, 2005 proposed rule (70 FR 6256).)

3. Substance Use-Disorder Prevention That Promotes Opioid Recovery and Treatment for Patients and Communities Act

The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (Pub. L. 115-271), hereinafter referred to as the “SUPPORT Act,” was enacted on October 24, 2018. Section 6062 of the SUPPORT Act amended section 1860D-4(e)(2) of the Act to require the adoption of transaction standards for the Part D e-prescribing program to ensure secure ePA request and response transactions between prescribers and Part D plan sponsors no later than January 1, 2021. Such transactions are to include an ePA request transaction for prescribers seeking an ePA from a Part D plan sponsor for a Part D-covered drug for a Part D-eligible individual, as well as an ePA response transaction for the Part D plan sponsor's response to the prescriber. A facsimile, a proprietary payer portal that does not meet standards specified by the Secretary or an electronic form are not treated as electronic transmissions for the purposes of ePA requests. The ePA standards adopted under this authority are to be adopted in consultation with the NCPDP or other standards development organizations the Secretary finds appropriate, as well as other stakeholders.

Finally, the SUPPORT Act also authorized the adoption of ePA transaction standards for Part D-covered drugs prescribed to Part D-eligible individuals “notwithstanding” any other provision of law.

B. Regulatory History

In 2000, the Secretary adopted HIPAA transaction standards for the “referral certification and authorization transaction”. The term “referral certification and authorization transaction” is defined at 45 CFR 162.1301 as the transmission of any of the following: (1) A request from a health care provider to a health plan for the review of health care to obtain an authorization for the health care; (2) a request from a health care provider to a health plan to obtain authorization for referring an individual to another health care provider; and (3) a response from a health plan to a health care provider to a request described in (1) or (2). The first HIPAA standard adopted for this transaction was version 4010 of the X12 278 (65 FR 50371, August 17, 2000). In 2003, the Secretary adopted another standard, the NCPDP version 5.1, for retail pharmacy drug referral certification and authorization transactions, and specified that version 4010 of the X12 278 was to be used only for dental, professional, and institutional referral certification and authorization transactions. (For more detailed information, see the February 20, 2003 Federal Register (68 FR 8398).) Still, as of 2003, the Secretary had not adopted a standard for ePA for medications specifically.

In 2004, NCPDP formed a multi-industry, multi-Standards Development Organization (SDO) ePA Task Group to evaluate existing ePA standards and promote standardized ePA, with a focus on the medication context. The Task Group considered the X12 278 standard, but determined that there were certain gaps in the X12 278 standard that made the standard difficult to use for ePA for medications, including that the standard was unable to support attachments for PA determinations, did not incorporate free text in certain fields, and did not at the time allow functionality for real-time messaging. As a result of these findings, the Task Group wrote a letter to the HHS Secretary stating that the X12 278 standard offered limited support for ePA for medications.

On January 16, 2009, the Secretary adopted later versions of the HIPAA transaction standards, requiring NCPDP Telecommunications D.0 instead of NCPDP 5.1, and version 5010 instead of version 4010 of the X12 278 for referral certification and authorization transactions (74 FR 3326). These standards are specified at 45 CFR 162.1302(b)(2).

In the meantime, the industry continued to work to develop and test alternative ePA transaction standards for use in the medication context. Such work led NCPDP to develop what would ultimately become its first standard to support ePA. In a May 15, 2014, letter to the HHS Secretary, NCVHS stated that they had received a letter from the NCPDP recommending its SCRIPT Standard Version 2013101 as a standard for carrying out medication ePA transactions. (For more information see, https://ncvhs.hhs.gov/​wp-content/​uploads/​2014/​05/​140515lt2.pdf.) In support of this recommendation, NCVHS reported that NCPDP investigators tasked with reviewing the X12 278 standards (the 278 v4010 or v5010) for medication ePA transactions found impediments. These impediments were grounded in the standards having been designed for requests for review and corresponding responses for the ePA of health care services (such as for procedures/services and durable medical equipment), resulting in an inability to facilitate medication ePA. NCPDP also noted the lack of widespread use of the X12 278 transaction in the medication ePA context as evidence of its inadequacy for this purpose.

Despite these findings and NCPDP recommendation to NCVHS, we did not pursue proposing the NCPDP SCRIPT Standard Version 2013101 as a Part D eRx program standard for medication ePA transactions because it was contrary to the HIPAA requirements, which continued to require use of the X12 278 standard. Similarly, when NCPDP wrote to CMS on May 24, 2017 to recommend the adoption of its NCPDP SCRIPT Standard Version 2017071, we were unable to consider it for the Part D e-Rx program due to the HIPAA transaction standards in effect at that time.

Of note, the Part D e-Rx program's authorizing statute requires the selection of Part D standards that are compatible with the HIPAA standards. See section 1860D-4(e)(2)(C) of the Act. However, given the new authority under the SUPPORT Act, we believe we now have authority to adopt Part D eRx ePA transaction standards “notwithstanding” any other provision of law, if such proposals are framed in consultation with stakeholders and the NCPDP or other standard setting organizations the Secretary finds appropriate. See section 1860D-4(e) of the Act, as amended by section 6062 of the SUPPORT Act. We believe that this provision explicitly authorizes us to require the use of an ePA standard in the Part D context that is different from the HIPAA standard, as long as it is for use in the ePA of Part D-covered drugs prescribed to a Part D-eligible individuals.

As previously described, Part D plan sponsors are required to establish electronic prescription drug programs that comply with the e-prescribing standards adopted under the Part D e-prescribing program's authorizing statute. There is no requirement that prescribers or dispensers implement eRx. However, prescribers and dispensers who electronically transmit and receive prescription and certain other information regarding covered drugs prescribed for Medicare Part D-eligible beneficiaries, directly or through an intermediary, are required to comply with any applicable standards that are in effect.

As of January 1, 2020, prescribers and dispensers are required to use the NCPDP SCRIPT standard, Implementation Guide Version 2017071, for the communication of the same prescription or prescription-related information between prescribers and dispensers for the transactions for which prior versions of the NCPDP SCRIPT standard were adopted, as well as a handful of new transactions named at § 423.160(b)(2)(iv). For more information, see the April 16, 2018 final rule (83 FR 16635) and for a detailed discussion of the regulatory history of the Part D e-prescribing standards see the November 28, 2017 proposed rule (82 FR 56437).

While not currently adopted as part of the Part D eRx standard, the NCPDP SCRIPT standard version 2017071 includes 4 transaction standards that will enable prescribers to initiate, request, and review the 4 response transactions from Part D plan sponsors at the time of the patient's visit. These eight response transactions include: The PA initiation request/response, PA request/response, PA appeal request/response, and PA cancel request/response. As noted previously, historically we were unable to name this ePA transaction standard as a Part D e-prescribing program standard. Prior to the passage of the SUPPORT Act, the Part D program was required to adopt standards that were compatible with the HIPAA standards, and HIPAA covered entities are currently required to use the X12 278 to conduct referral certification and authorization transactions between health plans and health care providers.

