2019-13028. Medicare Program; Secure Electronic Prior Authorization for Medicare Part D

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Proposed rule.

SUMMARY:

This rule proposes a new transaction standard for the Medicare Prescription Drug Benefit program's (Part D) e-prescribing program as required by the “Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act” or the “SUPPORT for Patients and Communities Act.” Under the SUPPORT for Patients and Communities Act, the Secretary is required to adopt standards for Part D e-prescribing program to ensure secure electronic prior authorization request and response transmissions. If finalized, the proposals in this rule would amend the Part D e-prescribing regulations to require Part D plan sponsors' support of version 2017071 of the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard for use in electronic Prior Authorization (ePA) transactions with prescribers regarding Part D covered drugs to Part D-eligible individuals.

DATES:

To be assured consideration, comments must be received at one of the addresses provided, no later than 5 p.m. on August 16, 2019.

ADDRESSES:

In commenting, please refer to file code CMS-4189-P. Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission.

Comments, including mass comment submissions, must be submitted in one of the following three ways (please choose only one of the ways listed):

1. Electronically. You may submit electronic comments on this regulation to http://www.regulations.gov. Follow the “Submit a comment” instructions.

2. By regular mail. You may mail written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-4189-P, P.O. Box 8013, Baltimore, MD 21244-8013.

Please allow sufficient time for mailed comments to be received before the close of the comment period.

3. By express or overnight mail. You may send written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-4189-P, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.

For information on viewing public comments, see the beginning of the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT:

Joella Roland [phone].

SUPPLEMENTARY INFORMATION:

Inspection of Public Comments: All comments received before the close of the comment period are available for viewing by the public, including any personally identifiable or confidential business information that is included in a comment. We post all comments received before the close of the comment period on the following website as soon as possible after they have been received: http://www.regulations.gov. Follow the search instructions on that website to view public comments.

I. Background

The purpose of this rule is to propose a new transaction standard for the Part D e-prescribing program. Under this proposal, Part D plan sponsors would be required to support version 2017071 of the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard for four electronic Prior Authorization (ePA) transactions, and prescribers would be required to use that standard when performing ePA transactions for Part D-covered drugs they wish to prescribe to Part D-eligible individuals. Part D plans, as defined in 42 CFR 423.4, include Prescription Drug Plans (PDPs) and Medicare Advantage Prescription Drug Plans (MA-PDs); Part D sponsor, as defined in 42 CFR 423.4, means the entity sponsoring a Part D plan, MA organization offering a MA-PD plan, a PACE organization sponsoring a PACE plan offering qualified prescription drug coverage, and a cost plan offering qualified prescription drug coverage. The proposed ePA transaction standard would provide for the electronic transmission of information between the prescribing health care professional and Part D plan sponsor to inform the sponsor's determination as to whether or not a prior authorization (PA) should be granted. The NCPDP SCRIPT version 2017071 was approved in CMS 4182-F published on April 16, 2018 (83 FR 16440) effective June 15, 2018 and materials are incorporated by reference of certain publications listed in the rule as approved by the Director of the Federal Register as of June 15, 2018.

An ePA transaction standard would allow a prescriber using an electronic prescribing (eRx) system or an electronic health record (EHR) with eRx capability to determine whether the beneficiary's plan requires a PA for a given medication. If the prescriber enters such a prescription into an eRx system, a message will be returned to the provider indicating that a PA is required. Use of the ePA transactions would then enable the prescriber to submit the information required to fulfill the terms of the PA in real time.

A. Legislative Background

1. Health Insurance Portability and Accountability Act of 1996 (HIPAA)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) was enacted on August 21, 1996. Title II, Subtitle F of HIPAA requires covered entities—health plans, health care providers that conduct covered transactions, and health care clearinghouses—to use the standards HHS adopts for certain electronic transactions. The standards adopted by HHS for purposes of HIPAA are in regulations at 45 CFR part 162.

2. Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA)

The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173) was enacted on December 8, 2003. It amended Title XVIII of the Social Security Act (the Act) by redesignating Part D as Part E and inserting a new Part D to establish a voluntary prescription drug benefit program. As part of that program, section 1860D-4(e) of Act as added by the MMA required the adoption of Part D e-prescribing standards for electronic prescriptions and prescription-related transactions between Part D plan sponsors, providers, and pharmacies. The Secretary's selection of standards is informed by the National Committee on Vital and Health Statistics (NCVHS). Under section 1860D-4(e)(4)(B) of the Act, NCVHS develops recommendations for Part D e-prescribing standards, in consultation with specified groups of organizations and entities. These recommendations are then taken into consideration when developing, adopting, recognizing, or modifying Part D e-prescribing standards. The statute further requires that the selection of standards designed, to the extent practicable, not impose an undue administrative burden on prescribers or dispensers, are compatible with standards established under Part C of title XI of the Act (the HIPAA standards), and with general health information technology standards and permit electronic exchange of drug labeling and drug listing information maintained by the Food and Drug Administration and the Library of Medicine.

The standards adopted by CMS for purposes of the Part D e-prescribing program are in regulations at 42 CFR 423.160. Part D plan sponsors are required to support the Part D e-prescribing program transaction standards, and providers and pharmacies that conduct electronic transactions for which a program standard has been adopted must do so using the adopted standard. See the February 4, 2005 proposed rule titled “Medicare Program, E-Prescribing and the Prescription Drug Program” (70 FR 6256) for additional information about the MMA program authority.

