(a) This subpart sets forth State plan requirements and exceptions that pertain to the following administrative requirements and provisions of the Act:

(1) Statewideness—section 1902(a)(1);

(2) Proper and efficient administration—section 1902(a)(4);

(3) Comparability of services—section 1902(a)(10) (B)-(E);

(4) Payment for services furnished outside the State—section 1902(a)(16);

(5) Free choice of providers—section 1902(a)(23);

(6) Special waiver provisions applicable to American Samoa and the Northern Mariana Islands—section 1902(j); and

(7) Exceptions to, and waiver of, State plan requirements—sections 1915 (a)-(c) and 1916 (a)(3) and (b)(3).

(b) Other applicable regulations include the following:

(1) Section 430.25 Waivers of State plan requirements.

(2) Section 440.250 Limits on comparability of services.

(a) Statutory basis. Section 1902(a)(1) of the Act requires a State plan to be in effect throughout the State, and section 1915 permits certain exceptions.

(b) State plan requirements. A State plan must provide that the following requirements are met:

(1) The plan will be in operation statewide through a system of local offices, under equitable standards for assistance and administration that are mandatory throughout the State.

(2) If administered by political subdivisions of the State, the plan will be mandatory on those subdivisions.

(3) The agency will ensure that the plan is continuously in operation in all local offices or agencies through—

(i) Methods for informing staff of State policies, standards, procedures, and instructions;

(ii) Systematic planned examination and evaluation of operations in local offices by regularly assigned State staff who make regular visits; and

(iii) Reports, controls, or other methods.

(c) Exceptions. (1) “Statewide operation” does not mean, for example, that every source of service must furnish the service State-wide. The requirement does not preclude the agency from contracting with a comprehensive health care organization (such as an HMO or a rural health clinic) that serves a specific area of the State, to furnish services to Medicaid beneficiaries who live in that area and chose to receive services from that HMO or rural health clinic. beneficiaries who live in other parts of the State may receive their services from other sources.

(2) Other allowable exceptions and waivers are set forth in §§ 431.54 and 431.55.

[56 FR 8847, Mar. 1, 1991; 56 FR 23022, May 20, 1991]

(a) Statutory basis. This section is based on sections 1902(a)(23), 1902(e)(2), and 1915(a) and (b) and 1932(a)(3) of the Act.

(1) Section 1902(a)(23) of the Act provides that beneficiaries may obtain services from any qualified Medicaid provider that undertakes to provide the services to them.

(2) Section 1915(a) of the Act provides that a State shall not be found out of compliance with section 1902(a)(23) solely because it imposes certain specified allowable restrictions on freedom of choice.

(3) Section 1915(b) of the Act authorizes waiver of the section 1902(a)(23) freedom of choice of providers requirement in certain specified circumstances, but not with respect to providers of family planning services.

(4) Section 1902(a)(23) of the Act provides that a beneficiary enrolled in a primary care case management system or Medicaid managed care organization (MCO) may not be denied freedom of choice of qualified providers of family planning services.

(5) Section 1902(e)(2) of the Act provides that an enrollee who, while completing a minimum enrollment period, is deemed eligible only for services furnished by or through the MCO or PCCM, may, as an exception to the deemed limitation, seek family planning services from any qualified provider.

(6) Section 1932(a) of the Act permits a State to restrict the freedom of choice required by section 1902(a)(23), under specified circumstances, for all services except family planning services.

(b) State plan requirements. A State plan, except the plan for Puerto Rico, the Virgin Islands, or Guam, must provide as follows:

(1) Except as provided under paragraph (c) of this section and part 438 of this chapter, a beneficiary may obtain Medicaid services from any institution, agency, pharmacy, person, or organization that is—

(i) Qualified to furnish the services; and

(ii) Willing to furnish them to that particular beneficiary.

This includes an organization that furnishes, or arranges for the furnishing of, Medicaid services on a prepayment basis.

(2) A beneficiary enrolled in a primary care case-management system, a Medicaid MCO, or other similar entity will not be restricted in freedom of choice of providers of family planning services.

(c) Exceptions. Paragraph (b) of this section does not prohibit the agency from—

(1) Establishing the fees it will pay providers for Medicaid services;

(2) Setting reasonable standards relating to the qualifications of providers; or

(3) Subject to paragraph (b)(2) of this section, restricting beneficiaries' free choice of providers in accordance with one or more of the exceptions set forth in § 431.54, or under a waiver as provided in § 431.55; or

(4) Limiting the providers who are available to furnish targeted case management services defined in § 440.169 of this chapter to target groups that consist solely of individuals with developmental disabilities or with chronic mental illness. This limitation may only be permitted so that the providers of case management services for eligible individuals with developmental disabilities or with chronic mental illness are capable of ensuring that those individuals receive needed services.