II. Adoption of the NCPDP SCRIPT Standard Version 2017071 as the Part D ePA Transaction for the Part D Program

A. PA in the Part D Context

All Part D plans, as defined under § 423.4, including PDPs, MA-PDs, PACE Plans offering qualified prescription drug coverage, or Cost Plans offering qualified prescription drug coverage, may use approved PA processes to ensure appropriate prescribing and coverage of Part D-covered drugs prescribed to Part D-eligible individuals. We review all PA criteria as part of the formulary review process. In framing our PA policies, we encourage PDP and MA-PD sponsors to consistently utilize PA for drugs prescribed for non-Part D covered uses and to ensure that Part D drugs are only prescribed when medically appropriate. Non-Part D covered uses may be indicated when the drug is frequently covered under Parts A or B as prescribed and dispensed or administered, is otherwise excluded from Part D coverage, or is used for a non-medically accepted indication. (For more information, see the Medicare Prescription Drug Manual, chapter 6, section 30.2.2.3.) Part D sponsors must submit to CMS utilization management requirements applied at point of sale, including PA.

We may also approve PA for prescriptions when the Part D plan desires to manage drug utilization, such as when step therapy is required, when it needs to establish whether the utilization is a continuation of existing treatment that should not be subject to the step therapy requirements, or to ensure that a drug is being used safely or in a cost-effective manner. Formulary management decisions must be based on scientific evidence and may also be based on pharmaco-economic considerations that achieve appropriate, safe, and cost-effective drug therapy.

The PA process has historically been handled via facsimile exchange of information or telephone call, and only recently via payer-specific web portals. However, stakeholders testifying to NCVHS generally agree that there is a need to move to a user-friendly, real-time ePA for use by prescribers. Minutes from NCVHS meetings can be accessed at https://ncvhs.hhs.gov/​meetings-meeting/​all-past-meetings/​. Therefore, we believe the adoption of an ePA standard for the Part D eRx program will improve patient access to required medications.

B. PA for Part D E-Prescribing

In order to meet the SUPPORT Act's mandate to adopt an ePA transaction standard for the Part D-covered drugs prescribed to Part D-eligible individuals, CMS identified ePA transaction standards currently available for use by pharmacies and prescribers. These included the X12 278 and NCPDP Telecommunications D.0 standards, the NCPDP SCRIPT standard version 2017071, and earlier versions of the NCPDP SCRIPT standard. We quickly ruled out the use of older NCPDP SCRIPT standards based on the improvements incorporated in the current HIPAA Administrative Simplification transaction standards and our assessment of the enhanced functionality available in the NCPDP SCRIPT standard version 2017071.

Then we considered the needs of the Part D eRx program; the functionalities offered by the remaining two sets of standards; NCVHS recommendations, stakeholder recommendations based on their experience developing, vetting, evaluating, revising, and using the standards constructed by the respective Standards Development Organizations (SDOs) including NCPDP, the burden on stakeholders to use the standards, the security offered by the standards; and the current EHR capabilities of the industry in order to estimate the potential burden each standard will impose if it were to be adopted in the Part D context.

The NCPDP Telecommunications D.0 standard was designed to be a standard for insurance companies to approve claims, and, to our knowledge, is only used in “pharmacy to plan” transactions. We found that it does not include all of the content fields that may be relevant to ePA for medications, and had understood that it does not have the ability to support transmission of information in real time. Then we considered the X12 278 standard. The X12 278 is already used as the HIPAA standard for referral certification and PA for dental, professional and institutional transactions, and retail pharmacy drugs transactions, respectively.

Based on review of NCPDP's testimony and the letters received from NCVHS, we had found that the NCPDP and its participant organizations have historically concluded (and presented to NCVHS via testimony at hearings) that the X12 278 standard is not adequate to enable ePA in the medication e-prescribing context because it does not support “real-time” medication e-prescribing, meaning a prescriber seeking an ePA determination during the patient encounter. We understood that this was due to the content logic of the standard not having the technical capabilities to allow for next question logic, which allows the prescriber to determine medication alternatives and determine within minutes if the medication will be authorized or if a coverage determination is required. In addition, we found that the fields, transaction messaging, and software functioning were not structured to include information relevant to ePA, and contained mandatory questions that were unnecessary for medication ePA. Unfortunately, we also found that prescribers are unable to customize these fields as may be needed for medication ePA.

These findings were largely based on NCPDP's 2016 written testimony to NCVHS, which is available via this web link: https://www.ncvhs.hhs.gov/​wp-content/​uploads/​2016/​01/​Part-2-Attachments-NCPDP-WrittenOnly.pdf. The NCPDP testimony urged the exemption of medication transactions from the X12 278 standard. The testimony also advocated for NCPDP's May 24, 2017 recommendation to adopt the NCPDP SCRIPT Standard Version 2017071 for ePA transactions in the HIPAA context, with a 24-month implementation time period due to the extensive coding required by health IT developers and Part D plans to implement the change.

Although NCPDP's recommendation was to adopt this standard for all HIPAA transactions, the Department did not elect to make the suggested changes to the HIPAA Administrative Simplification transaction standards. Based on conversations with the industry, our own assessment of the standard, and under the authority provided by Congress to require the use of a standard for Part D ePA notwithstanding any other provision of law, we concluded that the potential benefits of adopting user-friendly ePA for the Part D eRx program outweigh any difficulties that may arise by virtue of Part D using a different standard than the rest of the industry.

More specifically, we concluded that the NCPDP SCRIPT standard version 2017071 would support an electronic version of today's PA process by providing standardized information fields that are relevant for medication use, mandatory questions, transaction messaging, and standardized ePA data elements and vocabulary for exchanging the PA questions and answers between prescribers and payers, while also allowing the payers to customize the wording of the questions using free form fields. Although the X12 278 standard has standard information fields, mandatory questions, transaction messaging, and standardized data element and values, we believed those fields were more relevant to use in dental, professional, and institutional requests for review and response, and would not be conducive to medication ePA. Since the X12 278 standard does not allow payers to customize the wording of questions, we believe it would be difficult for parties to decide how to fill out the fields. In contrast, we found that NCPDP SCRIPT Standard version 2017071 was specifically designed to support medication ePA. The standard supports features that minimize what the prescriber is asked, creating a customized experience based on earlier answers or data automatically pulled by their EHR system. These features would reduce the amount of time a prescriber or their staff spend reviewing and responding to the ePA questions. We understood that this functionality exists in most EHR systems, and can be customized based on what information is requested by the plans. We found great value in this potential to automate the collection of data required for ePA from data available within most EHR systems.