3. Substance Use-Disorder Prevention That Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT for Patients and Communities Act)

The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (Pub. L 115-271), hereinafter referred to as the “SUPPORT for Patients and Communities Act,” was enacted on October 24, 2018. Section 6062 of the SUPPORT for Patients and Communities Act amended section 1860D-4(e)(2) of the Social Security Act to require the adoption of transaction standards for the Part D e-prescribing program to ensure secure ePA request and response transactions between prescribers and part D plan sponsors no later than January 1, 2021. Such transactions are to include an ePA request transaction standard for prescribers seeking an ePA from a Part D plan sponsor for a Part D covered drug for a Part D-eligible individual, as well as an ePA response transaction standard for the Part D plan sponsor's response to the prescriber. A facsimile, a proprietary payer portal that does not meet standards specified by the Secretary or an electronic form are not treated as electronic transmissions for the purposes of ePA requests. Such standards are to be adopted in consultation with the NCPDP or other standard setting organizations the Secretary finds appropriate, as well as other stakeholders. Finally, the SUPPORT for Patients and Communities Act also authorized the adoption of ePA transaction standards for part D covered drugs for part D eligible individuals “notwithstanding” any other provision of law.

B. Regulatory History

In 2000, the Secretary adopted HIPAA transaction standards for the “referral certification and authorization transaction”. The term “referral certification and authorization transaction” is defined at 45 CFR 162.1301 as the transmission of any of the following: (1) A request from a health care provider to a health plan for the review of health care to obtain an authorization for the health care; (2) a request from a health care provider to a health plan to obtain authorization for referring an individual to another health care provider; and (3) a response from a health plan to a health care provider to a request described in (1) or (2). The first HIPAA standard adopted for this transaction was version 4010 of the X12 278 (65 FR 50371, August 17, 2000). In 2003, the Secretary adopted another standard, the NCPDP version 5.1, for retail pharmacy drug referral certification and authorization transactions and specified that version 4010 of the X12 278 was to be used only for dental, professional, and institutional referral certification and authorization transactions (see the February 20, 2003 Federal Register (68 FR 8398)). Still, as of 2003, the Secretary had not adopted a standard for ePA for medications specifically.

In 2004, NCPDP formed a multi-industry, multi-Standards Development Organization (SDO) ePA Task Group to evaluate existing PA standards and promote standardized ePA, with a focus on the medication context. The Task Group considered the X12 278 standard, but determined that there were certain gaps in the X12 278 standard that made the standard difficult to use for ePA, including that the standard was unable to support attachments for PA determinations, incorporate free text in certain fields, and allow functionality for real-time messaging. As a result of these findings, the Task Group wrote a letter to the HHS Secretary stating that the X12 278 standard offered limited support for ePA and urged HHS to test new versions of the standard.

In 2006, CMS made awards to grantees as part of a pilot to test e-prescribing standards. The participants in the pilot identified further gaps in the X12 278 standard that made it inadequate for use with medication PAs. These gaps included no mechanism for providers to request and explain reasons for deviating from standard medication dosing instructions, requiring certain fields that are not applicable to drugs, and no limit on diagnosis codes, which required clinicians to select from hundreds of options to find the appropriate code.

After the pilot, stakeholders continued to try to improve the X12 278 standard by starting the process of adding new fields to the X12 278 standard to try to make it better able to support ePA. However, after testing the modified X12 278 standard in 2006, NCPDP determined that the improved X12 278 standard was still inadequate to support ePA, due to the inability to exchange transactions in real-time.

On January 16, 2009, the Secretary adopted later versions of the HIPAA transaction standards, requiring NCPDP Telecommunications D.0 instead of NCPDP 5.1 and version 5010 instead of version 4010 of the X12 278 to be used for referral certification and authorization transactions (74 FR 3326) because it was determined that the X12 278 standard served the needs for non-pharmacy claims. These standards are specified at 45 CFR 162.1302(b)(2).

However, these revised standards still have the same impediments for ePA as they still require information such as the patient diagnosis code which is not available on prescription processing and omits other information needed for ePA such as directions and dose. Further, it remains a batch standard which does not accommodate the real time nature of prescription claims.

In the meantime, interest was once again building in the industry to develop and test alternative ePA transaction standards. NCPDP took into account its experience with previous transaction standards as it began to frame what would ultimately become its NCPDP SCRIPT ePA standard, version 2013101, which included the ability to send attachments in a standardized format. In a May 15, 2014 letter to the HHS Secretary, NCVHS stated that they had received a letter from the NCPDP recommending its SCRIPT Standard Version 2013101 standard for carrying out medication ePA transactions. (For more information see, https://ncvhs.hhs.gov/​wp-content/​uploads/​2014/​05/​140515lt2.pdf.) NCVHS reported hearing from NCPDP stakeholders that NCPDP investigators tasked with reviewing the X12 278 standard for use as an ePA transaction found that the HIPAA transaction standards for PA transactions (the 278 v4010 or v5010) were not adequate to support medication PA. The standard was designed for PA of procedures/services or durable medical equipment (DME), so did not adequately accommodate the information necessary to facilitate medication PA. NCPDP also noted that X12 278 is not widely used for ePA of prescription medications as evidence of its inadequacy for this purpose.