(d) Certification requirement—(1) Content of certification. If a State implements a project under one of the exceptions allowed under § 431.54 (d), (e) or (f), it must certify to CMS that the statutory safeguards and requirements for an exception under section 1915(a) of the Act are met.

(2) Timing of certification. (i) For an exception under § 431.54(d), the State may not institute the project until after it has submitted the certification and CMS has made the findings required under the Act, and so notified the State.

(ii) For exceptions under § 431.54 (e) or (f), the State must submit the certificate by the end of the quarter in which it implements the project.

[56 FR 8847, Mar. 1, 1991, as amended at 67 FR 41094, June 14, 2002; 72 FR 68091, Dec. 4, 2007]

(a) Statutory basis. Section 1902(a)(16) of the Act authorizes the Secretary to prescribe State plan requirements for furnishing Medicaid to State residents who are absent from the State.

(b) Payment for services. A State plan must provide that the State will pay for services furnished in another State to the same extent that it would pay for services furnished within its boundaries if the services are furnished to a beneficiary who is a resident of the State, and any of the following conditions is met:

(1) Medical services are needed because of a medical emergency;

(2) Medical services are needed and the beneficiary's health would be endangered if he were required to travel to his State of residence;

(3) The State determines, on the basis of medical advice, that the needed medical services, or necessary supplementary resources, are more readily available in the other State;

(4) It is general practice for beneficiaries in a particular locality to use medical resources in another State.

(c) Cooperation among States. The plan must provide that the State will establish procedures to facilitate the furnishing of medical services to individuals who are present in the State and are eligible for Medicaid under another State's plan.

A State plan must—

(a) Specify that the Medicaid agency will ensure necessary transportation for beneficiaries to and from providers; and

(b) Describe the methods that the agency will use to meet this requirement.

[74 FR 31195, June 30, 2009]

(a) Statutory basis—(1) Section 1915(a) of the Act provides that a State shall not be deemed to be out of compliance with the requirements of sections 1902(a)(1), (10), or (23) of the Act solely because it has elected any of the exceptions set forth in paragraphs (b) and (d) through (f) of this section.

(2) Section 1915(g) of the Act provides that a State may provide, as medical assistance, targeted case management services under the plan without regard to the requirements of sections 1902(a)(1) and 1902(a)(10)(B) of the Act.

(3) Section 1915(i) of the Act provides that a State may provide, as medical assistance, home and community-based services under an approved State plan amendment that meets certain requirements, without regard to the requirements of sections 1902(a)(10)(B) and 1902(a)(10)(C)(i)(III) of the Act, with respect to such services.

(b) Additional services under a prepayment system. If the Medicaid agency contracts on a prepayment basis with an organization that provides services additional to those offered under the State plan, the agency may restrict the provision of the additional services to beneficiaries who live in the area served by the organization and wish to obtain services from it.

(c) [Reserved]

(d) Special procedures for purchase of medical devices and laboratory and X-ray tests. The Medicaid agency may establish special procedures for the purchase of medical devices or laboratory and X-ray tests (as defined in § 440.30 of this chapter) through a competitive bidding process or otherwise, if the State assures, in the certification required under § 431.51(d), and CMS finds, as follows:

(1) Adequate services or devices are available to beneficiaries under the special procedures.

(2) Laboratory services are furnished through laboratories that meet the following requirements:

(i) They are independent laboratories, or inpatient or outpatient hospital laboratories that provide services for individuals who are not hospital patients, or physician laboratories that process at least 100 specimens for other physicians during any calendar year.

(ii) They meet the requirements of subpart M of part 405 or part 482 of this chapter.

(iii) Laboratories that require an interstate license under 42 CFR part 74 are licensed by CMS or receive an exemption from the licensing requirement by the College of American Pathologists. (Hospital and physician laboratories may participate in competitive bidding only with regard to services to non-hospital patients and other physicians' patients, respectively.)

(3) Any laboratory from which a State purchases services under this section has no more than 75 percent of its charges based on services to Medicare beneficiaries and Medicaid beneficiaries.

(e) Lock-in of beneficiaries who over-utilize Medicaid services. If a Medicaid agency finds that a beneficiary has utilized Medicaid services at a frequency or amount that is not medically necessary, as determined in accordance with utilization guidelines established by the State, the agency may restrict that beneficiary for a reasonable period of time to obtain Medicaid services from designated providers only. The agency may impose these restrictions only if the following conditions are met:

(1) The agency gives the beneficiary notice and opportunity for a hearing (in accordance with procedures established by the agency) before imposing the restrictions.

(2) The agency ensures that the beneficiary has reasonable access (taking into account geographic location and reasonable travel time) to Medicaid services of adequate quality.

(3) The restrictions do not apply to emergency services furnished to the beneficiary.

(f) Lock-out of providers. If a Medicaid agency finds that a Medicaid provider has abused the Medicaid program, the agency may restrict the provider, through suspension or otherwise, from participating in the program for a reasonable period of time.