Furthermore, unlike the X12 278 standard, NCPDP SCRIPT standard version 2017071 supports solicited and unsolicited models. A solicited model occurs when the prescriber notifies the payer that they wish to initiate the PA process to determine if an authorization is needed for the patient and their desired medication. The prescriber requests guidance as to what information will be required for an ePA request for a particular patient and medication. The payer then responds either with a description of the information required, or an indication that a PA is not required for that patient and medication. An unsolicited model can be used when the information generated in this first interchange of the solicited model is not required. In such a case, the prescriber presumes or knows that an authorization will be required based on past experience or other knowledge, anticipates what the payer needs, and submits the needed information.

We also found that while X12 278 uses Electronic Data Interchange (EDI) syntax, the NCPDP SCRIPT standard version 2017071 uses XML syntax. XML helps to ensure the security of transactions through the encryption of personal health information and through use of XML transaction processing. XML is a newer syntax that provides for an easier interaction among different formats and is more easily readable between disparate systems and when system issues arise. By contrast, EDI is an older syntax more commonly used when there are fewer companies that conduct standard interactions among one another.

Based on this evaluation of the candidate standards, coupled with the recommendations from NCPDP, CMS concluded that the NCPDP SCRIPT standard version 2017071 was the most appropriate standard to propose for the Part D eRx program.

We explicitly recognized that this final rule would not change the ePA transaction standards that will be used outside of the Part D context. We did not believe that it would be problematic to use one standard for Part D and another standard outside of Part D, because we believed that the industry was already equipped to use different standards for different health plans and programs.

Finally, we considered whether adopting the NCPDP SCRIPT standard version 2017071 for Part D ePA would create any difficulties if an individual had multiple forms of drug coverage or wished to pay cash for a prescription. The SUPPORT Act specifies that the adopted standard shall be applicable for ePA of Part D-covered drugs prescribed to Part D-eligible individuals, but it stops short of requiring that the prescribed drug be paid for by the Part D plan. Thus, even if a prescriber were to use the NCPDP SCRIPT standard version 2017071 to seek Part D ePA, the beneficiary's right to pay for the drug directly, or to use non-Part D coverage to pay for the drug would be unaffected. However, we noted that the prescriber may not use the NCPDP SCRIPT standard version 2017071 to seek ePA with non-Part D plans. We expected that their EHR's eRx function would be capable of using the appropriate HIPAA standard or that they may use alternative means to seek PA outside of the Part D context. Furthermore, where a patient has both a Part D plan and a supplementary payer, the NCPDP SCRIPT standard version 2017071 could be used to process the Part D ePA transactions in real time, with the subsequent claims processing transactions made in the usual manner if the prescription is filled. Thus, we believed our proposal would not be overly burdensome for regulated parties, even if beneficiaries seek to use their non-Part D coverage or elect to self-pay.

However, in recognition of patient rights, we also noted that while the prescriber can use the NCPDP SCRIPT standard version 2017071 for all Part D-covered drugs prescribed to Part D-eligible individuals, it should refrain from doing so in instances in which the patient specifically requests that the Part D benefits not be accessed.

As a result of these observations and our understanding that most of the industry is able to support NCPDP SCRIPT standard version 2017071 using their current EHRs, we believed that requiring plans to support, and prescribers to use the NCPDP SCRIPT standard version 2017071 ePA transactions when prescribing Part D-covered drugs to Part D-eligible individuals will not impose an undue administrative burden on plans, prescribers or dispensers. Therefore, based on its inherent features designed to accommodate prescriptions, we believed that the NCPDP SCRIPT standard version 2017071, which includes the following ePA transaction capabilities, would be the best available option to support ePA between prescribers and payers for Part D covered drugs prescribed to Part D-eligible individuals:

• PAInitiationRequest and PAInitiationResponse
• PARequest and PAResponse
• PAAppealRequest and PAAppealResponse
• PACancelRequest and PACancelResponse.

We believed finalization of the ePA transaction proposals would enable the electronic presentation of ePA questions and responses using secure transactions.

The SUPPORT Act states that the Secretary must adopt, and a Part D sponsor's electronic prescription program must implement the adopted ePA by January 1, 2021. As of January 1, 2020, plans will already be required to use the NCPDP SCRIPT 2017071 standard for certain Part D-specified transactions, so we believed that giving plans an additional year to add ePA to that list of other NCPDP SCRIPT 2017071 transactions would not be overly burdensome and would ensure that the SUPPORT Act was implemented as required.

In addition, the SUPPORT Act, allows us to finalize the adoption of an ePA standard for Part D-covered drugs to Part D-eligible individuals notwithstanding any other provision of law. Furthermore, we noted our belief that our proposal, if finalized, being later in time, more specific, and authorized by the SUPPORT Act, would prevail in a conflict of law analysis.

Therefore, we proposed adding § 423.160(b)(7) which would require Part D plans' support the noted NCPDP SCRIPT standard version 2017071 ePA transactions beginning on January 1, 2021, and that prescribers use that standard when conducting ePA for Part D-covered drugs prescribed to Part D-eligible individuals by the same date. This applies to the following list of ePA transactions:

• PAInitiationRequest and PAInitiationResponse
• PARequest and PAResponse
• PAAppealRequest and PAAppealResponse
• PACancelRequest and PACancelResponse

We welcomed comments on the proposed adoption of the NCPDP SCRIPT standard version 2017071 for these ePA transactions for Part D covered drugs prescribed to Part D eligible individuals. We also solicited comments regarding the impact of the proposed transactions and the proposed effective date on industry and other interested stakeholders, including whether the implementation of these NCPDP SCRIPT standard version 2017071 ePA transactions for use by prescribers and plans in the Part D program would impose an additional burden on the industry as a whole. We were also interested in hearing input as to whether implementation of the proposed transactions would constitute a significant change for Part D sponsors, such that a January 1, 2021 implementation date would not be feasible. We also sought comment on strategies to mitigate burden in order to support successful adoption of this policy, should it be finalized. We also sought comment on any additional ways that we can support plans if they were to be required to transition to the ePA standard by the proposed 2021 deadline. Finally, we solicited comments on the alternatives considered for the proposed rule.

In the June 19, 2019 Federal Register (84 FR 28450), we published the proposed rule that would, if finalized, establish a new ePA transaction standard for the Part D e-prescribing program as required by SUPPORT Act. We received 53 timely pieces of correspondence in response to the June 2019 proposed rule. Commenters included Part D sponsors, beneficiaries, beneficiary advocacy groups, pharmacy benefit managers (PBMs), pharmaceutical manufacturers, pharmacies, IT vendors, and other interested parties. Of the comments received, most commenters supported the rule. Summaries of the public comments, our responses to those public comments, and our final policies are set forth as follows.

Comment: Many commenters supported the proposed rule, stating that the standard is already used in the industry, and that any encouragement to use it for ePA will help streamline the PA process.