In response to NCVHS' May 2014 letter, we reviewed the X12 278, and found that the X12 278 standard is designed to conduct batch transactions which could not be used to support real time prescribing. For example, if a PA were to be submitted using the X12 278 standard, the PA would not accommodate a field for National Drug Codes (NDCs) and dosage information field, which are integral when evaluating medication requests. Since the X12 278 standard does not have a standard method to process ePA transactions, prescribers would have to find a place to insert NDCs and look up the codes using another source. In contrast, NCPDP SCRIPT ePA Version 2013101 and 2017 transactions are prepopulated with all NDCs and dosage information so the prescriber can choose among appropriate options.

Another standard that we are aware of is the NCPDP Telecommunications D.0 standard. However, this standard, does not have the ability to look up and convey NDCs and dosages. The NCPDP Telecommunications D.0 standard was designed to be a standard for insurance companies to approve claims, so it does not include content fields that are relevant to ePA, such as clinical fields and beneficiary-specific information nor does it have the ability to transmit information in real time. As such it is not frequently used by prescribers because it cannot collect information needed for satisfying a medication PA.

In our review of the standard, CMS found that the X12 278 standard is by nature a batch standard which cannot support real-time consideration of prescriptions. For example if a PA were to be submitted using the X12 278 standard, the PA would not be submitted to the plan until the following day, the plan would review it in the second day and, if all the information were correct, the approval would be conveyed back to the physician 3 days after the prescription was captured in the batching process. The reason for this is because the X12 278 is designed to batch the transactions, since this is what is optimal in the DME context. However, this is not optimal in the ePA context, since it would result in ePA transactions taking days to process. Resolution of the ePA would be further delayed if the plan needed additional information on the PA request.

This is in contrast to the SCRIPT ePA standard, which conveys information to the plan in real time that allows the patient to access a medication subject to PA the same day that the prescription and ePA are submitted.

In addition, X12 278 collects a standard set of information. However, PA criteria vary by medication being authorized: For some medications the plan may need to determine whether the patient had been on the same medication previously, or on another comparable medication or what the mediation is being used for, while for other medications this may not be necessary. In contrast, the SCRIPT ePA transaction requires that plans develop specific sets of questions for each drug that requires PA so that they can be answered when the ePA is submitted.

Finally, there is an inconsistency between the types of information that are required to be submitted on a DME claim, which is what the X12 278 transaction was designed to support, and the type of information that is required to be submitted for medications. For example, the X12 278 standard requires the diagnosis to be submitted, which is not required on prescription claims, but it does not accommodate a field for National Drug Codes (NDCs) and dosage information fields that are integral when evaluating medication requests. Because the X12 278 transaction is not specifically created to process medications, prescribers would have to find a place to insert NDCs and look up the codes using another source. In contrast, the SCRIPT ePA standard is prepopulated with all NDCs and dosage information so the prescriber can chose among appropriate options.

Despite these findings and NCPDP recommendation to NCVHS, we did not pursue proposing the NCPDP SCRIPT Standard Version 2013101 as a Part D eRx standard for medication PA transactions because it was contrary to the HIPAA requirements, which require use of the X12 278 standard. Similarly, when NCPDP wrote on May 24, 2017 to CMS to recommend the adoption of its NCPDP SCRIPT Standard Version 2017071, we were unable to consider it for the Part D e-prescribing program unless the HIPAA transaction standards for referral certifications and authorizations were modified.

The Part D e-prescribing program's authorizing statute requires selection of Part D standards that are compatible with the HIPAA standards (see section 1860D-4(e)(4) of the Act), so we have historically ensured that our Part D e-prescribing program standards are compatible with the HIPAA transaction standards. (For additional information, see the February 4, 2005 proposed rule (70 FR 6256).)

However, given the new authority under the SUPPORT for Patients and Communities Act, we believe we now have authority to adopt Part D eRx ePA transaction standards “notwithstanding” any other provision of law if such proposals are framed in consultation with stakeholders and the NCPDP or other standard setting organizations the Secretary finds appropriate. See section 1860D-4(e)(2)(E)(ii)(III) of the Act, as amended by section 6062 of the SUPPORT for Patients and Communities Act. We believe that this provision explicitly authorizes us to require the use of a PA standard in the Part D context that is different from the HIPAA standard, as long as it is for a Part D-covered drug prescribed to a Part D-eligible individual.

As previously described, Part D plan sponsors are required to establish electronic prescription drug programs that comply with the e-prescribing standards that are adopted under e-prescribing program's authorizing statute. There is no requirement that prescribers or dispensers implement eRx. However, prescribers and dispensers who electronically transmit and receive prescription and certain other information regarding covered drugs prescribed for Medicare Part D-eligible beneficiaries, directly or through an intermediary, are required to comply with any applicable standards that are in effect.

The Part D e-prescribing program currently requires providers and dispensers to utilize the NCPDP SCRIPT standard, Implementation Guide Version 10.6, which was approved November 12, 2008, for the communication of a prescription or prescription-related information for certain named transactions. However, as of January 1, 2020, we established through rulemaking that prescribers and dispensers will be required to use the NCPDP SCRIPT standard, Implementation Guide Version 2017071, which was approved by the NCPDP on July 28, 2017 to provide for the communication of prescription or prescription-related information between prescribers and dispensers for the transactions for which prior versions of the NCPDP SCRIPT standard were adopted with old named transactions, and a handful of new transactions named at § 423.160(b)(2)(iv). (For more information, see the April 16, 2018 final rule titled “Medicare Program; Contract Year 2019 Policy and Technical Changes to the Medicare Advantage, Medicare Cost Plan, Medicare Fee-for-Service, the Medicare Prescription Drug Benefit Programs, and the PACE Program” (83 FR 16635 through 16638) and for a detailed discussion of the regulatory history of e-prescribing standards see the November 28, 2017 proposed rule (82 FR 56437 and 56438).)