Before imposing any restriction, the agency must meet the following conditions:

(1) Give the provider notice and opportunity for a hearing, in accordance with procedures established by the agency.

(2) Find that in a significant number or proportion of cases, the provider has:

(i) Furnished Medicaid services at a frequency or amount not medically necessary, as determined in accordance with utilization guidelines established by the agency; or

(ii) Furnished Medicaid services of a quality that does not meet professionally recognized standards of health care.

(3) Notify CMS and the general public of the restriction and its duration.

(4) Ensure that the restrictions do not result in denying beneficiaries reasonable access (taking into account geographic location: and reasonable travel time) to Medicaid services of adequate quality, including emergency services.

(g) Targeted case management services. The requirements of § 431.50(b) relating to the statewide operation of a State plan and § 440.240 of this chapter related to comparability of services do not apply with respect to targeted case management services defined in § 440.169 of this chapter.

(h) State plan home and community-based services. The requirements of § 440.240 of this chapter related to comparability of services do not apply with respect to State plan home and community-based services defined in § 440.182 of this chapter.

[56 FR 8847, Mar. 1, 1991, as amended at 72 FR 68091, Dec. 4, 2007; 79 FR 3028, Jan. 16, 2014]

(a) Statutory basis. Section 1915(b) of the Act authorizes the Secretary to waive most requirements of section 1902 of the Act to the extent he or she finds proposed improvements or specified practices in the provision of services under Medicaid to be cost effective, efficient, and consistent with the objectives of the Medicaid program. Sections 1915 (f) and (h) prescribe how such waivers are to be approved, continued, monitored, and terminated. Section 1902(p)(2) of the Act conditions FFP in payments to an entity under a section 1915(b)(1) waiver on the State's provision for exclusion of certain entities from participation.

(b) General requirements. (1) General requirements for submittal of waiver requests, and the procedures that CMS follows for review and action on those requests are set forth in § 430.25 of this chapter.

(2) In applying for a waiver to implement an approvable project under paragraph (c), (d), (e), or (f) of this section, a Medicaid agency must document in the waiver request and maintain data regarding:

(i) The cost-effectiveness of the project;

(ii) The effect of the project on the accessibility and quality of services;

(iii) The anticipated impact of the project on the State's Medicaid program and;

(iv) Assurances that the restrictions on free choice of providers do not apply to family planning services.

(3) No waiver under this section may be granted for a period longer than 2 years, unless the agency requests a continuation of the waiver.

(4) CMS monitors the implementation of waivers granted under this section to ensure that requirements for such waivers are being met.

(i) If monitoring demonstrates that the agency is not in compliance with the requirements for a waiver under this section, CMS gives the agency notice and opportunity for a hearing.

(ii) If, after a hearing, CMS finds an agency to be out of compliance with the requirements of a waiver, CMS terminates the waiver and gives the agency a specified date by which it must demonstrate that it meets the applicable requirements of section 1902 of the Act.

(5) The requirements of section 1902(s) of the Act, with regard to adjustments in payments for inpatient hospital services furnished to infants who have not attained age 1 and to children who have not attained age 6 and who receive these services in disproportionate share hospitals, may not be waived under a section 1915(b) waiver.

(c) Case-management system. (1) Waivers of appropriate requirements of section 1902 of the Act may be authorized for a State to implement a primary care case-management system or specialty physician services system.

(i) Under a primary care case-management system the agency assures that a specific person or persons or agency will be responsible for locating, coordinating, and monitoring all primary care or primary care and other medical care and rehabilitative services on behalf of a beneficiary. The person or agency must comply with the requirements set forth in part 438 of this chapter for primary care case management contracts and systems.

(ii) A specialty physician services system allows States to restrict beneficiaries of specialty services to designated providers of such services, even in the absence of a primary care case-management system.

(2) A waiver under this paragraph (c) may not be approved unless the State's request assures that the restrictions—

(i) Do not apply in emergency situations; and

(ii) Do not substantially impair access to medically necessary services of adequate quality.

(d) Locality as central broker. Waivers of appropriate requirements of section 1902 of the Act may be authorized for a State to allow a locality to act as a central broker to assist beneficiaries in selecting among competing health care plans. States must ensure that access to medically necessary services of adequate quality is not substantially impaired.

(1) A locality is any defined jurisdiction, e.g., district, town, city, borough, county, parish, or State.

(2) A locality may use any agency or agent, public or private, profit or nonprofit, to act on its behalf in carrying out its central broker function.

(e) Sharing of cost savings. (1) Waivers of appropriate requirements of section 1902 of the Act may be authorized for a State to share with beneficiaries the cost savings resulting from the beneficiaries' use of more cost-effective medical care.

(2) Sharing is through the provision of additional services, including—

(i) Services furnished by a plan selected by the beneficiary; and

(ii) Services expressly offered by the State as an inducement for beneficiaries to participate in a primary care case-management system, a competing health care plan or other system that furnishes health care services in a more cost-effective manner.