Response: We thank commenters for their support and agree that ePA will likely help streamline the PA process in the Part D eRx program context.

Comment: A few commenters expressed their dissatisfaction with having to perform PAs so often and stated that providers should be paid to perform PA.

Response: While we appreciate commenters' concerns, the use of PA is outside the scope of this rule. This final rule is limited to establishing the means by which ePA will be conducted in the Part D eRx program context, not the frequency of PAs or provider reimbursement. However, we note that as a part of the agency's Patients Over Paperwork initiative,^[1] we are working towards improving the prior-authorization process, and solicited comment on ways to do so in the June 11, 2019, Request for Information; Reducing Administrative Burden to Put Patients Over Paperwork (84 FR 27070). We also solicited comment on how to improve prior authorization in Medicare fee-for-service through our Request for Information on the Future of Program Integrity issued in October 2019.

Comment: A number of commenters provided comments relating to the proposed January 1, 2021, implementation date. Some of these commenters stated that the January 1, 2021 deadline was achievable. However, other commenters encouraged a later deadline for implementation or the use of enforcement discretion for the first 2 years. The reasons given for the requested delay include a desire to focus on the requirement for Part D plans to implement a prescriber real time benefit tool (RTBT) by January 1, 2021 (84 FR 23832) and to allow more time for development and testing. One commenter requested that we allow 24 months after the publication of the final rule for implementation: 12 months for development and testing and 12 months for providers to adopt software updates.

Response: We are sympathetic to commenters requesting a longer period in which to implement these requirements, especially in light of the toll that the current public health emergency (PHE) related to the 2019 Novel Coronavirus Disease (COVID-19) is taking on the industry, our prescriber RTBT requirement, and the need to test the technology before use. However, as noted in the proposed rule and previously in this final rule, the SUPPORT Act established the deadline by which we are required to implement this program standard. The SUPPORT Act requires that the Part D eRx program “provide for the secure electronic transmission of . . . a prior authorization request . . .” by January 1, 2021. In light of this mandate and the benefits of encouraging ePA, including increased interoperability between parties and a decrease in time spent performing prior authorizations, we are allowing Part D sponsors to use NCPDP SCRIPT 2017071 for prior authorizations beginning January 1, 2021. In an attempt to balance the statutory mandate and the benefits of use of this standard with the concerns of the commenters requesting more time and the burden on Part D plans in light of the current PHE, we are only requiring use of the standard beginning January 1, 2022. We believe that the January 1, 2022 deadline affords sufficient time to ensure compliance with this rule. Although we understand the request for a 24-month implementation timeframe, we believe that the implementation date in this final rule appropriately balances the benefits of adoption of the standard and the time needed to ensure compliance. We also note that this is only a requirement for Part D plans—not providers—so we do not believe that the additional 12 months for providers to adopt updates needs to be accounted for in the implementation timeframe. As a result of our decision to delay requiring use of the standard until January 1, 2022, we do not anticipate using enforcement discretion.

As discussed later in this final rule, we are finalizing proposed § 423.160(b)(7) as § 423.160(b)(8). Additionally, to effectively finalize the implementation date changes, we are restructuring the regulation text at § 423.160(b)(8). As finalized, paragraph (b)(8)(i) allows for use of the NCPDP SCRIPT standard by January 1, 2021, and paragraph (b)(8)(ii) requires use of the standard by January 1, 2022. Accordingly, we have redesignated proposed paragraphs (b)(7)(i) through (iv), which list the covered electronic prior authorization transactions, as paragraphs (b)(8)(i)(A) through (D).

Comment: Some commenters stated that although they applaud implementing the NCPDP SCRIPT standard version 2017071 ePA transactions for Part D, they believe that it should be acceptable for all pharmacy transactions. The reasons commenters gave for this were their belief that the SCRIPT standard is the most appropriate standard for all pharmacy transactions, regardless of payer or inclusion in Part D, and that using two standards for the same workflow will cause an unnecessary burden.

Response: We thank the commenters for their support for implementing this rule, and appreciate their feedback. However, suggestions regarding the use of these standards outside of the Part D eRx program are outside the scope of this rule. This final rule implements section 6062 of the SUPPORT Act, which requires the program to provide for the secure electronic transmission of Part D drugs for a Part D eligible individual enrolled in a Part D plan. As such, electronic transmissions outside of the Part D context go beyond the scope of this rule.

Although we are sympathetic to concerns about having to support two standards within the same workflow, we are unable to remedy this issue within the scope of this final rule, which implements section 6062 of the SUPPORT Act. We believe that having the two standards is consistent with Congress' intent when promulgating this section of the SUPPORT Act, since the statutory mandate only extended to providing for electronic transmissions in Part D.

Comment: A commenter requested that CMS either issue clarifying guidance in the final rule to indicate that HIPAA's Referral Certification and Authorization standards do not apply to ePA transactions for prescription drugs, or name the NCPDP SCRIPT standard version 2017071 as the HIPAA standard for ePA transactions for prescription drugs. The commenter stated that the ASC X12 prior authorization transaction named under HIPAA is for medical benefits and is not effective for the exchange of information related to prior authorizations of products covered under a pharmacy benefit.

Response: We are unable to do as requested. Suggestions regarding the use of these standards outside of the Part D eRx program are outside the scope of this rule. This final rule implements section 6062 of the SUPPORT Act, which requires the program to provide for the secure electronic transmission of Part D drug for a Part D eligible individual enrolled in a Part D plan. As such, electronic transmissions outside of the Part D context go beyond the scope of this rule.

Comment: Several commenters stated that CMS should allow and encourage other ePA standards, such as the Fast Healthcare Interoperability Resources (FHIR) standard promulgated by the standards development organization Health Level 7 (HL7). This standard supports application programming interfaces (APIs), and encouraged us to adopt these standards for other eRx contexts.

Response: Although we appreciate this feedback, these comments are outside the scope of this rule. The proposed rule only covered our proposals to implement the SUPPORT Act's mandate to implement an ePA standard under Part D. At this time, the suggested standard and application programming interfaces are not used to support most pharmacy transactions. We will continue to monitor the development, maturity, and industry adoption of HL7 FHIR standards for future rulemaking.

In addition, to the extent the commenters were suggesting the adoption of more broadly applicable standards outside of the Part D eRx program, section 6062 of the SUPPORT Act, which this rule implements, only allows for the use of an ePA standard that is different from the HIPAA standard if it is for a Part D covered drug prescribed to a Part D eligible individual. Other ePA medication transactions outside of Part D are still governed by HIPAA standards.

Comment: Some commenters requested more guidance surrounding the use of PA generally, including information about PA processing times allowed under Part D and how PAs interact with subregulatory guidance for Medicare health and drug programs.