While not currently adopted as part of the Part D eRx standard, the NCPDP SCRIPT standard version 2017071 includes 4 transactions that would enable the prescribers to initiate medication ePA requests with Part D plan sponsors at the time of the patient's visit. These four transactions include: The PA initiation request/response, PA request/response, PA appeal request/response, and PA cancel request/response. As noted previously, historically we were unable to name the ePA transactions within the 2017071 standard as Part D e-prescribing program standards because the Part D program was previously required to adopt standards that were compatible with the HIPAA standards, and HIPAA covered entities are currently required to use the X12 278 to conduct referral certification and authorization transactions between health plans and health care providers.

II. Proposed Adoption of the NCPDP SCRIPT Standard Version 2017071 as the Part D ePA Transaction for the Part D Program

A. PA in the Part D Context

All Part D plans, as defined under § 423.4, including PDPs, MA-PDs, PACE Plans offering qualified prescription drug coverage, or Cost Plans offering qualified prescription drug coverage, can use approved PA processes to ensure appropriate prescribing and coverage of Part D-covered drugs prescribed to Part D-eligible individuals. We review all proposed PA criteria as part of the formulary review process. In framing our PA policies, we encourage PDP and MA-PD sponsors to consistently utilize PA for drugs prescribed for non-Part D covered uses and to ensure that Part D drugs are only prescribed when medically appropriate. Non-Part D covered uses may be indicated when the drug is frequently covered under Parts A or B as prescribed and dispensed or administered, is otherwise excluded from Part D coverage, or is used for a non-medically accepted indication. (See Medicare Prescription Drug Manual, chapter 6, section 30.2.2.3.) Part D sponsors must submit to CMS utilization management requirements applied at point of sale, including PA.

We may also approve PA for a drug when the Part D plan desires to manage drug utilization, such as when step therapy is required, or when it needs to establish whether the utilization is a continuation of existing treatment that should not be subject to the step therapy requirements, or to ensure that a drug is being used safely or in a cost-effective manner. Formulary management decisions must be based on scientific evidence and may also be based on pharmacoeconomic considerations that achieve appropriate, safe, and cost-effective drug therapy.

The PA process has historically been handled via facsimile exchange of information or telephone call, and only recently via payer-specific web portals. However, there is an overall consensus among stakeholders testifying to NCVHS that there is a need for real time PA at the prescriber level for electronic prescribing. Minutes from NCVHS meetings can be accessed at https://ncvhs.hhs.gov/​meetings-meeting/​all-past-meetings/​. We believe this would improve patient access to required medications.

B. PA for Part D E-Prescribing

In order to meet the SUPPORT for Patients and Communities Act's mandate to adopt an ePA transaction standard for the Part D-covered drugs prescribed to Part D-eligible individuals, CMS identified ePA transaction standards currently in use by pharmacies and prescribers. These included the X12 278 and NCPDP Telecommunications D.0 standards, the NCPDP SCRIPT standard version 2017071, and earlier versions of the NCPDP SCRIPT standard. We quickly ruled out the use of older NCPDP SCRIPT standards based on our assessment of the enhanced functionality available in the NCPDP SCRIPT version 2017071.

We then considered the needs of the Part D program; the functionalities offered by the remaining two standards; NCVHS recommendations, stakeholder recommendations based on their experience developing, vetting, evaluating, revising, and using the standards constructed by the respective Standards Development Organizations (SDOs) including NCPDP, the burden on stakeholders to use the standard, the security offered by the standard; and the current EHR capabilities of the industry in order to estimate the potential burden each standard would impose if it were to be adopted in the Part D context. SDOs work to formulate health and safety standards based on guidelines, best practices, specifications, test methods, and/or designs.

The X12 278 and NCPDP Telecommunications D.0 are already used as the HIPAA standards for referral certification and PA for dental, professional and institutional transactions, and retail pharmacy drugs transactions, respectively. However, the NCPDP Telecommunications D.0 standard was designed to be a standard for insurance companies to approve claims and is only used in “pharmacy to plan” transactions, so it does not include all of the content fields that are relevant to ePA nor does it have the ability to transmit information in real time. We then considered the X12 278.

Based on review of NCPDP's testimony and the letters received from NCVHS, we found that the NCPDP and its participant organizations have concluded and presented to NCVHS via testimony at hearings that the X12 278 standard is not adequate to enable ePA in the e-prescribing context because it does not support “real-time” medication e-prescribing, meaning a prescriber seeking ePA during the patient encounter. This is due to the content logic of the standard, which does not have the technical capabilities to allow for next question logic, which allows the prescriber to determine medication alternatives and determine within minutes if the medication will be authorized or if a coverage determination is required. In addition, the fields, transaction messaging, software functioning are not standardized to include information relevant to ePA and contain mandatory questions that are unnecessary for medication PA. Unfortunately, prescribers are unable to customize these fields as needed for medication PA.