(f) Restriction of freedom of choice—(1) Waiver of appropriate requirements of section 1902 of the Act may be authorized for States to restrict beneficiaries to obtaining services from (or through) qualified providers or practitioners that meet, accept, and comply with the State reimbursement, quality and utilization standards specified in the State's waiver request.

(2) An agency may qualify for a waiver under this paragraph (f) only if its applicable State standards are consistent with access, quality and efficient and economic provision of covered care and services and the restrictions it imposes—

(i) Do not apply to beneficiaries residing at a long-term care facility when a restriction is imposed unless the State arranges for reasonable and adequate beneficiary transfer.

(ii) Do not discriminate among classes of providers on grounds unrelated to their demonstrated effectiveness and efficiency in providing those services; and

(iii) Do not apply in emergency circumstances.

(3) Demonstrated effectiveness and efficiency refers to reducing costs or slowing the rate of cost increase and maximizing outputs or outcomes per unit of cost.

(4) The agency must make payments to providers furnishing services under a freedom of choice waiver under this paragraph (f) in accordance with the timely claims payment standards specified in § 447.45 of this chapter for health care practitioners participating in the Medicaid program.

(g) [Reserved]

(h) Waivers approved under section 1915(b)(1) of the Act—(1) Basic rules. (i) An agency must submit, as part of it's waiver request, assurance that the entities described in paragraph (h)(2) of this section will be excluded from participation under an approved waiver.

(ii) FFP is available in payments to an entity that furnishes services under a section 1915(b)(1) waiver only if the agency excludes from participation any entity described in paragraph (h)(2) of this section.

(2) Entities that must be excluded. The agency must exclude an entity that meets any of the following conditions:

(i) Could be excluded under section 1128(b)(8) of the Act as being controlled by a sanctioned individual.

(ii) Has a substantial contractual relationship (direct or indirect) with an individual convicted of certain crimes, as described in section 1128(b)(8)(B) of the Act.

(iii) Employs or contracts directly or indirectly with one of the following:

(A) Any individual or entity that, under section 1128 or section 1128A of the Act, is precluded from furnishing health care, utilization review, medical social services, or administrative services.

(B) Any entity described in paragraph (h)(2)(i) of this section.

(3) Definitions. As used in this section, substantial contractual relationship means any contractual relationship that provides for one or more of the following services:

(i) The administration, management, or provision of medical services.

(ii) The establishment of policies, or the provision of operational support, for the administration, management, or provision of medical services.

[56 FR 8847, Mar. 1, 1991, as amended at 59 FR 4599, Feb. 1, 1994; 59 FR 36084, July 15, 1994; 67 FR 41094, June 14, 2002]

(a) Statutory basis. Section 1902(j) of the Act provides for waiver of all but three of the title XIX requirements, in the case of American Samoa and the Northern Mariana Islands.

(b) Waiver provisions. American Samoa or the Northern Mariana Islands may request, and CMS may approve, a waiver of any of the title XIX requirements except the following:

(1) The Federal medical assistance percentage specified in section 1903 of the Act and § 433.10(b) of this chapter.

(2) The limit imposed by section 1108(c) of the Act on the amount of Federal funds payable to American Samoa or the Northern Mariana Islands for care and services that meet the section 1905(a) definition for Medicaid assistance.

(3) The requirement that payment be made only with respect to expenditure made by American Samoa or the Northern Mariana Islands for care and services that meet the section 1905(a) definition of medical assistance.

(a) Application Programming Interface to support Medicaid beneficiaries. A State must implement and maintain a standards-based Application Programming Interface (API) that permits third-party applications to retrieve, with the approval and at the direction of a current beneficiary or the beneficiary's personal representative, data specified in paragraph (b) of this section through the use of common technologies and without special effort from the beneficiary.

(b) Accessible content. A State must make the following information accessible to its current beneficiaries or the beneficiary's personal representative through the API described in paragraph (a) of this section:

(1) Data concerning adjudicated claims, including claims data for payment decisions that may be appealed, were appealed, or are in the process of appeal, and provider remittances and beneficiary cost-sharing pertaining to such claims, no later than one (1) business day after a claim is processed;

(2) Encounter data no later than one (1) business day after receiving the data from providers, other than MCOs, PIHPs, and PAHPs, compensated on the basis of capitation payments;

(3) All data classes and data elements included in a content standard in 45 CFR 170.213 that are maintained by the State no later than 1 business day after the State receives the data; and

(4) Information about covered outpatient drugs and updates to such information, including, where applicable, preferred drug list information, no later than one (1) business day after the effective date of any such information or updates to such information.

(5) Beginning January 1, 2027, the information in paragraph (b)(5)(i) of this section about prior authorizations for items and services (excluding drugs as defined in paragraph (b)(6) of this section), according to the timelines in paragraph (b)(5)(ii) of this section.