Response: Although we appreciate commenters' interest in learning more about use of PA in the Medicare programs, these comments are not within the scope of this rule. As previously mentioned, the sole purpose of this rule is to implement the SUPPORT Act's mandate that requires our adoption of a new standard for ePA in the Part D eRx program. However, we would note that PA is a key component of utilization management under a Part D plan, and consistent with § 423.153, we would further remind commenters that each Part D plan is required to review the effectiveness of its utilization management policies and systems. Such review should include ensuring the prevention of over-utilization and under-utilization of prescribed medications. To the extent that automation of the PA function will allow plans to improve their ongoing monitoring of utilization management programs through enhanced reporting, they should use that improved functioning. In addition, as coverage of drugs that undergo a PA constitutes a coverage determination, such determinations are subject to all applicable coverage determination standards, timelines, and requirements.

Comment: A commenter requested clarification about whether the proposed rule, if finalized, would ban prescribers from conducting PA using non-electronic means or whether it would only require prescribers to use the NCPDP SCRIPT standard version 2017071 ePA transactions if they intend to process PA via electronic means. Another commenter believed that naming the NCPDP SCRIPT standard version 2017071 ePA transactions was premature given the challenges inherent in the practice of rural medicine, which can be impacted by limited or inconsistent technological capabilities.

Response: This rule only requires plans support the NCPDP SCRIPT standard version 2017071. Prescribers who elect to conduct PA electronically in the Part D eRx context will be required to do so using the adopted standards. Prescribers remain free to use non-electronic means of conducting PA, and Part D plans are still required to accept prior authorization requests via existing means, such as via facsimile (FAX).

Comment: A commenter requested that CMS adopt the same electronic prescribing standards used for prescribers to communicate with Prescription Drug Management Program (PDMP) databases. The commenter did not identify the standard generally used by PDMPs.

Response: We did not consider the standard the commenter alluded to because without knowing the details of the standard generally used by PDMPs we are unable to assess whether it was or was not a standard considered for Part D eRx ePA. We appreciate the commenter's concerns about interoperability, but we are unable to delay naming of the proposed transactions while we evaluate the degree to which PDMPs may or may not be using the NCPDP SCRIPT standard version 2017071 or some alternative. Due to the statutory deadline to implement ePA in the Part D eRx program, we needed to select a standard that is ready for use in ePA transactions.

Comment: Another commenter urged CMS to allow voluntary use of other standards if mutually agreed upon between trading partners.

Response: We would like to emphasize that this rule proposed the NCPDP SCRIPT standard version 2017071 ePA transactions in part because health plans are already required to support use of that same version of the standard for other transactions beginning January 1, 2020, in accordance with the April 2018 final rule. As the ePA transactions are part of version 2017071 of the NCPDP SCRIPT standard, we do not believe it would be advisable to allow voluntary use of a different version of the NCPDP SCRIPT standard as that would require all trading partners to support different versions of the standard at the same time in order to comply with Part D program requirements, which we believe would impose unnecessary burden. CMS will consider proposing use of future updates to the NCPDP SCRIPT standard in future Part D e-prescribing rules as the need arises.

In order to ensure that ePA permeates across the industry for Part D and that multiple Part D stakeholders can participate in it, we believe that one Part D ePA standard should be used rather than simply allowing any stakeholder to use his/her preferred standard.

In addition, based on our analysis of available standards that led to our proposing to adopt the NCPDP SCRIPT standard version 2017071 for ePA under Part D, we question how many trading partners would wish to support the added cost and complexity of using ePA transactions drawn from an entirely different standard. Requiring consistent use of the same ePA standards throughout the Part D eRx program also ensures all plans and prescribers serving Part D eligible patients are able to conduct ePA transactions with one another.

Comment: One commenter noted that although they do not disagree with our characterization of the X12 278 transaction as the wrong type of standard for this transaction, they did alert us to the fact that the X12 278 transaction can now be used in real-time transactions, in addition to batched transactions.

Response: We thank the commenter for alerting us to this new development, and have consequently amended the statement in the background section to clarify that the X12 278 standard was not a real-time transaction in 2004.

Comment: A commenter disagreed with our statement that the SCRIPT transaction can determine whether the beneficiary's plan requires a PA for a given transaction, stating that the standard is not designed to determine whether prior authorization is required for a given transaction.

Response: We thank the commenter for this correction. We have not included this statement in the background section of this final rule.

Comment: A commenter expressed concern that this final rule would conflict with the information blocking and certification requirements from the March 4, 2019, Office of the National Coordinator for Information Technology (ONC) notice of proposed rulemaking (NPRM) (84 FR 7424), should it be finalized. Another commenter urged HHS to incorporate the NCPDP ePA transaction standard into future certification editions from ONC.

Response: In ONC's May 1, 2020 final rule titled “21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program” (ONC 21st Century Cures Act final rule), ONC finalized policies which directly align with the standard adopted in this final rule that supports ePA transactions and standards (85 FR 25642). Specifically, the ONC 21st Century Cures Act final rule adopted the NCPDP SCRIPT standard version 20170701 for Health IT Modules seeking certification to the § 170.315(b)(3) electronic prescribing criterion under the ONC Health IT Certification Program. The ONC 21st Century Cures Act final rule also adopted the ePA transactions in the NCPDP SCRIPT standard version 2017071 as optional for the updated §  170.315(b)(3) electronic prescribing criterion (85 FR 25685). As noted in the 21st Century Cures Act final rule, ONC believes the adoption of the ePA transactions included in version 2017071 of the NCPDP SCRIPT standard as optional transactions within this certification criteria supports alignment between the health IT certification program and Part D ePA policy.

We also note that CMS published the Patient Access and Interoperability final rule (85 FR 25510) concurrently with ONC's 21st Century Cures Act final rule on May 1, 2020. The CMS final rule requires certain payers, such as such as MA plans and Medicaid and CHIP programs, to make enrollee electronic health information held by the payer available through application programming interfaces (APIs) conformant to HL7 FHIR and other API standards that ONC adopted in 45 CFR 170.215.

Neither rule finalized a standard for conduct of ePA, nor did they require ePA be conducted through APIs conformant with the FHIR standard. The purpose of the current rule is to encourage the exchange of electronic health information by naming a standard suitable to support ePA by January 1, 2021. We will continue to monitor efforts within the health IT industry to support electronic prescribing transactions through emerging standards such as HL7 FHIR and technologies like APIs and will consider such developments in future rulemaking.

Comment: A commenter expressed concern that this rule would conflict with the CMS Interoperability and Patient Access proposed rule that was issued on March 4, 2019 (84 FR 7610), should it be finalized. In CMS Interoperability and Patient Access proposed rule, we noted that in June 2018, in support of the Da Vinci project (a private-sector initiative led by Health Level 7 (HL7), the CMS Medicare FFS program began: (1) Developing a prototype Documentation Requirement Lookup Service for the Medicare FFS program and (2) populating it with the list of items/services for which prior authorization is required by the Medicare FFS program (84 FR 7613).