These findings are outlined in NCPDP's 2016 written testimony to NCVHS, which is available via this web link: https://www.ncvhs.hhs.gov/​wp-content/​uploads/​2016/​01/​Part-2-Attachments-NCPDP-WrittenOnly.pdf,, urging the exemption of medication transactions from the X12 278 transaction standard, and its May 24, 2017 recommendation to adopt the NCPDP SCRIPT Standard Version 2017071 for ePA transactions in the HIPAA context, with a 24 month implementation time period, due to the extensive coding required by Electronic Health Records (EHRs) and Part D plans to implement the change.

Although NCPDP's recommendation was to adopt this standard for all HIPAA transactions, the Department has not promulgated rulemaking on this point. Based on conversations with the industry, our own assessment of the standard, and under the authority provided by Congress to require the use of a standard for Part D ePA notwithstanding any other provision of law, we have concluded that the potential benefits of adopting user-friendly ePA for the Part D program outweigh any difficulties that may arise by virtue of Part D using a different standard than the rest of the industry.

More specifically the NCPDP SCRIPT standard will support an electronic version of today's PA process by providing standardized information fields that are relevant for medication use, mandatory questions, transaction messaging, and standardized ePA data elements and vocabulary words for exchanging the PA questions and answers between prescribers and payers, while also allowing the payers to customize the wording of the questions using free form fields. Although the X12 278 standard has standard information fields, mandatory questions, transaction messaging and standardized data element and values, we believe those fields are relevant only for DME use—and would not be conducive to medication ePA. Since the X12 278 does not allow payers to customize the wording of questions, it is difficult for parties to decide how to fill out the fields. The NCPDP SCRIPT Standard was designed to support medication ePA, the standard also supports features that minimize what the prescriber is asked, creating a customized experience based on earlier answers or data pulled using automated functions from their EHR system, which would reduce the amount of time a prescriber or their staff spend reviewing and responding to the PA questions We understand that this functionality works with most EHR systems, and can be customized based on what information is requested by the plans. It additionally supports software functions that allow for automation of the collection of data required for ePA consideration from data available within most EHR systems or other PA transaction fields.

Furthermore, unlike the X12 278, the NCPDP SCRIPT version 2017071 standard supports solicited and unsolicited models. A solicited model occurs when the prescriber notifies the payer that they wish to start the PA process to determine if an authorization is needed for the patient and their desired medication. The prescriber requests guidance as to what information will be required for an ePA request for a particular patient and medication. The payer then responds either with a description of the information required, or an indication that a PA is not required for that patient and medication. An unsolicited model can be used when the information generated in this first interchange of the solicited model is not required, where the prescriber presumes or knows that an authorization will be required based on past experience or other knowledge and they will submit the information they anticipate the payer needs.

We found that while X12 278 uses Electronic Data Interchange (EDI) syntax, the NCPDP SCRIPT standard version 2017071 uses XML syntax. XML helps ensure security of transactions through the encryption of personal health information and through use of XML transaction processing. XML is a newer syntax that provides for an easier interaction between different formats and is more easily readable when system issues arise. By contrast, EDI is an older syntax more commonly used when there are few companies that conduct more standard interactions between each other.

Based on this evaluation of the candidate standards, coupled with the recommendations from NCPDP, CMS concluded that the NCPDP SCRIPT standard version 2017071 is the most appropriate standard to propose for the Part D e-prescribing program.

We recognize that this proposed rule would not change the ePA transaction standards that may be used outside of the Part D context. We do not believe that it will be problematic for plans to use one standard for Part D and another standard outside of Part D, if that is the case for the plan, because we believe that the industry is equipped to use different standards for different health plans and programs. We understand that based on our conversations with the industry, most EHRs are capable of generating transactions using more than one standard for a given transaction, and that they are programmed in a manner that would guide a prescriber to select the correct standard for a given transaction.

Finally, we considered whether adopting the NCPDP SCRIPT Standard version 2017071 for ePA would create any difficulties if an individual had multiple forms of drug coverage or wished to pay cash for their prescription. The SUPPORT for Patients and Communities Act specifies that the adopted standard shall be applicable for ePA of covered Part D drugs being prescribed to Part D-eligible individuals. The Act requires that the drug be a Part D-covered drug, and that the patient is Part D-eligible, but it stops short of requiring that the prescribed drug be paid for by the Part D plan. Thus, even if a prescriber were to use the SCRIPT ePA to seek part D PA, the beneficiary's right to pay for the drug him or herself, or to use non-Part D coverage to pay for the drug would be unaffected. However, we note, that the prescriber would not use the SCRIPT ePA to seek ePA with non-Part D plans. We expect that their EHR's eRx function would be capable of using the appropriate HIPAA standard to seek ePA outside of the Part D context. Furthermore, where a patient has both a Part D plan and a supplementary payer the SCRIPT ePA can be used to process the SCRIPT ePA transaction in real time, with the claims processing transactions made in the usual manner if/when the prescription is filled. Thus, we believe our proposal would not be overly burdensome for the prescriber, even if beneficiaries seek to use their non-Part D coverage.

While the prescriber can use the SCRIPT ePA for all covered Part D-covered drugs for Part D-eligible individuals, it should refrain from using the transaction if the patient were to specifically request that the Part D benefits not be accessed.