(i) The prior authorization request and decision, including all of the following, as applicable:

(A) The prior authorization status.

(B) The date the prior authorization was approved or denied.

(C) The date or circumstance under which the prior authorization ends.

(D) The items and services approved.

(E) If denied, a specific reason why the request was denied.

(F) Related structured administrative and clinical documentation submitted by a provider.

(ii) The information in paragraph (b)(5)(i) of this section must—

(A) Be accessible no later than 1 business day after the State receives a prior authorization request;

(B) Be updated no later than 1 business day after any status change; and

(C) Continue to be accessible for the duration that the authorization is active and at least 1 year after the prior authorization's last status change.

(6) Drugs are defined for the purposes of paragraph (b)(5) of this section as any and all drugs covered by the State.

(c) Technical requirements. A State implementing an API under paragraph (a) of this section:

(1) Must implement and maintain API technology conformant with 45 CFR 170.215(a)(1), (b)(1)(i), (c)(1), and (e)(1);

(2) Must conduct routine testing and monitoring, and update as appropriate, to ensure the API functions properly, including assessments to verify that the API is fully and successfully implementing privacy and security features such as, but not limited to, those required to comply with HIPAA privacy and security requirements in 45 CFR parts 160 and 164, 42 CFR parts 2 and 3, and other applicable law protecting the privacy and security of individually identifiable data;

(3) Must comply with the content and vocabulary standards requirements in paragraphs (c)(3)(i) and (ii) of this section, as applicable to the data type or data element, unless alternate standards are required by other applicable law:

(i) Content and vocabulary standards at 45 CFR 170.213 where such standards are applicable to the data type or element, as appropriate; and

(ii) Content and vocabulary standards at 45 CFR part 162 and § 423.160 of this chapter where required by law, or where such standards are applicable to the data type or element, as appropriate.

(4) May use an updated version of any standard or all standards required under paragraph (c)(1) or (3) of this section, where:

(i) Use of the updated version of the standard is required by other applicable law, or

(ii) Use of the updated version of the standard is not prohibited under other applicable law, provided that:

(A) For content and vocabulary standards other than those at 45 CFR 170.213, the Secretary has not prohibited use of the updated version of a standard for purposes of this section or 45 CFR part 170;

(B) For standards at 45 CFR 170.213 and 45 CFR 170.215, the National Coordinator has approved the updated version for use in the ONC Health IT Certification Program; and

(C) Using the updated version of the standard, implementation guide, or specification does not disrupt an end user's ability to access the data specified in paragraph (b) of this section or §§ 431.61, 431.70, and 431.80, through the required APIs.

(d) Documentation requirements for APIs. For each API implemented in accordance with paragraph (a) of this section, a State must make publicly accessible, by posting directly on its website or via publicly accessible hyperlink(s), complete accompanying documentation that contains, at a minimum the information listed in this paragraph. For the purposes of this section, “publicly accessible” means that any person using commonly available technology to browse the internet could access the information without any preconditions or additional steps, such as a fee for access to the documentation; a requirement to receive a copy of the material via email; a requirement to register or create an account to receive the documentation; or a requirement to read promotional material or agree to receive future communications from the organization making the documentation available;

(1) API syntax, function names, required and optional parameters supported and their data types, return variables and their types/structures, exceptions and exception handling methods and their returns;

(2) The software components and configurations an application must use in order to successfully interact with the API and process its response(s); and

(3) All applicable technical requirements and attributes necessary for an application to be registered with any authorization server(s) deployed in conjunction with the API.

(e) Denial or discontinuation of access to the API. A State may deny or discontinue any third-party application's connection to the API required under paragraph (a) of this section if the State:

(1) Reasonably determines, consistent with its security risk analysis under 45 CFR part 164 subpart C, that allowing an application to connect or remain connected to the API would present an unacceptable level of risk to the security of protected health information on the State's systems; and

(2) Makes this determination using objective, verifiable criteria that are applied fairly and consistently across all apps and developers through which parties seek to access electronic health information, as defined in 45 CFR 171.102, including but not limited to criteria that rely on automated monitoring and risk mitigation tools.

(f) Reporting on Patient Access API usage. Beginning in 2026, by March 31 of each year, a State must report to CMS the following metrics, in the form of aggregated, de-identified data, for the previous calendar year at the State level in the form and manner specified by the Secretary:

(1) The total number of unique beneficiaries whose data are transferred via the Patient Access API to a health app designated by the beneficiary; and

(2) The total number of unique beneficiaries whose data are transferred more than once via the Patient Access API to a health app designated by the beneficiary.

(g) Data availability. (1) The State must comply with the requirements in paragraph (a) through (f) of this section beginning January 1, 2021 with regard to data:

(i) With a date of service on or after January 1, 2016; and

(ii) That are maintained by the State.