Response: This rule can be finalized, as proposed, without conflicting with the CMS Interoperability and Patient Access final rule (85 FR 25510) which did not require payers to develop a prototype Documentation Requirement Lookup Service (DRLS). The DRLS was described in the proposed rule as work CMS was doing related to HL7 FHIR standards. We believe that the listing of items or services for purposes of a DRLS, as encouraged by CMS, is separate and distinct from requiring that a certain standard be used for ePA transactions for prescribers. This rule would require only the latter in the Part D eRx program context. Although CMS has recently proposed a rule requiring payers to use DRLS (85 FR 82586), this requirement does not extend to Part D. As a result, we continue to believe that this is separate and distinct from the requirements of this final rule.

Comment: A few commenters questioned whether pharmacies would be permitted to actively use the NCPDP SCRIPT standard version 2017071 transactions for ePAs performed on behalf of a beneficiary enrolled in Part D. One of these commenters stated that pharmacies that serve beneficiaries in long term care (LTC) settings would benefit from using the ePA transactions. They noted that applicable state laws permit dispensers to fulfill the terms of a prior authorization and suggest that we change the verbiage of the proposed regulation to allow “dispensers (as applicable)” to the parties required to use the NCPDP SCRIPT standard version 2017071 ePA transactions adopted in this final rule.

Response: We appreciate the commenters' concerns. However, this rule does not seek to change the current regulation with regard to who may request a PA on behalf of the beneficiary. Under our regulation at § 423.566(c), a pharmacy cannot request a coverage determination on behalf of an enrollee, unless the pharmacy is the enrollee's appointed representative. We believe that changing who may request a PA is outside the scope of the proposed rule. However, we will take the suggestion under advisement.

Comment: A commenter requested that CMS use this regulation as an opportunity to implement other provisions of the SUPPORT Act, such as section 2003 of the SUPPORT Act requiring the use of e-prescribing for opioids.

Response: We understand the importance of ensuring that all provisions of the SUPPORT Act are implemented. However, what is suggested in this comment is outside the scope of this rule, as the proposed rule only sought to implement section 6062 of the SUPPORT Act—not the entirety of the Act.

Comment: A commenter noted that the proposed NCPDP SCRIPT standard does not in itself prepopulate National Drug Codes (NDCs), rather NDCs are prepopulated by eRx and EHR systems if they are capable of doing so and set up to pre-fill such fields with known values.

Response: Upon re-evaluation we now understand that these NDCs are indeed completed by eRx and EHR systems with certain capabilities that are set up to do this work. During our initial research we had seen that the NDCs were widely prepopulated and incorrectly attributed this to the NCPDP SCRIPT standard. We appreciate this correction. In light of this understanding, we believe that the promulgation of a single standard electronic ePA for Part D-covered drugs prescribed to Part D-eligible individuals will encourage any remaining eRx and EHR vendors that do not offer the functionality to prepopulate NDCs to begin to do so, and continue to follow the NCPDP SCRIPT implementation guide.

Comment: A commenter clarified that the NCPDP Telecommunications standard D.0 is, indeed, a real time transaction.

Response: We appreciate the opportunity to further explain our assertions in the proposed rule. As the commenter states, the NCPDP Telecommunications D.0 standard is, indeed, a real time standard. However, because it is designed as a transaction between the pharmacy and the plan, it does not allow a prescriber to transmit information necessary to satisfy a prior authorization in real time. In practical terms when a drug is subject to prior authorization the Telecommunications standard conveys a real-time rejection to the pharmacy but leaves the prescriber unaware of the rejection, and unable to convey information to the plan which would satisfy the terms of the PA. To our knowledge, the NCPDP SCRIPT standard version 2017071 remains the only mechanism by which a prescriber can satisfy the terms of a prior authorization electronically in real time.

Comment: One commenter recommended that we amend our regulation text so that it states that the prescription-related information flows between prescribers and Part D sponsors, rather than prescribers and dispensers, which is what we stated in the proposed rule.

Response: We thank the commenter for the correction and have amended the text accordingly.

Comment: A commenter noted that since the May 2019 final rule amended the regulation text to include § 423.160(b)(7), the proposed rule should have been amended to include a new § 423.160(b)(8).

Response: We appreciate this comment and are finalizing the proposal in § 423.160(b)(8).

Comment: A commenter noted that some of the citations to the HIPAA standards at section 1860D-4(e)(4) of the Act and the new SUPPORT Act mandate at section 1860D-4(e)(2)(E)(ii)(III) of the Act were incorrect.

Response: We have revised the preamble to correct the citations noted by the commenter.

After review and consideration of the comments received, and for the reasons discussed herein and in the proposed rule, we are finalizing our proposed revision, with the following modifications:

• We are finalizing proposed § 423.160(b)(7) as § 423.160(b)(8).
• We are restructuring the final regulation text to permit Part D sponsors to use the standard beginning January 1, 2021 at § 423.160(b)(8)(i), but not require its use until January 1, 2022 at § 423.160(b)(8)(ii).
• We are redesignating proposed § 423.160(b)(7)(i) through (iv) which list the covered electronic prior authorization transactions, as § 423.160(b)(8)(i)(A) through (D) in this final rule.

III. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.), we are required to provide 60-day notice in the Federal Register and solicit public comment before a “collection of information” requirement is submitted to the Office of Management and Budget (OMB) for review and approval. For the purposes of the PRA and this section of the preamble, collection of information is defined under 5 CFR 1320.3(c) of the PRA's implementing regulations.

In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the PRA requires that we solicit comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

Our June 19, 2019 (84 FR 28450) proposed rule solicited public comment on each of the required issues under section 3506(c)(2)(A) of the PRA for our proposed information collection requirements, burden, and assumptions. Two comments were received. A summary of the comments is set out in this section of the document in this section of this rule along with our response.

The following changes will be submitted to OMB for approval under control number 0938-TBD (CMS-10755). Please note that our proposed rule indicated that the changes would be submitted under control number 0938-0763 (CMS-R-262). However, based on internal review we have since determined that the changes should be set out under a new collection of information request. Importantly, the new collection of information request (0938-TBD; CMS-10755) has no effect on our proposed and final requirements and burden estimates. Rather, we are simply changing the location of those requirements and burden estimates. Please note that OMB will issue the new control number when ready. In the meantime it is to be determined (or “TBD”). The new collection of information request's CMS identification number (CMS-10755) is not subject to change.