As a result of these observations and our understanding that most of the industry is able to support NCPDP SCRIPT standards for ePA using their current EHRs, we believe that requiring plans to support and prescribers to use the NCPDP SCRIPT 2017071 ePA transactions when prescribing Part D covered drugs when they are prescribed to Part D eligible individuals would not impose an undue administrative burden on prescribers or dispensers. Therefore, based on its real time capabilities and its inherent features designed to accommodate prescriptions, we believe that the NCPDP SCRIPT standard version 2017071, which includes the following ePA transaction capabilities, would be the best available option to support ePA between prescribers and payers for Part D covered drugs prescribed to Part D-eligible individuals:

• PAInitiationRequest and PAInitiationResponse
• PARequest and PAResponse
• PAAppealRequest and PAAppealResponse
• PACancelRequest and PACancelResponse.

If these ePA transaction proposals are finalized, they would enable the electronic presentation of ePA questions and responses using secure transactions.

The SUPPORT for Patients and Communities Act states that the Secretary must adopt, and a Part D sponsor's electronic prescription program must implement the adopted ePA by January 1, 2021. As of January 1, 2020, plans will already be required to use the NCPDP SCRIPT 2017071 standard for certain Part D specified transactions, so we believe that giving plans an additional year to add ePA to that list of other NCPDP SCRIPT 2017071 transactions would not be overly burdensome and help ensure that the SUPPORT for Patients and Communities Act is implemented.

We acknowledge that covered entities are required to use the X12 278 standard for ePA under HIPAA, which is different than the standard we are proposing. (See 45 CFR 162.1301.) However, the SUPPORT for Patients and Communities Act, allows us to propose the adoption of an ePA standard for Part D-covered drugs to Part D-eligible individuals notwithstanding any other provision of law. We believe that our proposal to adopt the NCPDP SCRIPT standard version 2017071 for ePA of Part D covered drugs prescribed to Part D eligible individuals is consistent with the statutory requirement to adopt technical standards for ePA transactions under the Act, which allows the Secretary to require use of standards in lieu of any other applicable standards for an electronic transmission of an ePA nothwithstanding any other provision of law.

Therefore, we propose to add § 423.160(b)(7) which would require that Part D plans be able to support the NCPDP SCRIPT ePA standard transactions included within version 2017071 beginning on January 1, 2021, and that prescribers use that standard when conducting ePA by the same date. The proposed ePA standard applies to the following list of ePA transactions:

• PAInitiationRequest and PAInitiationResponse
• PARequest and PAResponse
• PAAppealRequest and PAAppealResponse
• PACancelRequest and PACancelResponse

We welcome comments on the proposed adoption of the NCPDP SCRIPT standard version 2017071 eRx for these ePA transactions for Part D- covered drugs prescribed to Part D eligible individuals. We are also soliciting comments regarding the impact of these proposed transactions and the proposed effective date on industry and other interested stakeholders, including whether the implementation of a NCPDP SCRIPT standard version 2017071 ePA transaction standard for use by prescribers and plans in the Part D program would impose an additional burden on the industry as a whole. We would also be interested in hearing if implementation of the proposed transactions is a significant change for Part D sponsors which would make a January 1, 2021 implementation date as required by statute not be feasible. We also seek comment on strategies to mitigate burden in order to support successful adoption of this policy. Finally, we seek comment on any additional ways CMS can support plans as they transition to the ePA standard by the 2021 deadline.

III. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.), we are required to provide 60-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the PRA requires that we solicit comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

In this proposed rule we are soliciting public comment on each of these issues for the following sections of the rule that contain proposed “collection of information” requirements as defined under 5 CFR 1320.3(c) of the PRA's implementing regulations.

A. Proposed Information Collection Requirements (ICRs)

The following requirements and burden will be submitted to OMB for approval under control number 0938-0763 (CMS-R-262). Subject to renewal, the control number is currently set to expire on February 28, 2019. It was last approved on February 27, 2018, and remains active.

This rule proposes to implement section 6062 of the SUPPORT for Patients and Communities Act, which require the adoption of technical standards for the Part D e-prescribing program that will help ensure secure ePA requests and response transactions Specifically, the proposed rule would amend the Prescription Drug Benefit program (Part D) regulations to require under § 423.160(b)(7) that Part D plan sponsors (hereinafter, “plans”) have the technical capability to support the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 2017071 when performing electronic ePA for Part D-covered drugs prescribed to Part D-eligible individuals. While this proposed rule will not impact the PA criteria which Part D plans have in place, the electronic process will make the PA process less burdensome for plans and prescribers. Prescribers who are currently using an electronic prescribing software already have access to the ePA transactions and may generally access the proposed transactions without cost, since the eRx software includes all transactions within the NCPDP SCRIPT standard. As ePA is implemented the current system of manual processing (fax and phone calls) will be eliminated, since plans will be able to use this more appropriate standard.

We estimate a one-time cost for plans to implement the necessary changes to support the ePA transactions within NCPDP SCRIPT standard version 2017071. After consulting with industry stakeholders, we have concluded that implementing or building the type of logic which will allow systems engineers to produce the interactive logic which the SCRIPT standard requires can vary based on how the PA criteria are currently documented, but $100,000 is the approximate average cost. The cost varies based on the size and expertise of the plan. This figure includes only the plan's internal costs including labor, initial development and programming, and systems support to transform each of its CMS-approved PA criteria from a free flowing document suitable for implementation by a clinical professional into a step-by-step document that can be adapted for use by programmers. Based on our internal data, we estimate that there are 990 plans. We estimate that only 20 percent (or 198) of the plans (990 plans × 0.20) do not have the internal ePA process that would be required to build the logic into the NCPDP SCRIPT standard's ePA transactions. In that regard we estimate a one-time implementation cost of $19,800,000 (198 plans × $100,000/plan) or $6,600,000 annually when factoring in OMB's 3-year approval period ($19.8 million/3 years). We are annualizing the one-time estimate since we do not anticipate any additional burden after the 3-year approval period expires.