(2) [Reserved]

(h) Applicability. A State must comply with the requirements in paragraphs (a) through (e) and (g) of this section beginning January 1, 2021, and with the requirements in paragraph (f) of this section beginning in 2026, with regard to data:

(1) With a date of service on or after January 1, 2016; and

(2) That are maintained by the State.

[85 FR 25634, May 1, 2020, as amended at 89 FR 8977, Feb. 8, 2024]

(a) Application programming interface to support data exchange from payers to providers—Provider Access API. Beginning January 1, 2027, unless granted an extension or exemption under paragraph (c) of this section, a State must do the following:

(1) API requirements. Implement and maintain an application programming interface (API) conformant with all of the following:

(i) Section 431.60(c)(2) through (4), (d), and (e).

(ii) The standards in 45 CFR 170.215(a)(1), (b)(1)(i), (c)(1), and (d)(1).

(2) Provider access. Make the data specified in § 431.60(b) with a date of service on or after January 1, 2016, excluding provider remittances and beneficiary cost-sharing information, that are maintained by the State available to enrolled Medicaid providers via the API required in paragraph (a)(1) of this section no later than 1 business day after receiving a request from such a provider, if all the following conditions are met:

(i) The State authenticates the identity of the provider that requests access and attributes the beneficiary to the provider under the attribution process described in paragraph (a)(3) of this section.

(ii) The beneficiary does not opt out as described in paragraph (a)(4) of this section.

(iii) Disclosure of the data is not prohibited by other applicable law.

(3) Attribution. Establish and maintain a process to associate beneficiaries with their enrolled Medicaid providers to enable data exchange via the Provider Access API.

(4) Opt out and patient educational resources. (i) Establish and maintain a process to allow a beneficiary or the beneficiary's personal representative to opt out of the data exchange described in paragraph (a)(2) of this section and to change their permission at any time. That process must be available before the first date on which the State makes beneficiary information available via the Provider Access API and at any time while the beneficiary is enrolled with the State.

(ii) Provide information to beneficiaries in plain language about the benefits of API data exchange with their providers, their opt out rights, and instructions both for opting out of data exchange and for subsequently opting in, as follows:

(A) Before the first date on which the State makes beneficiary information available through the Provider Access API.

(B) No later than 1 week after enrollment.

(C) At least annually.

(D) In an easily accessible location on its public website.

(5) Provider resources. Provide on its website and through other appropriate provider communications, information in plain language explaining the process for requesting beneficiary data using the Provider Access API required in paragraph (a)(1) of this section. The resources must include information about how to use the State's attribution process to associate beneficiaries with their providers.

(b) Application programming interface to support data exchange between payers—Payer-to-Payer API. Beginning January 1, 2027, unless granted an extension or exemption under paragraph (c) of this section, a State must do the following:

(1) API requirements. Implement and maintain an API conformant with all of the following:

(i) Section 431.60(c)(2) through (4), (d), and (e).

(ii) The standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (d)(1).

(2) Opt in. Establish and maintain a process to allow beneficiaries or their personal representatives to opt into the State's payer to payer data exchange with the beneficiary's previous payer(s), described in paragraphs (b)(4) and (5) of this section, and with concurrent payer(s), described in paragraph (b)(6) of this section, and to change their permission at any time.

(i) The opt in process must be offered as follows:

(A) To current beneficiaries, no later than the compliance date.

(B) To new beneficiaries, no later than 1 week after enrollment.

(ii) If a beneficiary has coverage through any Medicaid MCO, prepaid inpatient health plan (PIHP), or prepaid ambulatory health plan (PAHP) within the same State while enrolled in Medicaid, the State must share their opt in permission with those MCO, PIHP, or PAHP to allow the Payer-to-Payer API data exchange described in this section.

(iii) If a beneficiary does not respond or additional information is necessary, the State must make reasonable efforts to engage with the beneficiary to collect this information.

(3) Identify previous and concurrent payers. Establish and maintain a process to identify a new beneficiary's previous and concurrent payer(s) to facilitate the Payer-to-Payer API data exchange. The information request process must start as follows:

(i) For current beneficiaries, no later than the compliance date.

(ii) For new beneficiaries, no later than 1 week after enrollment.

(iii) If a beneficiary does not respond or additional information is necessary, the State must make reasonable efforts to engage with the beneficiary to collect this information.

(4) Exchange request requirements. Exchange beneficiary data with other payers, consistent with the following requirements:

(i) The State must request the data specified in paragraph (b)(4)(ii) of this section through the beneficiary's previous payers' API, if all the following conditions are met:

(A) The beneficiary has opted in, as described in paragraph (b)(2) of this section, except for data exchanges between a State Medicaid agency and its contracted MCOs, PIHPs, or PAHPs, which do not require a beneficiary to opt in.

(B) The exchange is not prohibited by other applicable law.

(ii) The data to be requested are all of the following with a date of service within 5 years before the request:

(A) Data specified in § 431.60(b), excluding the following:

(1) Provider remittances and enrollee cost-sharing information.