This rule implements section 6062 of the SUPPORT Act, which requires the adoption of technical standards for the Part D e-prescribing program to help ensure secure ePA requests and response transactions. Specifically, this final rule amends the Prescription Drug Benefit program (Part D) regulations to require under § 423.160(b)(8) that Part D plan sponsors (hereinafter, “Part D plans” or “plans”) have the technical capability to support the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 2017071 when performing ePA for Part D-covered drugs prescribed to Part D-eligible individuals. While this final rule will not impact the PA criteria which Part D plans have in place, the electronic process will make the PA process less burdensome for plans and prescribers. Prescribers who are currently capable of using an electronic prescribing software likely already have access to the ePA transaction standards, and would be expected to generally be able to access the transactions without cost. As ePA is implemented, the current system of manual processing (fax and phone calls) will fade in the Part D context since plans will be able to use the adopted standard, and incentivize their prescribers to conduct ePA. We expect that prescribers will be more likely to conduct ePA now that this less burdensome standard is currently available to them.

We estimate a one-time cost for plans to implement the necessary changes to support the ePA transactions within NCPDP SCRIPT standard version 2017071. After consulting with industry stakeholders, we have concluded that implementing or building the type of logic which will allow systems engineers to produce the interactive logic which the NCPDP SCRIPT standard requires can vary based on how the PA criteria are currently documented, but $6,500 is the approximate average cost as the cost varies based on the size and expertise of the plan. The $6,500 figure includes only the plan's internal costs including labor, initial development and programming, and systems support to transform each of its CMS-approved PA criteria from a free flowing manual process suitable for telephonic or facsimile communication with a clinical professional into a 2017071-compliant step-by-step query process that can be adapted for use by programmers. Based on our internal data, we estimate that this rule will apply to 774 plans. We estimate that only 2 percent (or 15) of the plans (774 plans × 0.02) do not already have the internal ePA process capabilities that will be required to build the logic to support NCPDP SCRIPT standard version 2017071's ePA transactions. In that regard we estimate a one-time implementation cost of approximately $100,000 (15 plans × $6,500/plan) or $33,000 annually when factoring in OMB's 3-year approval period, which is required for all new Paperwork Reduction Act activities ($100,000/3 years). We are annualizing the one-time estimate since we do not anticipate any additional burden after the 3-year approval period expires.

Based on our informal conversations with the industry, we believe that the ongoing cost that plans will incur to process ePA transactions range from $1.20 to $2.85 per transaction, which varies based on vendor and volume. Based on internal CMS data, for the 774 plans we estimate that 560,430 PAs are performed every year and that each authorization requires two individual transactions, one for receiving and one for responding. Using $2.03 as the average cost per transaction ([$1.20 + $2.85]/2) we estimate $4.06 per authorization ($2.03/transaction × 2 transactions/authorization). In aggregate we project an ongoing transaction (both receiving and responding) cost of $2,275,346 annually ($4.06/authorization × 560,430 authorizations) for all plans.

With regard to current practice, 98 percent (or 15) of the plans (774 plans × 0.02) already have the capacity to process automated PAs. However, when they perform these processes manually, they spend an average of $10.00/fax PA for 549,221.4 authorizations (560,430 authorizations × 0.98) at a cost of $5,492,214 (549,221 PAs × $10.00/PA). The remaining 15 plans that rely on phone or fax and manual review spend an average of $25.00/manual PA for 11,209 authorizations (560,430 authorizations × 0.02) at a cost of $280,225, (11,209 PAs × $25.00/PA). In this regard the transaction cost for the current practice is approximately $5,729,439 ($5,492,214 + $280,225).

In addition, we believe that there will be added savings due to fewer appeals being processed. We estimate that 900 appeals are processed annually due to mistakes emanating from the use of manual PA, including missing PA information and the PAs not being received by the correct party. We believe that these appeals would be eliminated, since ePA requires input of all necessary information for the transactions to be processed and provides a secure means of delivery to the recipients. We estimate that it costs $101.63 to process each of these appeals based on the 1.25 hours at $69.72/hr that it takes a quality officer at each organization to process the appeal and the cost of sending the appropriate notices, which would lead to a savings to plans of $91,467 (900 appeals × $101.63). When we add this savings to the $3,454,093 already saved, we project a total annual savings of $3,454,560 ($3,454,093 + $91,467). This figure differs slightly from the estimate that was set out in our June 19, 2019 proposed rule. That rule had inadvertently excluded the savings emanating from the revised number of appeals. In addition, the rule had overestimated the amount of plans that would need to make changes to implement the standard and the burden to implement it. We are correcting that oversight in this final rule.

Since this final rule only requires plans, and not prescribers, to implement the standard, we are not estimating costs that assume prescribers will transition to this standard. As a result, we did not include the aforementioned transaction costs and appeals savings in our tabulation of the final costs of implementing this rule. Therefore, we believe that the final cost of this rule will be the $100,000 for plans to implement this standard. As indicated, we received public comments related to the PRA. The following summarizes the comments and provides our response:

Comment: A commenter requested that CMS include the burden to physicians. Another commenter expressed concern about the potential costs to practices to switch to the new standard, and requested that we bar EHR vendors from passing on additional transaction costs to providers or patients. Another commenter stated that they believe our assumption incorrectly assumed that a provider's electronic prescribing software already has support for all NCPDP SCRIPT transactions.

Response: We thank commenters for the information about other factors that we should consider when estimating the implementation costs for providers to implement a new standard. However, we clarify that this rule imposes requirements only on Part D plans—if physicians elect to utilize ePA in the Part D program context, they will be required to do so using the adopted standard, but they are free to conduct PA through other means. We believe our proposed rule incorrectly included prescriber costs in our estimates. We have removed these estimates from the calculations on this final rule. While we understand the potential costs for providers and EHR vendors to pass on transaction costs to providers or plans, we do not have the statutory authority to regulate EHRs. As previously mentioned, this final rule implements section 1860D-4(e)(2)(E) of the Act requiring that the program provide for the secure electronic transmission of prior authorization requests and responses. However, this section of the Act does not expand CMS's authority to allow the agency to regulate EHR vendors or specify who may bear the cost of implementing the transaction. As a result, we are not able to adopt this commenter's suggestion that we bar EHR vendors from passing on transactions costs to providers or patients.

Comment: A commenter requested that CMS revise its estimates to account for ongoing maintenance costs associated with ePA.

Response: We acknowledged in the proposed rule that there would be a cost associated with maintenance of systems to support electronic prior authorizations. These costs are included in our ongoing methodology which, based on our research, we estimated to range from $1.20 to $2.85 per transaction for a total of $2.27 million. Since commenters did not provide specific feedback on the veracity of this estimate, we will finalize the estimates as initially presented.

IV. Regulatory Impact Statement

A. Statement of Need

This rule implements provisions of the SUPPORT Act, which require the adoption of transaction standards for the Part D program that will help ensure secure electronic PA request and response transactions. Specifically, this final rule amends the Prescription Drug Benefit program (Part D) regulations to require that Part D sponsors have the technical capability to support the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 2017071 when performing electronic Prior Authorization (ePA) for Part D-covered drugs prescribed to Part D-eligible individuals.

B. Overall Impact

We have examined the impact of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), the Congressional Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017).