Based on our informal conversations with the industry, we believe that the ongoing cost that plans would incur to process ePA transactions range from $1.20 to $2.85 per transaction, which varies based on vendor and volume. Based on internal CMS data, for the 990 plans we estimate that 560,430 PAs are performed every year and that each authorization requires two individual transactions, one for receiving and one for responding. Using $2.03 as the average cost per transaction ([$1.20 + $2.85]/2) we estimate $4.06 per authorization ($2.03/transaction × 2 transactions/authorization). In aggregate we project an ongoing cost of $2,275,346 annually ($4.06/authorization × 560,430 authorizations) for all plans.

With regard to current practice, the remaining 80 percent (or 792) of the plans (990 plans × 0.80) already have an automated PA process in place. Our review of their cost data indicates that they spend an average of $10.00/fax PA for 448,344 authorizations (560,430 authorizations × 0.80) at a cost of $4,483,440 (448,344 PAs × $10.00/PA). The remaining 198 plans that rely on phone or fax and individual ePA review spend an average of $25.00/manual PA for 112,086 authorizations (560,430 authorizations × 0.20) at a cost of $2,802,150 (112,086 PAs × $25.00/PA). In this regard the transaction cost for the current practice is approximately $7,285,590 ($4,483,440 + $2,802,150).

Outside of the one-time implementation cost, the proposed changes to § 423.160(b)(7) would result in an annual savings of $5,010,244 to Part D plans ($7,285,590 current process − $2,275,346 proposed standard) for the ongoing PA requirements. When considering the one-time cost, we project an annual increase of $8,875,346 ($7,285,590 current process − $5,010,244 proposed standard savings + $6,600,000 one-time cost) for the first 3 years of OMB's approval period.

B. Submission of PRA-Related Comments

We have submitted a copy of this rule to OMB for its review of the rule's proposed information collection requirements and burden. The requirements are not effective until they have been approved by OMB.

To obtain copies of the supporting statement and any related forms for the proposed collections previously discussed, please visit CMS's website at: https://www.cms.gov/​Regulations-andGuidance/​Legislation/​PaperworkReductionActof1995/​PRAListing.html,, or call the Reports Clearance Office at [phone].

We invite public comments on the proposed information collection requirements and burden. If you wish to comment, please submit your comments electronically as specified in the DATES and ADDRESSES sections of this proposed rule and identify the rule (CMS-4189-P) and where applicable the ICR's CFR citation, CMS ID number (CMS-R-262), and OMB control number (OMB 0938-0763).

IV. Regulatory Impact Statement

A. Statement of Need

This rule proposes to implement provisions of the SUPPORT for Patients and Communities Act, which require the adoption of transaction standards for the Part D program that will help ensure secure electronic PA request and response transactions. Specifically, the proposed rule would amend the Prescription Drug Benefit program (Part D) regulations to require that Part D plans sponsors have the technical capability to support the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 2017071 when performing electronic Prior Authorization (ePA) for Part D-covered drugs prescribed to Part D-eligible individuals.

B. Overall Impact

We have examined the impact of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), the Congressional Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017).

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A RIA must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). This rule does not reach the economic threshold and thus is not considered a major rule.

The RFA requires agencies to analyze options for regulatory relief of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of less than $7.5 million to $38.5 million annually. Individuals and states are not included in the definition of a small entity. We are not preparing an analysis for the RFA because we have determined, and the Secretary certifies, that this proposed rule would not have a significant economic impact on a substantial number of small entities.

In addition, section 1102(b) of the Act requires us to prepare an RIA if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 603 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area for Medicare payment regulations and has fewer than 100 beds. We are not preparing an analysis for section 1102(b) of the Act because we have determined, and the Secretary certifies, that this rule would not have a significant impact on the operations of a substantial number of small rural hospitals.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2019, that threshold is approximately $154 million. This rule would have no consequential effect on state, local, or tribal governments or on the private sector.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. Since this rule does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.

If regulations impose administrative costs on reviewers, such as the time needed to read and interpret this final rule, then we should estimate the cost associated with regulatory review. There are currently 750 MA contracts (which also includes PDPs), 50 State Medicaid Agencies, and 200 Medicaid Managed Care Organizations (1,000 reviewers total). We assume each entity will have one designated staff member who will review the entire rule. Other assumptions are possible and will be reviewed after the calculations.

Using the wage information from the Bureau of Labor Statistics (BLS) for medical and health service managers (code 11-9111), we estimate that the cost of reviewing this final rule is $107.38 per hour, including fringe benefits and overhead costs (http://www.bls.gov/​oes/​current/​oes_​nat.htm). Assuming an average reading speed, we estimate that it will take approximately 12.5 hours for each person to review this final rule. For each entity that reviews the rule, the estimated cost is therefore, $1,342 (12.5 hours × $107.38). Therefore, we estimate that the total cost of reviewing this final rule is $1,342,000 ($1,342 × 1,000 reviewers).