(2) Denied prior authorizations.

(B) Unstructured administrative and clinical documentation submitted by a provider related to prior authorizations.

(iii) The State must include an attestation with this request affirming that the beneficiary is enrolled with the State and has opted into the data exchange.

(iv) The State must complete this request as follows:

(A) No later than 1 week after the payer has sufficient identifying information about previous payers and the beneficiary has opted in.

(B) At a beneficiary's request, within 1 week of the request.

(v) The State must receive, through the API required in paragraph (b)(1) of this section, and incorporate into its records about the beneficiary, any data made available by other payers in response to the request.

(5) Exchange response requirements. Make available the data specified in paragraph (b)(4)(ii) of this section that are maintained by the State to other payers via the API required in paragraph (b)(1) of this section within 1 business day of receiving a request, if all the following conditions are met:

(i) The payer that requests access has its identity authenticated and includes an attestation with the request that the patient is enrolled with the payer and has opted into the data exchange.

(ii) Disclosure of the data is not prohibited by other applicable law.

(6) Concurrent coverage data exchange requirements. When a beneficiary has provided sufficient identifying information about concurrent payers and has opted in as described in paragraph (b)(2) of this section, a State must do the following, through the API required in paragraph (b)(1) of this section:

(i) Request the beneficiary's data from all known concurrent payers as described in paragraph (b)(4) of this section, and at least quarterly thereafter while the beneficiary is enrolled with both payers.

(ii) Respond as described in paragraph (b)(5) of this section within 1 business day of a request from any concurrent payers. If agreed upon with the requesting payer, the State may exclude any data that were previously sent to or originally received from the concurrent payer.

(7) Patient educational resources. Provide information to applicants or beneficiaries in plain language, explaining at a minimum: the benefits of Payer-to-Payer API data exchange, their ability to opt in or withdraw that permission, and instructions for doing so. The State must provide the following resources:

(i) When requesting a beneficiary's permission for Payer-to-Payer API data exchange, as described in paragraph (b)(2) of this section.

(ii) At least annually, in appropriate mechanisms through which it ordinarily communicates with current beneficiaries.

(iii) In an easily accessible location on its public website.

(c) Extensions and exemptions—(1) Extension. (i) A State may submit a written application to request a one-time, 1-year extension of the requirements in paragraph (a) or (b) of this section (or paragraphs (a) and (b)) for its Medicaid fee-for-service (FFS) program. The written application must be submitted as part of the State's annual Advance Planning Document (APD) for Medicaid Management Information System (MMIS) operations expenditures described in part 433, subpart C, of this chapter, and approved before the compliance date for the requirements to which the State is seeking an extension. It must include all the following:

(A) A narrative justification describing the specific reasons why the State cannot satisfy the requirement(s) by the compliance date and why those reasons result from circumstances that are unique to the agency operating the Medicaid FFS program.

(B) A report on completed and ongoing State activities that evidence a good faith effort towards compliance.

(C) A comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(ii) CMS grants the State's request if it determines, based on the information provided, that—

(A) The request adequately establishes a need to delay implementation; and

(B) The State has a comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(2) Exemption. (i) A State operating a Medicaid program in which at least 90 percent of the State's Medicaid beneficiaries are enrolled in Medicaid managed care organizations, as defined in § 438.2 of this chapter, may request an exemption for its FFS program from either or both of the following requirement(s):

(A) Paragraph (a) of this section.

(B) Paragraphs (b)(1) and (3) through (7) of this section.

(ii) The State's exemption request must:

(A) Be submitted in writing as part of a State's annual APD for MMIS operations expenditures before the compliance date for the requirements to which the State is seeking an exemption.

(B) Include both of the following:

(1) Documentation that the State meets the threshold for the exemption, based on enrollment data from the most recent CMS “Medicaid Managed Care Enrollment and Program Characteristics” (or successor) report.

(2) An alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iii) CMS grants the exemption if the State establishes to CMS's satisfaction that the State—

(A) Meets the threshold for the exemption; and

(B) Has established an alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iv) The State's exemption expires if either—

(A) Based on the 3 previous years of available, finalized Medicaid Transformed Medicaid Statistical Information System (T-MSIS) managed care and FFS enrollment data, the State's managed care enrollment for 2 of the previous 3 years is below 90 percent; or

(B)(1) CMS has approved a State plan amendment, waiver, or waiver amendment that would significantly reduce the percentage of beneficiaries enrolled in managed care; and

(2) The anticipated shift in enrollment is confirmed by the first available, finalized Medicaid T-MSIS managed care and FFS enrollment data.

(v) If a State's exemption expires under paragraph (c)(2)(iv) of this section, the State is required to do both of the following—

(A) Submit written notification to CMS that the State no longer qualifies for the exemption within 90 days of the finalization of annual Medicaid T-MSIS managed care enrollment data that demonstrates that there has been the requisite shift from managed care enrollment to FFS enrollment resulting in the State's managed care enrollment falling below the 90 percent threshold.