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any one year). This rule does not reach the economic threshold and thus is not considered a major rule.

The RFA requires agencies to analyze options for regulatory relief of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of less than $7.5 million to $38.5 million annually. Individuals and states are not included in the definition of a small entity. We are not preparing an analysis for the RFA, because we have determined, and the Secretary certifies, that this final rule will not have a significant economic impact on a substantial number of small entities.

In addition, section 1102(b) of the Act requires us to prepare an RIA if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area for Medicare payment regulations and has fewer than 100 beds. We are not preparing an analysis for section 1102(b) of the Act because we have determined, and the Secretary certifies, that this rule will not have a significant impact on the operations of a substantial number of small rural hospitals.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any one year of $100 million in 1995 dollars, updated annually for inflation. In 2020, that threshold is approximately $156 million. This rule will have no consequential effect on state, local, or tribal governments or on the private sector.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. Since this rule does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.

If regulations impose administrative costs on reviewers, such as the time needed to read and interpret this final rule, then we should estimate the cost associated with regulatory review. There are currently 774 PD contracts (excluding PACE organizations, since they are not affected by this regulation)). We assume each entity will have one designated staff member who will review the entire rule. Other assumptions are possible and will be reviewed after the calculations, in this section of this rule.

Using the wage information from the Bureau of Labor Statistics (BLS) for medical and health service managers (code 11-9111), we estimate that the cost of reviewing this final rule is $107.38 per hour, including fringe benefits and overhead costs (http://www.bls.gov/​oes/​current/​oes_​nat.htm). Assuming an average reading speed, we estimate that it will take approximately 12.5 hours for each person to review this final rule. For each entity that reviews the rule, the estimated cost is therefore, $1,342 (12.5 hours × $107.38). Therefore, we estimate that the total cost of reviewing this final rule is $1,342,000 ($1,342 × 1,000 reviewers).

Note that this analysis assumed one reader per contract. Some alternatives include assuming one reader per parent entity. Using parent organizations instead of contracts will reduce the number of reviewers to approximately 500 (assuming approximately 250 parent organizations), and this will cut the total cost of reviewing in half. The argument for this is that a parent organization might have local reviewers; even if that parent organization has several contracts that might have a reader for each distinct geographic region, to be on the lookout for effects of provisions specific to that region.

Executive Order 13771, titled Reducing Regulation and Controlling Regulatory Costs, was issued on January 30, 2017 (82 FR 9339, February 3, 2017). It has been determined that this rule does not impose more than a de minimis costs; and thus, is not a regulatory action for purposes of E.O. 13771.

C. Anticipated Effects

As stated previously, section 6062 of the SUPPORT Act requires the adoption of technical standards for the Part D program that will ensure secure ePA request and response transactions no later than January 1, 2022, and allows for Part D sponsors to begin using the standard by January 1, 2021. We are codifying requirements at § 423.160, which require plans to support the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 2017071 by January 1, 2022 when performing ePA for Part D-covered drugs prescribed to Part D-eligible individuals. This final rule has the following impacts.

Entities affected by the PA processes include pharmacies receiving ePAs from providers and filling the prescription, prescribers who use ePA, the Medicare Part D Program, Part D plans, EHR vendors who need to modify their products, and the Promoting Interoperability Programs, for any Part D prescribers in these programs. Information about what programs are included in the Medicare Promoting Interoperability Programs is available via this web link: https://www.cms.gov/​Regulations-and-Guidance/​Legislation/​EHRIncentivePrograms/​index.html?​redirect=​/​EHRincentiveprograms. We do not anticipate any impacts to the Medicare program, beneficiaries, or other stakeholders.

There are three primary aspects of the provision that could affect its cost and the amount saved. The most immediate cost comes from the one-time implementation cost for the few EHR vendors that need to need to change their programming to use two standards; the NCPDP SCRIPT standard version 2017071 for Part D ePA and the HIPAA standard for other contexts. Based on our conversations with EHR vendors, we believe that it will take the EHR vendors approximately 200 developing hours and 800 programming hours to enable the EHRs to utilize two standards.

We also estimated what it will cost plan sponsors to implement this standard. After consulting with industry stakeholders, we have concluded that implementing or building to the SCRIPT standard can vary, but $6,500 is the approximate amount per plan and $100,000 is the approximate amount for the industry. We estimate that only 2 percent of the 774 plans will have to make changes to their ePA process to implement the NCPDP SCRIPT standard version 2017071 ePA transactions, which gives us an approximate one time implementation cost of $100,000 (15 * $6,500).

E. Alternatives Considered

We considered requiring the adoption of the standard by January 1, 2021 to ensure that this important mandate was implemented quickly. However, we want to help ensure that plans have as much time to comply with the statutory mandate as possible.

F. Accounting Statement and Table

The following table summarizes overall costs for this rule. The cost comes from implementing the new standard.

	2022	2023	2024	2025	2026
Total Costs	$100,000
Net Savings

List of Subjects in 42 CFR Part 423

• Administrative practice and procedure
• Emergency medical services
• Health facilities
• Health maintenance organizations (HMO)
• Health professionals
• Incorporation by reference
• Medicare
• Penalties
• Privacy
• Reporting and recordkeeping requirements

For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services amends 42 CFR part 423 as set forth below:

PART 423—VOLUNTARY MEDICARE PRESCRIPTION DRUG BENEFIT

1. The authority citation for part 423 continues to read as follows:

Authority: 42 U.S.C. 1302, 1306, 1395w-101 through 1395w-152, and 1395hh.

2. Section 423.160 is amended by adding paragraph (b)(8) to read as follows:

§ 423.160

Standards for electronic prescribing.

* * * * *

(b) * * *

(8) Electronic prior authorization. (i) Beginning January 1, 2021, Part D sponsors and prescribers may use the National Council for Prescription Drug Programs SCRIPT standard, Implementation Guide Version 2017071 approved July 28, 2017 (incorporated by reference in paragraph (c)(1)(vii) of this section), to provide for the communication of a prescription or prescription-related information between prescribers and Part D sponsors for the following transactions:

(A) PAInitiationRequest and PAInitiationResponse.

(B) PARequest and PAResponse.

(C) PAAppealRequest and PAAppealResponse.

(D) PACancelRequest and PACancelResponse.

(ii) Beginning January 1, 2022, Part D sponsors and prescribers must use the standard specified in paragraph (b)(8)(i) of this section for the transactions listed in paragraphs (b)(8)(i)(A) through (D) of this section.

* * * * *

Dated: February 6, 2020.

Seema Verma,

Administrator, Centers for Medicare & Medicaid Services.

Dated: March 13, 2020.

Alex M. Azar II,

Secretary, Department of Health and Human Services.

Editorial note:

This document was received for publication by the Office of the Federal Register on December 23, 2020.

Footnotes

1.  https://www.cms.gov/​About-CMS/​story-page/​patients-over-paperwork.html.