Note that this analysis assumed one reader per contract. Some alternatives include assuming one reader per parent entity. Using parent organizations instead of contracts will reduce the number of reviewers to approximately 500 (assuming approximately 250 parent organizations), and this will cut the total cost of reviewing in half. However, we believe it is likely that reviewing will be performed by contract. The argument for this is that a parent organization might have local reviewers; even if that parent organization has several contracts that might have a reader for each distinct geographic region, to be on the lookout for effects of provisions specific to that region.

Executive Order 13771, titled Reducing Regulation and Controlling Regulatory Costs, was issued on January 30, 2017 (82 FR 9339, February 3, 2017). It has been determined that this rule does not impose more than a de minimis costs; and thus, is not a regulatory action for purposes of E.O. 13771.

C. Anticipated Effects

As stated in the previously, section 6062 of the SUPPORT for Patients and Communities Act requires the adoption of technical standards for the Part D program that will ensure secure ePA request and response transactions no later than January 1, 2021. We propose to codify requirements at § 423.160, which would require plans to support the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard version 2017071 by January 1, 2021 when performing electronic ePA for Part D-covered drugs prescribed to Part D-eligible individuals. The proposed rule has the following impacts.

Entities affected by the PA processes include pharmacies receiving ePAs from providers and filling the prescription, prescribers who use ePA, the Medicare Part D Program, Part D plans, EHR vendors who need to modify their products, and the Promoting Interoperability Programs, for any Part D prescribers in these programs. Information about what programs are included in the Medicare Promoting Interoperability Programs is available via this web link: https://www.cms.gov/​Regulations-and-Guidance/​Legislation/​EHRIncentivePrograms/​index.html?​redirect=​/​EHRincentiveprograms.

There are three primary aspects of the provision that could affect its cost and the amount saved. The most immediate cost comes from the one-time implementation cost for the few EHR vendors who need to need to change their programming to use two standards; the NCPDP SCRIPT standard version 2017071 for Part D ePA and the HIPAA standard for other contexts. Based on our conversations with EHR vendors, we believe that it would take the EHR vendors approximately 200 developing hours and 800 programming hours to enable the EHRs to utilize two standards.

We also estimated what it would cost plan sponsors to implement this proposed standard. After consulting with industry stakeholders, we have concluded that implementing or building to the SCRIPT standard can vary, but $100,000 is the approximate amount. We estimate that only 20 percent of the 750 plans would have to make changes to implement their ePA process to implement the SCRIPT ePA process standard, which gives us an approximate one time implementation cost of $15 million (0.2 * 750 * $100,000).

The ongoing cost for plans range from $1.20 to $2.85 per transaction, and vary based on vendor and volume. We estimate that 560,430 PAs are performed every year. If we estimate the average cost per transaction to be $2.03 and each PA requires two transactions, the ongoing cost of ePA would be approximately $2.27 million annually ($2.03 * 560,430 * 2).

The anticipated costs and how they compare to current costs are as follows:

	Plans without automated PA logic	Plans with automated PA processing logic	Total
Annual Maintenance Costs, Paper Process	$2,302,150.00	$3,683,440.00	$5,985,590.00
Annual Maintenance Costs, ePA Process			(2,275,345.80)
Projected Annual Savings			3,710,244.20

It should be noted that the $3,710,244 in cumulative plan savings would be reduced by $100,000 in the first year as plans that have not automated their PA logic move to do so.

We believe that the savings from this rule would be primarily derived from the reduction in time it takes to process a prior-authorization as discussed previously.

E. Alternatives Considered

The SUPPORT for Patients and Communities Act requires the adoption of technical standards by January 1, 2021. We had considered requiring the adoption of the standard by January 1, 2020. However, we want to help ensure that plans have as much time to comply with the statutory mandate as possible.

V. Response to Comments

Because of the large number of public comments we normally receive on Federal Register documents, we are not able to acknowledge or respond to them individually. We will consider all comments we receive by the date and time specified in the DATES section of this preamble, and, when we proceed with a subsequent document, we will respond to the comments in the preamble to that document.

List of Subjects in 42 CFR Part 423

• Administrative practice and procedure
• Emergency medical services
• Health facilities
• Health maintenance organizations (HMO)
• Health professionals
• Medicare
• Penalties
• Privacy, and Reporting and recordkeeping requirements

For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services proposes to amend 42 CFR part 423 as set forth below:

PART 423—VOLUNTARY MEDICARE PRESCRIPTION DRUG BENEFIT

1. The authority citation for part 423 is revised to read as follows:

Authority: 42 U.S.C. 1302, 1306, 1395w-101 through 1395w-152, and 1395hh.

2. Section 423.160 is amended by adding paragraph (b)(7) to read as follows:

§ 423.160

Standards for electronic prescribing.

* * * * *

(b) * * *

(7) Electronic prior authorization. Beginning January 1, 2021, Part D sponsors and prescribers must comply with the National Council for Prescription Drug Programs SCRIPT standard, Implementation Guide Version 2017071 approved July 28, 2017 (incorporated by reference in paragraph (c)(1)(vii) of this section), to provide for the communication of a prescription or related prescription-related information between prescribers and dispensers for the following transactions:

(i) PAInitiationRequest and PAInitiationResponse

(ii) PARequest and PAResponse

(iii) PAAppealRequest and PAAppealResponse

(iv) PACancelRequest and PACancelResponse

* * * * *

Dated: June 11, 2019.

Seema Verma,

Administrator, Centers for Medicare & Medicaid Services.

Dated: June 14, 2019.

Alex M. Azar II,

Secretary, Department of Health and Human Services.