(B) Obtain CMS approval of a timeline for compliance with the requirements in paragraph (a) or (b) (or paragraph0s (a) and (b)) of this section within 2 years of the expiration of the exemption.

[89 FR 8977, Feb. 8, 2024]

(a) The State must implement and maintain a publicly accessible, standards-based Application Programming Interface (API) that is conformant with the technical requirements at § 431.60(c), excluding the security protocols related to user authentication and authorization and any other protocols that restrict the availability of this information to particular persons or organizations, the documentation requirements at § 431.60(d), and is accessible via a public-facing digital endpoint on the State's website.

(b) The API must provide a complete and accurate directory of—

(1) The State's provider directory information specified in section 1902(a)(83) of the Act, updated no later than 30 calendar days after the State receives provider directory information or updates to provider directory information.

(2) [Reserved]

(c) This section is applicable beginning January 1, 2021.

[85 FR 25635, May 1, 2020]

(a) Communicating a reason for denial. Beginning January 1, 2026, if the State denies a prior authorization request (excluding a request for coverage of drugs as defined in § 431.60(b)(6)), in accordance with the timeframes established in § 440.230(e)(1) of this chapter, the response to the provider must include a specific reason for the denial, regardless of the method used to communicate that information.

(b) Prior Authorization Application Programming Interface (API). Unless granted an extension or exemption under paragraph (c) of this section, beginning January 1, 2027, a State must implement and maintain an API conformant with § 431.60(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that—

(1) Is populated with the State's list of covered items and services (excluding drugs, as defined in § 431.60(b)(6)) that require prior authorization;

(2) Can identify all documentation required by the State for approval of any items or services that require prior authorization;

(3) Supports a HIPAA-compliant prior authorization request and response, as described in 45 CFR part 162; and

(4) Communicates the following information about prior authorization requests:

(i) Whether the State—

(A) Approves the prior authorization request (and the date or circumstance under which the authorization ends);

(B) Denies the prior authorization request; or

(C) Requests more information.

(ii) If the State denies the prior authorization request, it must include a specific reason for the denial.

(c) Extensions and exemptions—(1) Extension. (i) A State may submit a written application to request a one-time, 1-year extension of the requirements in paragraph (b) of this section for its Medicaid FFS program. The written application must be submitted as part of the State's annual APD for MMIS operations expenditures described in part 433, subpart C, of this chapter; and approved before the compliance date in paragraph (b) of this section. It must include all the following:

(A) A narrative justification describing the specific reasons why the State cannot satisfy the requirement(s) by the compliance date and why those reasons result from circumstances that are unique to the agency operating the Medicaid FFS program.

(B) A report on completed and ongoing State activities that evidence a good faith effort towards compliance.

(C) A comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(ii) CMS grants the State's request if it determines, based on the information provided, that—

(A) The request adequately establishes a need to delay implementation; and

(B) The State has a comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(2) Exemption. (i) A State operating a Medicaid program in which at least 90 percent of the State's Medicaid beneficiaries are enrolled in Medicaid managed care organizations, as defined in § 438.2 of this chapter, may request an exemption for its FFS program from the requirements in paragraph (b) of this section.

(ii) The State's exemption request must:

(A) Be submitted in writing as part of a State's annual APD for MMIS operations expenditures before the compliance date in paragraph (b) of this section.

(B) The State's request must include both of the following:

(1) Documentation that the State meets the threshold for the exemption, based on enrollment data from the most recent CMS “Medicaid Managed Care Enrollment and Program Characteristics” (or successor) report.

(2) An alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iii) CMS grants the exemption if the State establishes to CMS's satisfaction that the State—

(A) Meets the threshold for the exemption; and

(B) Has established an alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iv) The State's exemption expires if either—

(A) Based on the 3 previous years of available, finalized Medicaid Transformed Medicaid Statistical Information System (T-MSIS) managed care and FFS enrollment data, the State's managed care enrollment for 2 of the previous 3 years is below 90 percent; or

(B)(1) CMS has approved a State plan amendment, waiver, or waiver amendment that would significantly reduce the percentage of beneficiaries enrolled in managed care; and

(2) The anticipated shift in enrollment is confirmed by the first available, finalized Medicaid T-MSIS managed care and FFS enrollment data.

(v) If a State's exemption expires under paragraph (c)(2)(iv) of this section, the State is required to do both of the following—

(A) Submit written notification to CMS that the State no longer qualifies for the exemption within 90 days of the finalization of annual Medicaid T-MSIS managed care enrollment data that demonstrates that there has been the requisite shift from managed care enrollment to FFS enrollment resulting in the State's managed care enrollment falling below the 90 percent threshold.

(B) Obtain CMS approval of a timeline for compliance with the requirements in paragraph (b) of this section within 2 years of the expiration of the exemption.

[89 FR 8979, Feb. 8, 2024]